--- title: Create your Zero Trust organization --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Zero Trust](https://developers.cloudflare.com/api/go/resources/zero_trust) [Organizations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create your Zero Trust organization client.ZeroTrust.Organizations.New(ctx, params) (\*[Organization](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations Sets up a Zero Trust organization for your account or zone. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### Accepted Permissions (at least one required) `Access: Organizations, Identity Providers, and Groups Write` ##### ParametersExpand Collapse
params OrganizationNewParams AccountID param.Field\[string]Optional Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. Link to this property ZoneID param.Field\[string]Optional Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. Link to this property AllowAuthenticateViaWARP param.Field\[bool]Optional Body param: When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property AuthDomain param.Field\[string]Optional Body param: The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property AutoRedirectToIdentity param.Field\[bool]Optional Body param: When set to true, users skip the identity provider selection step during login. Link to this property DenyUnmatchedRequests param.Field\[bool]Optional Body param: Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property DenyUnmatchedRequestsExemptedZoneNames param.Field\[\[]string]Optional Body param: Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property IsUIReadOnly param.Field\[bool]Optional Body param: Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property LoginDesign param.Field\[LoginDesign]Optional Body param Link to this property
MfaConfig param.Field\[OrganizationNewParamsMfaConfig]Optional Body param: Configures multi-factor authentication (MFA) settings for an organization.
AllowedAuthenticators \[]OrganizationNewParamsMfaConfigAllowedAuthenticatorOptional Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: const OrganizationNewParamsMfaConfigAllowedAuthenticatorTotp OrganizationNewParamsMfaConfigAllowedAuthenticator = "totp" Link to this property const OrganizationNewParamsMfaConfigAllowedAuthenticatorBiometrics OrganizationNewParamsMfaConfigAllowedAuthenticator = "biometrics" Link to this property const OrganizationNewParamsMfaConfigAllowedAuthenticatorSecurityKey OrganizationNewParamsMfaConfigAllowedAuthenticator = "security\_key" Link to this property const OrganizationNewParamsMfaConfigAllowedAuthenticatorPivKey OrganizationNewParamsMfaConfigAllowedAuthenticator = "piv\_key" Link to this property const OrganizationNewParamsMfaConfigAllowedAuthenticatorSSHFido2Key OrganizationNewParamsMfaConfigAllowedAuthenticator = "ssh\_fido2\_key" Link to this property
Link to this property AmrMatchingSessionDuration stringOptional Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property RequiredAaguids stringOptional Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property SessionDuration stringOptional Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
MfaPivKeyRequirements param.Field\[OrganizationNewParamsMfaPivKeyRequirements]Optional Body param: Configures PIV key requirements for MFA using hardware security keys.
PinPolicy OrganizationNewParamsMfaPivKeyRequirementsPinPolicyOptional Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: const OrganizationNewParamsMfaPivKeyRequirementsPinPolicyNever OrganizationNewParamsMfaPivKeyRequirementsPinPolicy = "never" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsPinPolicyOnce OrganizationNewParamsMfaPivKeyRequirementsPinPolicy = "once" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsPinPolicyAlways OrganizationNewParamsMfaPivKeyRequirementsPinPolicy = "always" Link to this property
Link to this property RequireFipsDevice boolOptional Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
SSHKeySize \[]OrganizationNewParamsMfaPivKeyRequirementsSSHKeySizeOptional Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize256 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 256 Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize384 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 384 Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize521 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 521 Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize2048 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 2048 Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize3072 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 3072 Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize4096 OrganizationNewParamsMfaPivKeyRequirementsSSHKeySize = 4096 Link to this property
Link to this property
SSHKeyType \[]OrganizationNewParamsMfaPivKeyRequirementsSSHKeyTypeOptional Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: const OrganizationNewParamsMfaPivKeyRequirementsSSHKeyTypeEcdsa OrganizationNewParamsMfaPivKeyRequirementsSSHKeyType = "ecdsa" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeyTypeEd25519 OrganizationNewParamsMfaPivKeyRequirementsSSHKeyType = "ed25519" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsSSHKeyTypeRSA OrganizationNewParamsMfaPivKeyRequirementsSSHKeyType = "rsa" Link to this property
