# Cloudflare integration

> Manage Cloudflare zones, DNS records, firewall lockdown rules, rulesets (WAF/rate limiting), DNSSEC, and account settings.

- Authentication: apiKey

## Tools (244)

- **Add Pages Domain**: Attach a custom domain to a Pages project.
- **Bulk Delete KV**: Delete up to 10,000 keys from a Workers KV namespace in a single request.
- **Bulk Write KV**: Write up to 10,000 keys to a Workers KV namespace in a single request.
- **Create Access Application**: Create a new Cloudflare Access application protecting a domain or resource.
- **Create Access Group**: Create a reusable Access group of rules.
- **Create Access Identity Provider**: Add a new identity provider (Okta, Google, SAML, OIDC, etc.) to Cloudflare Access.
- **Create Access Policy**: Attach a new policy (allow/deny/bypass rule) to a Cloudflare Access application.
- **Create Access Service Token**: Create a new service token for non-interactive access to Cloudflare Access apps.
- **Create Cloudflare Tunnel**: Create a new Cloudflare Tunnel.
- **Create Custom Hostname**: Register a customer hostname for SSL provisioning and routing.
- **Create D1 Database**: Create a new D1 (serverless SQLite) database.
- **Create DNS Record**: Add a new DNS record (A, AAAA, CNAME, MX, TXT, SRV, CAA, etc.) to a Cloudflare zone.
- **Create Email Destination Address**: Add a new destination address. Sends a verification email; address can't be used as a forwarding target until verified.
- **Create Email Routing Rule**: Create a routing rule that forwards or drops incoming mail.
- **Create IP Access Rule**: Create an IP Access Rule (block/allow/challenge an IP, range, ASN, or country).
- **Create KV Namespace**: Create a new Workers KV namespace.
- **Create Load Balancer**: Create a Cloudflare Load Balancer for a zone.
- **Create Load Balancer Monitor**: Create a health-check monitor for use by load balancer pools.
- **Create Load Balancer Pool**: Create an origin pool for use by load balancers.
- **Create Logpush Job**: Create a Logpush job to stream logs to your storage destination.
- **Create Notification Policy**: Create a notification policy to alert on Cloudflare events.
- **Create Origin CA Certificate**: Mint a new Origin CA certificate from a CSR, for installation on the origin server.
- **Create Page Rule**: Create a Page Rule that matches a URL pattern and applies actions (cache, forwarding, SSL, etc.).
- **Create Pages Deployment**: Trigger a new deployment for a Pages project (Git rebuild or direct-upload).
- **Create Pages Project**: Create a new Cloudflare Pages project (direct-upload or Git-connected).
- **Create Queue**: Create a new Cloudflare Queue.
- **Create Queue Consumer**: Register a Worker script as a push consumer for a Queue.
- **Create R2 Bucket**: Create a new R2 bucket. Returns immediately; bucket is usable as soon as the API returns.
- **Create Rule in Ruleset**: Append or insert a single rule into an existing ruleset without resending the rest.
- **Create Ruleset**: Create a new Cloudflare ruleset at account or zone scope (custom WAF, rate-limit, transform, etc.).
- **Create Spectrum Application**: Create a Spectrum application to proxy a TCP/UDP port through Cloudflare.
- **Create Tunnel Route**: Create a private-network route for a Cloudflare Tunnel.
- **Create Turnstile Widget**: Create a Turnstile widget (sitekey + secret pair) for use on your domains.
- **Create Virtual Network**: Create a virtual network namespace for overlapping CIDR support.
- **Create Waiting Room**: Create a virtual waiting room for traffic spikes (drops, sales, launches).
- **Create Worker Route**: Bind a URL pattern on a zone to a Worker script.
- **Create Zone**: Add a new zone (domain) to a Cloudflare account. Returns the zone's ID and required nameservers.
- **Create Zone Lockdown Rule**: Create a Zone Lockdown rule restricting access to URL patterns to a specific list of IPs or CIDR ranges.
- **Delete Access Application**: Delete a Cloudflare Access application and all its policies.
- **Delete Access Policy**: Delete a policy from a Cloudflare Access application.
