Cloudflare integration

Overview

Cloudflare is a CDN, DNS, security, and edge-compute platform. The Automize connector talks to the Cloudflare API v4 – zones, DNS records, page rules, firewall, cache purges, Workers, R2 buckets, and KV namespaces – using a scoped API token.

• Regions: Single global API at api.cloudflare.com/client/v4. R2 endpoints are region-aware (auto, wnam, enam, weur, eeur, apac); zone and DNS endpoints are global with edge propagation in seconds.
• Plans: DNS, page rules, firewall, cache purge, and Workers/KV listing work on Free. R2 needs a paid subscription. Some Enterprise-only fields (Argo, Spectrum, Magic Transit) are skipped silently if your plan doesn't include them.

Setting up the connection

Auth type: Bearer Token.

1. In Cloudflare → My Profile → API Tokens, click Create Token and use the 'Edit zone DNS' template or build a custom token.
2. Grant Zone:Read on All zones (or specific zones), plus the permissions for each action you'll call: DNS:Edit, Page Rules:Edit, Firewall Services:Edit, Cache Purge, Workers Scripts:Edit, R2 Admin Read & Write, etc.
3. Copy the token and paste it as the API token. Never paste your Global API Key – it has unbounded scope and is an audit finding.
4. Use the Verify Token action immediately after pasting to confirm scope and active status – the token list in the dashboard doesn't show last-used cleanly.

Find your credentials at https://dash.cloudflare.com/profile/api-tokens.

Rate limits

1200 requests / 5 minutes per user (4 req/sec average), measured per token. The connector parses the X-RateLimit-Remaining header and backs off proactively before hitting the cap. Cache Purge has a stricter cap of 1000 URLs / 30s for the purge_files variant.

Data model

Cloudflare's API is split between account-level and zone-level
resources:

    Account     → R2 buckets, Workers scripts, KV namespaces,
                  Pages projects, account-wide audit logs
    Zone        → DNS records, page rules, firewall rules,
                  cache purge, SSL certs, WAF rules

Identifiers:

    account_id       hex string, /accounts/{account_id}/...
    zone_id          hex string, /zones/{zone_id}/...
    DNS record_id    UUID-style, lives under a zone
    R2 bucket name   globally unique across all of Cloudflare
    script_id        Workers script name, scoped to an account

Most endpoints expect EITHER account_id OR zone_id – never both.
Get User returns the list of accounts + zones your token can
reach; treat that as the authoritative scope check.

All responses follow the envelope {"success": bool, "errors": [...],
"messages": [...], "result": <payload>, "result_info": {...}}.
Pagination lives under result_info.page / per_page / total_count.

Available operations

20 operations available. Click any row to jump to its detail.

Operations

Create DNS Record

Add a new DNS record

Tips

• Body needs type, name (FQDN), content, ttl (1 = automatic), proxied (boolean – only meaningful for A/AAAA/CNAME).
• CAA, SRV, and MX use structured 'data' objects, not the bare 'content' field.

Errors

• 9007 – DNS Validation Error – A/AAAA content must be an IP; CNAME content must be a hostname.
• 81057 – Record already exists – Cloudflare blocks duplicate (type, name, content) tuples by default.
• 1004 – DNS Validation: content too long (TXT > 2048 chars). Split into multiple records or use a longer chunk format.

Create R2 Bucket

Create a new R2 bucket

Tips

• Body: name (3-63 chars, lowercase/digits/hyphens), locationHint (auto|wnam|enam|weur|eeur|apac), storageClass (Standard|InfrequentAccess).
• locationHint determines the primary region – replication is automatic. Setting wrong region adds latency for your origin reads but is otherwise harmless.

Errors

• 10006 – Bucket already exists – names are global. Pick a different name.
• 10004 – Invalid name format – must match ^[a-z0-9][-a-z0-9]{2,62}$.

Create Zone

Add a new zone to the account

Tips

• Body needs name (FQDN, root only – not subdomains) and account.id. type=full (default) or partial (CNAME setup).
• After create, the API returns Cloudflare's nameservers under name_servers[]. The zone stays in status=pending until DNS delegation flips at the registrar.

Errors

• 1097 – Zone is already hosted on another Cloudflare account – move it via account transfer, not a new create.
• 1061 – Plan is not authorised for the requested feature (e.g. partial setup on Free).

Delete DNS Record

Delete a DNS record

Tips

• Immediate, no soft-delete. If a DNS record disappears from the dashboard mid-flow, suspect a deploy script that re-syncs from source-of-truth without diffing first.

Delete R2 Bucket

Delete an R2 bucket (must be empty)

Tips

• Bucket MUST be empty. Object-level operations (delete all objects) are S3-compatible – use an aws-s3 credential pointing at https://<account>.r2.cloudflarestorage.com to empty first.

Delete Zone

Delete a zone

Tips

• DELETE /zones/{zone_id} – IRREVERSIBLE. Removes the zone, all DNS records, page rules, firewall rules, and analytics history.
• Re-adding a deleted zone is a clean Create + DNS-delegation flip again.