Link to this property
TouchPolicy OrganizationNewParamsMfaPivKeyRequirementsTouchPolicyOptional Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: const OrganizationNewParamsMfaPivKeyRequirementsTouchPolicyNever OrganizationNewParamsMfaPivKeyRequirementsTouchPolicy = "never" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsTouchPolicyAlways OrganizationNewParamsMfaPivKeyRequirementsTouchPolicy = "always" Link to this property const OrganizationNewParamsMfaPivKeyRequirementsTouchPolicyCached OrganizationNewParamsMfaPivKeyRequirementsTouchPolicy = "cached" Link to this property
Link to this property
Link to this property MfaRequiredForAllApps param.Field\[bool]Optional Body param: Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property Name param.Field\[string]Optional Body param: The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
ServiceTokenInactivity param.Field\[OrganizationNewParamsServiceTokenInactivity]Optional Body param: Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
Action OrganizationNewParamsServiceTokenInactivityAction The action applied to an inactive service token. One of the following: const OrganizationNewParamsServiceTokenInactivityActionDisable OrganizationNewParamsServiceTokenInactivityAction = "disable" Link to this property const OrganizationNewParamsServiceTokenInactivityActionDelete OrganizationNewParamsServiceTokenInactivityAction = "delete" Link to this property
Link to this property Enabled bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property InactivityThresholdDays int64 The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property SessionDuration param.Field\[string]Optional Body param: The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property StrictServiceTokenAuth param.Field\[bool]Optional Body param: Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property UIReadOnlyToggleReason param.Field\[string]Optional Body param: A description of the reason why the UI read only field is being toggled. Link to this property UserSeatExpirationInactiveTime param.Field\[string]Optional Body param: The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property WARPAuthNonBrowser401 param.Field\[bool]Optional Body param: When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property WARPAuthSessionDuration param.Field\[string]Optional Body param: The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(method)%20create%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type Organization struct{…} AllowAuthenticateViaWARP boolOptional When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property AuthDomain stringOptional The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. Link to this property
CustomPages OrganizationCustomPagesOptional Forbidden stringOptional The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property IdentityDenied stringOptional The uid of the custom page to use when a user is denied access. Link to this property
Link to this property DenyUnmatchedRequests boolOptional Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property DenyUnmatchedRequestsExemptedZoneNames \[]stringOptional Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property IsUIReadOnly boolOptional Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property
LoginDesign LoginDesignOptional BackgroundColor stringOptional The background color on your login page. Link to this property FooterText stringOptional The text at the bottom of your login page. Link to this property HeaderText stringOptional The text at the top of your login page. Link to this property LogoPath stringOptional The URL of the logo on your login page. Link to this property TextColor stringOptional The text color on your login page. Link to this property
Link to this property
MfaConfig OrganizationMfaConfigOptional Configures multi-factor authentication (MFA) settings for an organization.
AllowedAuthenticators \[]OrganizationMfaConfigAllowedAuthenticatorOptional Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: const OrganizationMfaConfigAllowedAuthenticatorTotp OrganizationMfaConfigAllowedAuthenticator = "totp" Link to this property const OrganizationMfaConfigAllowedAuthenticatorBiometrics OrganizationMfaConfigAllowedAuthenticator = "biometrics" Link to this property const OrganizationMfaConfigAllowedAuthenticatorSecurityKey OrganizationMfaConfigAllowedAuthenticator = "security\_key" Link to this property const OrganizationMfaConfigAllowedAuthenticatorPivKey OrganizationMfaConfigAllowedAuthenticator = "piv\_key" Link to this property const OrganizationMfaConfigAllowedAuthenticatorSSHFido2Key OrganizationMfaConfigAllowedAuthenticator = "ssh\_fido2\_key" Link to this property
Link to this property AmrMatchingSessionDuration stringOptional Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property RequiredAaguids stringOptional Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property SessionDuration stringOptional Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
MfaPivKeyRequirements OrganizationMfaPivKeyRequirementsOptional Configures PIV key requirements for MFA using hardware security keys.