- **Delete Certificate Pack**: Delete an Advanced certificate pack. The Universal pack cannot be deleted (it auto-regenerates).
- **Delete Cloudflare Image**: Delete an image from Cloudflare Images.
- **Delete Cloudflare Tunnel**: Delete a Cloudflare Tunnel. All active connections close.
- **Delete Custom Certificate**: Remove a custom SSL certificate from a zone.
- **Delete Custom Hostname**: Remove a custom hostname. Cloudflare stops routing the customer domain and revokes its certificate.
- **Delete D1 Database**: Permanently delete a D1 database and all its data.
- **Delete DNS Record**: Remove a specific DNS record from a Cloudflare zone.
- **Delete DNSSEC**: Remove DNSSEC records and configuration for a zone. Do this after disabling DNSSEC at the registrar.
- **Delete Email Destination Address**: Remove a destination address. Any rules forwarding to it stop delivering.
- **Delete Email Routing Rule**: Delete an email routing rule.
- **Delete IP Access Rule**: Delete an IP Access Rule.
- **Delete KV Value**: Delete a single key from a Workers KV namespace.
- **Delete Load Balancer**: Delete a Cloudflare Load Balancer.
- **Delete Load Balancer Monitor**: Delete a health-check monitor. Pools using it lose active health checking.
- **Delete Load Balancer Pool**: Delete an origin pool. Cannot delete if referenced by any load balancer.
- **Delete Logpush Job**: Delete a Logpush job.
- **Delete mTLS Certificate**: Delete an mTLS CA certificate.
- **Delete Page Rule**: Permanently remove a Page Rule from a zone.
- **Delete Pages Deployment**: Delete a Pages deployment. Cannot delete the active production deployment.
- **Delete Pages Domain**: Detach a custom domain from a Pages project.
- **Delete Pages Project**: Permanently delete a Pages project and all its deployments.
- **Delete Queue**: Delete a Queue and discard any in-flight messages.
- **Delete Queue Consumer**: Detach a consumer from a Queue.
- **Delete R2 Bucket**: Delete an R2 bucket. Bucket must be empty — all objects must be deleted first via S3 API.
- **Delete Rule from Ruleset**: Remove a specific rule from a ruleset, returning the updated ruleset.
- **Delete Ruleset**: Delete all versions of a ruleset at account or zone scope.
- **Delete Spectrum Application**: Delete a Spectrum application.
- **Delete Stream Video**: Delete a video from Cloudflare Stream.
- **Delete Tunnel Connections**: Force-close all cloudflared connections for a tunnel (so it can be deleted).
- **Delete Tunnel Route**: Delete a private-network route from a Cloudflare Tunnel.
- **Delete Virtual Network**: Delete a virtual network. Cannot delete the default VNET.
- **Delete Waiting Room**: Delete a waiting room. Traffic flows through unqueued.
- **Delete Worker Route**: Remove a Worker route binding from a zone.
- **Delete Worker Script**: Permanently delete a Worker script and all of its bindings.
- **Delete Worker Secret**: Remove a secret binding from a Worker script.
- **Delete Zone**: Permanently delete a Cloudflare zone. This removes all DNS records and configuration for the domain.
- **Disable Email Routing**: Disable Email Routing on a zone.
- **Enable Email Routing**: Enable Email Routing on a zone (provisions MX/SPF/DKIM DNS records).
- **Export DNS Records (BIND)**: Download all DNS records for a zone as a BIND-format zone file (text/plain).
- **Get Access Application**: Retrieve a single Cloudflare Access application by ID.
- **Get Account**: Retrieve a single account's details: name, type, settings (2FA enforcement, abuse contact, etc.).
- **Get Account Member**: Fetch a single account member by member ID, including assigned roles and user info.
- **Get Always Online Status**: Check if Always Online (serve from Internet Archive when origin is down) is enabled.
- **Get Audit Logs**: Retrieve audit logs for the account (who did what, when, from where).
- **Get Cache Reserve Status**: Check Cache Reserve enablement (persistent edge cache backed by R2).
- **Get Catch-All Rule**: Get the catch-all rule (applied when no other rule matches).
- **Get Certificate Pack**: Retrieve a single certificate pack by ID, including validation records, status, and contained certificates.