Get DNS Record

Get a single DNS record

Tips

• GET /zones/{zone_id}/dns_records/{record_id} – single record by ID. Useful in update flows where you fetched the ID from a list call.

Get User

Get the authenticated user's details

No input parameters.

Tips

• GET /user – returns the authenticated identity (User Service tokens) or the bound user (User API tokens).
• Useful as a 'who is this credential' echo after a Verify Token success – pairs nicely for incident triage.

Get Worker Script

Get a Worker script's metadata

Tips

• GET /accounts/{account_id}/workers/scripts/{script_name} – returns the raw JS or module bundle. Heavy response if your Worker is large.
• Useful for cross-environment diffs (production vs staging Worker source).

Get Zone

Get details of a single zone

Tips

• GET /zones/{zone_id} – full zone metadata including plan, nameservers, original_registrar, paused state.
• Use this to confirm a zone_id is real before kicking off a chain of DNS/page-rule edits.

List DNS Records

List DNS records for a zone

Tips

• Pagination + filters: type=A|AAAA|CNAME|MX|TXT|SRV|CAA, name=record.example.com, content=<value>, proxied=true|false.
• match=any (default) or all when you pass multiple filters.

List Firewall Rules

List WAF custom rules for a zone (rulesets entry-point)

Tips

• Returns the zone's firewall rules + their filter expressions. action= filter (block | allow | challenge | js_challenge | log | bypass).
• The legacy 'Firewall Rules' API is being superseded by 'Rulesets' – the connector targets the legacy endpoint for compatibility, which still works but may be migrated in 2026.

List KV Namespaces

List Workers KV namespaces

Tips

• Workers KV namespaces (per-account). Use the account_id-scoped endpoint.
• Returns namespace IDs; key-level ops (get/put/list keys) are NOT in this connector – use direct REST or the Workers binding inside a Worker.

List Page Rules

List page rules for a zone

Tips

• GET /zones/{zone_id}/pagerules – order matters; first-match wins. priority lower = evaluated first.
• Page Rules cap at 3 on Free, 20 on Pro, 50 on Business, 125 on Enterprise. List returns active + disabled.

List R2 Buckets

List R2 storage buckets on the account

Tips

• Per-account; requires R2 Admin Read permission on the token.
• R2 buckets are global namespaces – bucket names are unique across all of Cloudflare, not just your account.

List Workers Scripts

List Worker scripts on the account

Tips

• GET /accounts/{account_id}/workers/scripts – returns deployed Worker scripts with their created_on / modified_on timestamps.
• Doesn't return the script body – use Get Workers Script for that.

List Zones

List zones on the account

No input parameters.

Tips

• Returns zones the token can see. Filter by name=example.com, status=active, account.id=<accountId>.
• Pagination is page= + per_page= (max 50). Default order is name asc.

Purge Cache

Purge the Cloudflare cache for a zone (by URL, tag, host, or purge-everything)

Tips

• Three variants: purge_everything=true, files=[urls...], tags=[cache-tag,...]. Tags are Enterprise-only.
• Files must be exact URLs including query string; partial matches don't fire. Up to 30 URLs per call (1000 if your account is Enterprise).
• purge_everything is the nuclear option – invalidates the whole zone's edge cache and triggers a cache-miss storm. Prefer targeted purges.

Update DNS Record

Update an existing DNS record

Tips

• PUT /zones/{zone_id}/dns_records/{record_id} – full replace. PATCH is also supported by Cloudflare but the connector uses PUT for predictability; send the full record body.
• Set proxied=false to disable orange-cloud routing per record without touching the zone-level setting.

Verify Token

Verify the supplied API token

No input parameters.

Tips

• Call this first after pasting a token – confirms it's active and lists the permissions it carries. Tokens that are 'expired' or 'revoked' fail every other call with 6111.
• Cheap health-check for monitoring; no body, no side effects.

FAQ

Global API Key vs API Token – which should I use?

Always API Token. The Global API Key has unbounded scope, can't be rotated without breaking every integration that uses it, and shows up in compliance audits. Tokens are scoped, revocable, and logged per call.

Why does my DNS record not propagate?

Cloudflare's edge is sub-minute; if name resolution lags, the issue is downstream – recursive resolver TTL, your local DNS cache, or a wildcard record overriding it. Use a 1.1.1.1 lookup directly to confirm CF's authoritative state.

How do I purge a single page including its query string?

Send the full URL including ?utm_source=... in files[]. Cloudflare hashes the entire URL including the query for cache keys, so /page and /page?x=1 are different cache entries.

R2 vs S3 – does the connector talk to R2 directly?

These actions cover R2 management (create/delete/list buckets). Object-level R2 operations (put/get/list objects) are S3-compatible – point an aws-s3 credential at https://<account>.r2.cloudflarestorage.com instead.

Token Validation Failed (10000) on a token I just made?

Cloudflare's token cache takes 30-60s to propagate after creation. Wait a minute and retry. If it persists, the token was scoped to a zone that's not on the account – recreate without the zone-specific scope.

Related connectors

• Aws-s3
• Vercel
• Netlify