APIs.io Engineering Platform Zero Trust Organization API

openapi: 3.2.0
info:
  description: 'To get started using Cloudflare''s products and services via the API, refer to [how to interact with Cloudflare](https://developers.cloudflare.com/fundamentals/basic-tasks/interact-with-cloudflare/), which covers using tools like [Terraform](https://developers.cloudflare.com/terraform/#cloudflare-terraform) and the [official SDKs](https://developers.cloudflare.com/fundamentals/api/reference/sdks/) to maintain your Cloudflare resources.


    Using the Cloudflare API requires authentication so that Cloudflare knows who is making requests and what permissions you have. Create an API token to grant access to the API to perform actions.


    To create an API token, from the Cloudflare dashboard, go to My Profile > API Tokens and select Create Token. For more information on how to create and troubleshoot API tokens, refer to

    our [API fundamentals](https://developers.cloudflare.com/fundamentals/api/).


    Totally new to Cloudflare? [Start here](https://developers.cloudflare.com/fundamentals/get-started/).'
  license:
    name: BSD-3-Clause
    url: https://opensource.org/licenses/BSD-3-Clause
  title: APIs.io Engineering Platform Cloudflare Zero Trust Organization API
  version: 4.0.0
tags:
- name: Zero Trust Organization
paths:
  /accounts/{account_id}/access/organizations:
    get:
      description: Returns the configuration for your Zero Trust organization.
      operationId: zero-trust-organization-get-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get your Zero Trust organization response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Get your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Revoke'
      - 'Access: Organizations, Identity Providers, and Groups Write'
      - 'Access: Organizations, Identity Providers, and Groups Read'
    post:
      description: Sets up a Zero Trust organization for your account.
      operationId: zero-trust-organization-create-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                allow_authenticate_via_warp:
                  $ref: '#/components/schemas/access_allow_authenticate_via_warp'
                auth_domain:
                  $ref: '#/components/schemas/access_auth_domain'
                auto_redirect_to_identity:
                  $ref: '#/components/schemas/access_auto_redirect_to_identity'
                is_ui_read_only:
                  $ref: '#/components/schemas/access_is_ui_read_only'
                login_design:
                  $ref: '#/components/schemas/access_login_design'
                name:
                  $ref: '#/components/schemas/access_name'
                session_duration:
                  $ref: '#/components/schemas/access_session_duration'
                ui_read_only_toggle_reason:
                  $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
                user_seat_expiration_inactive_time:
                  $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
                warp_auth_session_duration:
                  $ref: '#/components/schemas/access_warp_auth_session_duration'
              required:
              - name
              - auth_domain
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Create your Zero Trust organization response failure
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Create your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Create your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Write'
    put:
      description: Updates the configuration for your Zero Trust organization.
      operationId: zero-trust-organization-update-your-zero-trust-organization
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                allow_authenticate_via_warp:
                  $ref: '#/components/schemas/access_allow_authenticate_via_warp'
                auth_domain:
                  $ref: '#/components/schemas/access_auth_domain'
                auto_redirect_to_identity:
                  $ref: '#/components/schemas/access_auto_redirect_to_identity'
                custom_pages:
                  $ref: '#/components/schemas/access_custom_pages'
                is_ui_read_only:
                  $ref: '#/components/schemas/access_is_ui_read_only'
                login_design:
                  $ref: '#/components/schemas/access_login_design'
                name:
                  $ref: '#/components/schemas/access_name'
                session_duration:
                  $ref: '#/components/schemas/access_session_duration'
                ui_read_only_toggle_reason:
                  $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
                user_seat_expiration_inactive_time:
                  $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
                warp_auth_session_duration:
                  $ref: '#/components/schemas/access_warp_auth_session_duration'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update your Zero Trust organization response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_single_response'
          description: Update your Zero Trust organization response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update your Zero Trust organization
      tags:
      - Zero Trust Organization
      x-api-token-group:
      - 'Access: Organizations, Identity Providers, and Groups Write'
  /accounts/{account_id}/access/organizations/doh:
    get:
      description: Returns the DoH settings for your Zero Trust organization.
      operationId: zero-trust-organization-get-your-zero-trust-organization-doh-settings
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get your Zero Trust organization DoH settings response failure
        '200':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_schemas-single_response'
                - properties:
                    result:
                      properties:
                        jwt_duration:
                          description: 'The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account.'
                          example: 800h
                          type: string
          description: Get your Zero Trust organization DoH settings response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get your Zero Trust organization DoH settings
      tags:
      - Zero Trust Organization
    put:
      description: Updates the DoH settings for your Zero Trust organization.
      operationId: zero-trust-organization-update-your-zero-trust-organization-doh-settings
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                jwt_duration:
                  $ref: '#/components/schemas/access_doh_jwt_duration'
                service_token_id:
                  description: The uuid of the service token you want to use for DoH authentication
                  example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
                  type: string
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update your Zero Trust organization DoH settings response failure
        '201':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_schemas-single_response'
                - properties:
                    result:
                      properties:
                        jwt_duration:
                          $ref: '#/components/schemas/access_doh_jwt_duration'
          description: Update your Zero Trust organization DoH settings response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update your Zero Trust organization DoH settings
      tags:
      - Zero Trust Organization
  /accounts/{account_id}/access/organizations/revoke_user:
    post:
      description: Revokes a user's access across all applications.
      operationId: zero-trust-organization-revoke-all-access-tokens-for-a-user
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              properties:
                email:
                  description: The email of the user to revoke.
                  example: test@example.com
                  type: string
              required:
              - email
        required: true
      responses:
        4xx:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Revoke all Access tokens for a user response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_empty_response'
          description: Revoke all Access tokens for a user response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Revoke all Access tokens for a user
      tags:
      - Zero Trust Organization
components:
  schemas:
    access_login_design:
      properties:
        background_color:
          description: The background color on your login page.
          example: '#c5ed1b'
          type: string
        footer_text:
          description: The text at the bottom of your login page.
          example: This is an example description.
          type: string
        header_text:
          description: The text at the top of your login page.
          example: This is an example description.
          type: string
        logo_path:
          description: The URL of the logo on your login page.
          example: https://example.com/logo.png
          type: string
        text_color:
          description: The text color on your login page.
          example: '#c5ed1b'
          type: string
    access_timestamp:
      example: '2014-01-01T05:20:00.12345Z'
      format: date-time
      type: string
    access_auto_redirect_to_identity:
      default: false
      description: When set to `true`, users skip the identity provider selection step during login.
      type: boolean
    access_uuid:
      description: UUID
      example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
      maxLength: 36
      type: string
    access_identifier:
      description: Identifier
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      type: string
    access_custom_pages:
      properties:
        forbidden:
          description: The uid of the custom page to use when a user is denied access after failing a non-identity rule.
          example: 699d98642c564d2e855e9661899b7252
          type: string
        identity_denied:
          description: The uid of the custom page to use when a user is denied access.
          example: 699d98642c564d2e855e9661899b7252
          type: string
    access_doh_jwt_duration:
      description: 'The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h'
      example: 800h
      type: string
    access_is_ui_read_only:
      description: Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
      example: 'false'
      type: boolean
    access_allow_authenticate_via_warp:
      description: When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
      example: 'false'
      type: boolean
    access_name:
      description: The name of your Zero Trust organization.
      example: Widget Corps Internal Applications
      type: string
    access_session_duration:
      description: 'The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.'
      example: 24h
      type: string
    access_service-tokens:
      properties:
        client_id:
          $ref: '#/components/schemas/access_client_id'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        duration:
          $ref: '#/components/schemas/access_duration'
        expires_at:
          $ref: '#/components/schemas/access_timestamp'
        id:
          allOf:
          - description: The ID of the service token.
          - $ref: '#/components/schemas/access_uuid'
        name:
          $ref: '#/components/schemas/access_schemas-name'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      type: object
    access_api-response-common-failure:
      properties:
        errors:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example:
          - code: 7003
            message: No route for the URI
          minLength: 1
        messages:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example: []
        result:
          enum:
          - null
          type:
          - object
          - 'null'
        success:
          description: Whether the API call was successful
          enum:
          - false
          example: false
          type: boolean
      required:
      - success
      - errors
      - messages
      - result
      type: object
    access_ui_read_only_toggle_reason:
      description: A description of the reason why the UI read only field is being toggled.
      example: Temporarily turn off the UI read only lock to make a change via the UI
      type: string
    access_user_seat_expiration_inactive_time:
      description: 'The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.'
      example: 730h
      type: string
    access_auth_domain:
      description: The unique subdomain assigned to your Zero Trust organization.
      example: test.cloudflareaccess.com
      type: string
    access_messages:
      example: []
      items:
        properties:
          code:
            minimum: 1000
            type: integer
          message:
            type: string
        required:
        - code
        - message
        type: object
        uniqueItems: true
      type: array
    access_organizations:
      properties:
        allow_authenticate_via_warp:
          $ref: '#/components/schemas/access_allow_authenticate_via_warp'
        auth_domain:
          $ref: '#/components/schemas/access_auth_domain'
        auto_redirect_to_identity:
          $ref: '#/components/schemas/access_auto_redirect_to_identity'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        custom_pages:
          $ref: '#/components/schemas/access_custom_pages'
        is_ui_read_only:
          $ref: '#/components/schemas/access_is_ui_read_only'
        login_design:
          $ref: '#/components/schemas/access_login_design'
        name:
          $ref: '#/components/schemas/access_name'
        session_duration:
          $ref: '#/components/schemas/access_session_duration'
        ui_read_only_toggle_reason:
          $ref: '#/components/schemas/access_ui_read_only_toggle_reason'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
        user_seat_expiration_inactive_time:
          $ref: '#/components/schemas/access_user_seat_expiration_inactive_time'
        warp_auth_session_duration:
          $ref: '#/components/schemas/access_warp_auth_session_duration'
      type: object
    access_empty_response:
      allOf:
      - properties:
          result:
            enum:
            - true
            - false
            example: true
            type: boolean
          success:
            enum:
            - true
            - false
            example: true
            type: boolean
    access_api-response-common:
      properties:
        errors:
          $ref: '#/components/schemas/access_messages'
        messages:
          $ref: '#/components/schemas/access_messages'
        success:
          description: Whether the API call was successful
          enum:
          - true
          example: true
          type: boolean
      required:
      - success
      - errors
      - messages
      type: object
    access_warp_auth_session_duration:
      description: 'The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h.'
      example: 24h
      type: string
    access_single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_organizations'
    access_schemas-single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_service-tokens'
    access_schemas-name:
      description: The name of the service token.
      example: CI/CD token
      type: string
    access_duration:
      default: 8760h
      description: 'The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).'
      example: 60m
      type: string
    access_client_id:
      description: The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.
      example: 88bf3b6d86161464f6509f7219099e57.access.example.com
      type: string
    access_api-response-single:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      type: object
  securitySchemes:
    api_email:
      in: header
      name: X-Auth-Email
      type: apiKey
    api_key:
      in: header
      name: X-Auth-Key
      type: apiKey
    api_token:
      scheme: bearer
      type: http
    user_service_key:
      in: header
      name: X-Auth-User-Service-Key
      type: apiKey