- **Get Cloudflare IP Addresses**: Retrieve the public list of IPv4 and IPv6 CIDR ranges used by Cloudflare's edge network (or JD Cloud).
- **Get Cloudflare Tunnel**: Retrieve a single Cloudflare Tunnel by ID, including active connections and connector versions.
- **Get Custom Certificate**: Retrieve metadata for a single custom certificate (issuer, hosts, status, expiry).
- **Get Custom Hostname**: Retrieve a single custom hostname's certificate status, validation records, and metadata.
- **Get D1 Database**: Retrieve a single D1 database's metadata (size, table count, version).
- **Get Development Mode**: Check Development Mode status (bypasses cache for 3 hours).
- **Get DNS Record**: Fetch a single DNS record by ID, including type, name, content, TTL, proxy state, and metadata.
- **Get DNSSEC**: Read the current DNSSEC configuration (status, DS record, algorithm) for a zone.
- **Get Email Routing DNS Records**: Get the MX/SPF/DKIM DNS records Email Routing needs (to verify or manually configure).
- **Get Email Routing Settings**: Get Email Routing status and MX/SPF DNS verification for a zone.
- **Get Email Routing Subdomain Status**: Check whether Email Routing has been configured at a subdomain level.
- **Get Entrypoint Ruleset Version**: Fetch a specific historical version of an entry point (phase) ruleset for audit, comparison, or rollback analysis.
- **Get Fallback Origin**: Get the fallback origin for the zone (the CNAME target your customers point at).
- **Get Load Balancer Analytics Events**: Retrieve load balancing analytics events (origin failovers, health changes).
- **Get Origin CA Certificate**: Retrieve a single Origin CA certificate by ID.
- **Get Page Rule**: Fetch a single Page Rule by ID, including target pattern, actions, priority, and status.
- **Get Pages Deployment**: Retrieve a single Pages deployment by ID, including stage status.
- **Get Pages Deployment Logs**: Retrieve the build logs for a Pages deployment.
- **Get Page Shield Settings**: Get Page Shield settings (client-side script monitoring) for a zone.
- **Get Pages Project**: Retrieve a single Pages project by name, including build config, deployments, and domains.
- **Get Pool Health Status**: Get the health status of each origin in a pool, per-region.
- **Get R2 Bucket**: Retrieve a single R2 bucket's metadata by name.
- **Get R2 Bucket Usage**: Get object count and total size for an R2 bucket.
- **Get Regional Tiered Cache Setting**: Read the current Regional Tiered Cache (tc_regional) status for a zone.
- **Get Ruleset**: Fetch the latest version of a ruleset by ID at account or zone scope.
- **Get SSL Verification**: List the certificate validation records (TXT/HTTP) currently outstanding for a zone — used to issue/renew SSL certs.
- **Get Stream Video**: Retrieve a Stream video by UID, including its status and playback URLs.
- **Get Tiered Cache Settings**: Get smart/regional tiered cache configuration.
- **Get Tunnel Configuration**: Retrieve the ingress rules and warp-routing config for a dashboard-managed tunnel.
- **Get Tunnel Token**: Retrieve the connector token for a Cloudflare Tunnel.
- **Get Universal SSL Settings**: Read whether Universal SSL is enabled for the zone.
- **Get User Audit Logs**: Retrieve audit logs for the current user (own actions only).
- **Get User Details**: Retrieve the caller's Cloudflare user profile — email, name, two-factor status, locale, and verification state.
- **Get Waiting Room Status**: Get live status (queue depth, active users) of a waiting room.
- **Get Worker Cron Triggers**: List the cron schedules currently attached to a Worker script.
- **Get Worker Script Content**: Download the source of a Worker script. Returns multipart/form-data for module workers, plain JS for service-worker format.
- **Get Workers Subdomain**: Read the account's workers.dev subdomain (e.g. `myaccount.workers.dev`).
- **Get Zone Details**: Retrieve full metadata for a single zone by ID, including plan, owner, name servers, and activation status.
- **Get Zone Lockdown Rule**: Fetch a single Zone Lockdown rule by ID.
