{"openapi":"3.1.0","info":{"title":"Cloudflare Zero Trust (BYOK) API","version":"0.1.0","description":"Cloudflare Zero Trust (BYOK) lets an AI assistant read your own Cloudflare Zero Trust data through the Cloudflare Zero Trust API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 9 tools (list_access_apps, list_access_policies, list_access_groups, list_identity_providers, list_service_tokens, list_gateway_rules, list_gateway_lists, list_gateway_locations,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-cloudflare-zero-trust.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-cloudflare-zero-trust/docs"},"termsOfService":"https://connectorbay.com/byok-cloudflare-zero-trust/terms"},"servers":[{"url":"https://byok-cloudflare-zero-trust.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-cloudflare-zero-trust/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_access_apps":{"post":{"operationId":"list_access_apps","summary":"List Cloudflare Access applications with type, domain, audience tag, session duration and destinations. Use for \"Which a","description":"List Cloudflare Access applications with type, domain, audience tag, session duration and destinations. Use for \"Which applications are protected by Cloudflare Access\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only applications with this name.","title":"Name"},"domain":{"anyOf":[{"maxLength":253,"type":"string"},{"type":"null"}],"default":null,"description":"Only applications with this domain.","title":"Domain"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search by name, domain or audience tag.","title":"Search"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_access_appsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_access_policies":{"post":{"operationId":"list_access_policies","summary":"List reusable Access policies with decision (allow, deny, bypass, non_identity), session duration and how many apps use ","description":"List reusable Access policies with decision (allow, deny, bypass, non_identity), session duration and how many apps use each. Rule contents (emails) are not returned. Use for \"Which reusable Access policies exist and how many apps use them\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_access_policiesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_access_groups":{"post":{"operationId":"list_access_groups","summary":"List Access groups (reusable rule sets) by name and dates. The include, exclude and require rules are not returned. Use ","description":"List Access groups (reusable rule sets) by name and dates. The include, exclude and require rules are not returned. Use for \"Which Access groups are defined\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only groups with this name.","title":"Name"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search by name.","title":"Search"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_access_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_identity_providers":{"post":{"operationId":"list_identity_providers","summary":"List the identity providers connected to Access (Okta, Google, GitHub, SAML ...) with type and whether SCIM is on. Clien","description":"List the identity providers connected to Access (Okta, Google, GitHub, SAML ...) with type and whether SCIM is on. Client secrets are not returned. Use for \"Which identity providers does Cloudflare Access use\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"scim_enabled":{"anyOf":[{"enum":["true","false"],"type":"string"},{"type":"null"}],"default":null,"description":"Set to true to list only providers with SCIM provisioning on.","title":"Scim Enabled"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_identity_providersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_service_tokens":{"post":{"operationId":"list_service_tokens","summary":"List Access service tokens with client id, enabled flag, duration, expiry and last use. Token secrets are not shown by t","description":"List Access service tokens with client id, enabled flag, duration, expiry and last use. Token secrets are not shown by the API. Use for \"Which Access service tokens are about to expire\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only tokens with this name.","title":"Name"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search by name.","title":"Search"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_service_tokensArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_gateway_rules":{"post":{"operationId":"list_gateway_rules","summary":"List Zero Trust Gateway rules (DNS, HTTP and network filtering) with action, precedence, enabled flag and traffic expres","description":"List Zero Trust Gateway rules (DNS, HTTP and network filtering) with action, precedence, enabled flag and traffic expression. Identity expressions are not returned. Use for \"Which Gateway rules block traffic and in what order\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"order_by":{"anyOf":[{"enum":["name","created_at","updated_at","precedence"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort field.","title":"Order By"},"direction":{"anyOf":[{"enum":["asc","desc"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort direction.","title":"Direction"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search by rule name.","title":"Search"}},"required":["account_id"],"title":"list_gateway_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_gateway_lists":{"post":{"operationId":"list_gateway_lists","summary":"List Zero Trust lists (domains, URLs, IPs, emails ...) with type and item count. The list entries themselves are not ret","description":"List Zero Trust lists (domains, URLs, IPs, emails ...) with type and item count. The list entries themselves are not returned. Use for \"Which Gateway lists do I maintain and how big are they\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"type":{"anyOf":[{"enum":["SERIAL","URL","DOMAIN","EMAIL","IP","CATEGORY","LOCATION","DEVICE","AAGUID"],"type":"string"},{"type":"null"}],"default":null,"description":"Only lists of this type.","title":"Type"},"order_by":{"anyOf":[{"enum":["name","created_at","updated_at","item_count"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort field.","title":"Order By"},"direction":{"anyOf":[{"enum":["asc","desc"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort direction.","title":"Direction"}},"required":["account_id"],"title":"list_gateway_listsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_gateway_locations":{"post":{"operationId":"list_gateway_locations","summary":"List Gateway DNS locations with default flag, DNS-over-HTTPS subdomain and EDNS client subnet support. Use for \"Which Ga","description":"List Gateway DNS locations with default flag, DNS-over-HTTPS subdomain and EDNS client subnet support. Use for \"Which Gateway DNS locations are configured\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_gateway_locationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_tunnels":{"post":{"operationId":"list_tunnels","summary":"List Cloudflare Tunnels with status (healthy, degraded, down, inactive), type and when connections were last active. Use","description":"List Cloudflare Tunnels with status (healthy, degraded, down, inactive), type and when connections were last active. Use for \"Are my Cloudflare Tunnels healthy\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only tunnels with this name.","title":"Name"},"status":{"anyOf":[{"enum":["inactive","degraded","healthy","down"],"type":"string"},{"type":"null"}],"default":null,"description":"Only tunnels in this state.","title":"Status"},"is_deleted":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True to list deleted tunnels instead of live ones.","title":"Is Deleted"},"per_page":{"anyOf":[{"maximum":100,"minimum":5,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results per page (5 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1; result_info.total_count says how many exist.","title":"Page"}},"required":["account_id"],"title":"list_tunnelsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}