- **Get Zone Setting**: Get a specific zone setting value.
- **Import DNS Records (BIND)**: Upload a BIND-format zone file to bulk-import DNS records into a Cloudflare zone.
- **Invite Account Member**: Send an invitation to add a new user to an account with a specified role.
- **List Access Applications**: List Cloudflare Access applications (Zero Trust protected apps) for an account.
- **List Access Groups**: List reusable Access groups (named rule bundles for policies).
- **List Access Identity Providers**: List configured identity providers (Okta, Google, OneLogin, etc.) for an account.
- **List Access Policies**: List policies attached to a Cloudflare Access application.
- **List Access Service Tokens**: List service tokens for non-interactive (machine) access to Access-protected apps.
- **List Account Members**: List all members of an account, with roles, status, and contact info.
- **List Account Roles**: List the available roles in an account (Administrator, Super Administrator, Billing, etc.) with their permission scopes.
- **List Accounts**: List Cloudflare accounts the API token can see, with name, type, and membership metadata.
- **List All Zone Settings**: Get every zone setting in one call.
- **List Audit Logs**: Query audit log entries for an account — every API/UI action performed by members, with actor, resource, and timestamp.
- **List Bot Management Settings**: Get Bot Management configuration for a zone.
- **List Certificate Packs**: List the SSL certificate packs (Universal + Advanced Certificate Manager) attached to a zone.
- **List Cloudflare Images**: List images uploaded to Cloudflare Images.
- **List Cloudflare Tunnels**: List Cloudflare Tunnels (cloudflared connectors) for an account.
- **List Custom Certificates**: List custom (BYO) SSL certificates uploaded to a zone for use with custom hostnames / SaaS.
- **List Custom Hostnames**: List custom hostnames (Cloudflare for SaaS) configured on a zone.
- **List D1 Databases**: List all D1 (serverless SQLite) databases in an account.
- **List DNS Records**: List, filter, and search DNS records for a zone with rich query parameters and pagination.
- **List Email Destination Addresses**: List verified destination addresses for email routing (account-scoped).
- **List Email Routing Rules**: List routing rules (match patterns + destination addresses) for a zone.
- **List Email Routing Workers**: List Workers eligible to receive Email Routing actions on this account.
- **List Healthcheck**: List standalone health checks (independent of Load Balancing, used for notifications).
- **List IP Access Rules**: List IP Access Rules (zone or account-level allowlist/blocklist).
- **List KV Keys**: List keys in a Workers KV namespace, with optional prefix filtering and cursor pagination.
- **List KV Namespaces**: List all Workers KV namespaces in an account.
- **List Load Balancer Monitors**: List health-check monitors (configurations) for load balancer pools.
- **List Load Balancer Pools**: List origin pools (groups of origin servers) for the account.
- **List Load Balancers**: List Cloudflare Load Balancers for a zone.
- **List Logpush Jobs**: List Logpush jobs (streaming log delivery to your storage).
- **List mTLS Certificates**: List client certificates uploaded for mTLS (mutual TLS) authentication on custom hostnames or Workers.
- **List Notification Policies**: List configured alert/notification policies for the account.
- **List Origin CA Certificates**: List Cloudflare Origin CA certificates — internally-issued certs to install on your origin server for Full (strict) mode.
- **List Page Rules**: List Page Rules for a zone (legacy URL-pattern matching engine). Prefer Rulesets for new work.
- **List Pages Deployments**: List deployments for a Pages project.
- **List Pages Domains**: List custom domains attached to a Pages project.
- **List Page Shield Scripts**: List third-party scripts Page Shield has detected loading on the zone.
- **List Pages Projects**: List all Cloudflare Pages projects in an account.
- **List Queue Consumers**: List the Workers and HTTP pull endpoints registered to consume messages from a Queue.
- **List Queues**: List all Cloudflare Queues in an account.
- **List R2 Buckets**: List all R2 buckets in an account, with name, creation date, and location.
- **List Rate Limits**: List zone-level rate limit rules (legacy v1; new rules go through WAF).
- **List Spectrum Applications**: List Spectrum applications (TCP/UDP proxy configurations) for a zone.
- **List Stream Videos**: List videos uploaded to Cloudflare Stream.
- **List Tunnel Connections**: List the active cloudflared connector connections for a tunnel.
- **List Tunnel Routes**: List private-network routes (IP CIDR blocks) routed through Cloudflare Tunnels.
- **List Turnstile Widgets**: List Turnstile (CAPTCHA replacement) widgets configured for the account.
- **List Virtual Networks**: List virtual networks (for overlapping CIDR support across tunnels).
- **List WAF Packages**: List managed WAF rule packages (e.g. OWASP, Cloudflare Specials) for a zone.
- **List Waiting Rooms**: List virtual waiting rooms configured on a zone.
- **List Worker Routes**: List all Worker routes (URL pattern → Worker script bindings) for a zone.
- **List Worker Scripts**: List all Worker scripts in an account, with names, modification times, and usage models.
- **List Worker Secrets**: List the names of secrets bound to a Worker script. Values are never returned.
- **List Zones**: List, search, filter, and sort the Cloudflare zones your API token can see.
- **Logs Retrieval (Logpull)**: Pull raw HTTP request logs for a time range via the Logpull API.
- **Order Advanced Certificate Pack**: Order an Advanced Certificate Manager pack — request a new SSL cert with custom hostnames, CA, and validity period.
- **Overwrite DNS Record**: Replace a DNS record completely (PUT). All fields must be provided; omitted fields revert to defaults.
- **Overwrite Page Rule**: Replace a Page Rule completely (PUT). All fields must be provided.
- **Preview Monitor**: Test a monitor configuration against pool origins without saving it.
- **Purge All Cache**: Purge everything from the zone's edge cache.
- **Purge Cache**: Purge Cloudflare's cache for a zone — by URL, hostname, cache-tag, prefix, or everything.
- **Purge Cache by Tag, Host, or Prefix**: Purge cache entries matching cache tags, hostnames, or URL prefixes (Enterprise).
- **Purge Cache by URL**: Purge specific URLs from the edge cache.
- **Put Worker Secret**: Create or replace a secret binding on a Worker script.
- **Query D1 Database**: Execute one or more SQL statements against a D1 database via REST.
- **Query GraphQL Analytics**: Query Cloudflare's GraphQL analytics API for request/threat/cache metrics.
- **Read KV Metadata**: Read the metadata JSON attached to a Workers KV key (without retrieving the value).
- **Read KV Value**: Read a value from a Workers KV namespace by key.
- **Remove Account Member**: Remove a member from an account. Idempotent — re-running on an already-removed member is fine.
- **Rename KV Namespace**: Change a KV namespace's title.
- **Rerun Zone Activation Check**: Trigger a fresh activation check on a pending zone (used after updating registrar nameservers).
- **Restart Certificate Pack Validation**: Trigger Cloudflare to re-check pending validation records on a certificate pack (e.g. after publishing the required TXT).
- **Retry Pages Deployment**: Re-run a failed Pages deployment from the same source commit.
- **Revoke Origin CA Certificate**: Revoke an Origin CA certificate (e.g. private key compromise).
- **Rollback Pages Deployment**: Promote a previous deployment to be the active production (or preview) deployment.
- **Scan DNS Records**: Run Cloudflare's automatic DNS scan against the zone's existing nameservers to import discovered records.
- **Send Message Batch to Queue**: Publish up to 100 messages to a Queue in a single request.
- **Send Message to Queue**: Publish a single message to a Cloudflare Queue.
- **Update Access Application**: Update a Cloudflare Access application's configuration.
- **Update Access Policy**: Update an existing Access policy's rules or decision.
- **Update Account**: Update an account's name, settings (2FA enforcement, abuse contact, default nameservers).
- **Update Account Member**: Change a member's assigned roles or status (e.g. re-send invitation).
- **Update Bot Management Settings**: Configure Bot Management behavior (Bot Fight Mode, AI bot protection, action on automation).
- **Update Cache Reserve**: Enable or disable Cache Reserve.
- **Update Catch-All Rule**: Update the catch-all rule's action (forward, drop, or hand off to a Worker).
- **Update Custom Certificate**: Replace the certificate body, private key, or change geo/policy of an existing custom cert.
- **Update Custom Hostname**: Update SSL method, origin, metadata, or settings on a custom hostname.
- **Update DNS Record**: Patch a DNS record's fields without resending the rest (PATCH). Use Overwrite DNS Record (PUT) to replace the full object.
- **Update DNSSEC Status**: Enable, disable, or configure DNSSEC (NSEC3, multi-signer, presigned) for a zone.
- **Update Email Routing Rule**: Update a rule's matchers, actions, or enabled state.
- **Update Fallback Origin**: Set or change the fallback origin for the zone.
- **Update Load Balancer**: Update a Cloudflare Load Balancer.
- **Update Load Balancer Pool**: Update an origin pool's members or health settings.
- **Update Multiple Zone Settings**: Patch many zone settings in a single request.
- **Update Page Rule**: Patch a single Page Rule's fields (PATCH). Use Overwrite Page Rule (PUT) to fully replace.
- **Update Page Shield Settings**: Enable or configure Page Shield on a zone.
- **Update Pages Project**: Update a Pages project's build config, environment variables, or Git source.
- **Update Queue**: Update a Queue's name or delivery settings.
- **Update Rule in Ruleset**: Modify or reorder a single rule inside a ruleset without touching the other rules.
- **Update Ruleset**: Replace a ruleset's rules and metadata, creating a new version. Submitted rules replace ALL existing rules.
- **Update Tunnel Configuration**: Update the ingress rules for a dashboard-managed Cloudflare Tunnel.
- **Update Universal SSL Settings**: Enable or disable Universal SSL for a zone.
- **Update Waiting Room**: Update a waiting room's thresholds, queueing method, or HTML.
- **Update Worker Cron Triggers**: Replace the full set of cron schedules attached to a Worker script.
- **Update Worker Route**: Replace a Worker route's pattern or target script.
- **Update Workers Subdomain**: Claim or change the account's workers.dev subdomain (one-time, per account).
- **Update Zone**: Edit a single property of a Cloudflare zone (paused state, type, or vanity name servers).
- **Update Zone Lockdown Rule**: Replace the URL patterns and allowed IPs/CIDRs of an existing Zone Lockdown rule.
- **Update Zone Setting**: Update a specific zone setting (e.g. SSL mode, security level, cache TTL).
- **Upload Cloudflare Image**: Upload an image directly to Cloudflare Images.
- **Upload Custom Certificate**: Upload a custom SSL certificate (BYO certificate from a CA outside Cloudflare). Business or Enterprise plan.
- **Upload mTLS Certificate**: Upload a CA certificate for use as an mTLS trust anchor.
- **Upload Stream Video URL**: Upload a video to Cloudflare Stream by URL (Cloudflare fetches it).
- **Upload Worker Script**: Create or update a Worker script (module worker via multipart/form-data, or service-worker format via JS body).
- **Validate Custom Hostname Ownership**: Force re-validation of a custom hostname's ownership / DCV record.
- **Write KV Value**: Write or replace a single key/value in Workers KV, with optional TTL and metadata.

## Related prompts

- [Nightly AbuseIPDB threat list sync to Cloudflare firewall](https://www.generalinput.com/prompts/nightly-abuseipdb-threat-list-sync-to-cloudflare-firewall.md)
- [Weekly Cloudflare WAF and traffic security digest in Slack](https://www.generalinput.com/prompts/weekly-cloudflare-waf-and-traffic-security-digest-in-slack.md)
- [Provision tenant subdomains from Airtable in Cloudflare](https://www.generalinput.com/prompts/provision-tenant-subdomains-from-airtable-in-cloudflare.md)
- [Weekly Cloudflare DNS drift report in Slack](https://www.generalinput.com/prompts/weekly-cloudflare-dns-drift-report-in-slack.md)
- [Slack alerts for risky Cloudflare changes](https://www.generalinput.com/prompts/slack-alerts-for-risky-cloudflare-changes.md)
- [Catch expiring SSL certificates before they cause outages](https://www.generalinput.com/prompts/catch-expiring-ssl-certificates-before-they-cause-outages.md)

Connect Cloudflare in General Input: https://www.generalinput.com/apps/cloudflare