PinPolicy OrganizationMfaPivKeyRequirementsPinPolicyOptional Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: const OrganizationMfaPivKeyRequirementsPinPolicyNever OrganizationMfaPivKeyRequirementsPinPolicy = "never" Link to this property const OrganizationMfaPivKeyRequirementsPinPolicyOnce OrganizationMfaPivKeyRequirementsPinPolicy = "once" Link to this property const OrganizationMfaPivKeyRequirementsPinPolicyAlways OrganizationMfaPivKeyRequirementsPinPolicy = "always" Link to this property
Link to this property RequireFipsDevice boolOptional Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
SSHKeySize \[]OrganizationMfaPivKeyRequirementsSSHKeySizeOptional Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: const OrganizationMfaPivKeyRequirementsSSHKeySize256 OrganizationMfaPivKeyRequirementsSSHKeySize = 256 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize384 OrganizationMfaPivKeyRequirementsSSHKeySize = 384 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize521 OrganizationMfaPivKeyRequirementsSSHKeySize = 521 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize2048 OrganizationMfaPivKeyRequirementsSSHKeySize = 2048 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize3072 OrganizationMfaPivKeyRequirementsSSHKeySize = 3072 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize4096 OrganizationMfaPivKeyRequirementsSSHKeySize = 4096 Link to this property
Link to this property
SSHKeyType \[]OrganizationMfaPivKeyRequirementsSSHKeyTypeOptional Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: const OrganizationMfaPivKeyRequirementsSSHKeyTypeEcdsa OrganizationMfaPivKeyRequirementsSSHKeyType = "ecdsa" Link to this property const OrganizationMfaPivKeyRequirementsSSHKeyTypeEd25519 OrganizationMfaPivKeyRequirementsSSHKeyType = "ed25519" Link to this property const OrganizationMfaPivKeyRequirementsSSHKeyTypeRSA OrganizationMfaPivKeyRequirementsSSHKeyType = "rsa" Link to this property
Link to this property
TouchPolicy OrganizationMfaPivKeyRequirementsTouchPolicyOptional Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: const OrganizationMfaPivKeyRequirementsTouchPolicyNever OrganizationMfaPivKeyRequirementsTouchPolicy = "never" Link to this property const OrganizationMfaPivKeyRequirementsTouchPolicyAlways OrganizationMfaPivKeyRequirementsTouchPolicy = "always" Link to this property const OrganizationMfaPivKeyRequirementsTouchPolicyCached OrganizationMfaPivKeyRequirementsTouchPolicy = "cached" Link to this property
Link to this property
Link to this property MfaRequiredForAllApps boolOptional Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property Name stringOptional The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
ServiceTokenInactivity OrganizationServiceTokenInactivityOptional Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
Action OrganizationServiceTokenInactivityAction The action applied to an inactive service token. One of the following: const OrganizationServiceTokenInactivityActionDisable OrganizationServiceTokenInactivityAction = "disable" Link to this property const OrganizationServiceTokenInactivityActionDelete OrganizationServiceTokenInactivityAction = "delete" Link to this property
Link to this property Enabled bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property InactivityThresholdDays int64 The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property StrictServiceTokenAuth boolOptional Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property UIReadOnlyToggleReason stringOptional A description of the reason why the UI read only field is being toggled. Link to this property UserSeatExpirationInactiveTime stringOptional The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property WARPAuthNonBrowser401 boolOptional When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property WARPAuthSessionDuration stringOptional The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization%20%3E%20(schema)>) ### Create your Zero Trust organization Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) organization, err := client.ZeroTrust.Organizations.New(context.TODO(), zero_trust.OrganizationNewParams{ }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", organization.AutoRedirectToIdentity) } ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "allow_authenticate_via_warp": true, "auth_domain": "test.cloudflareaccess.com", "auto_redirect_to_identity": true, "created_at": "2014-01-01T05:20:00.12345Z", "custom_pages": { "forbidden": "699d98642c564d2e855e9661899b7252", "identity_denied": "699d98642c564d2e855e9661899b7252" }, "deny_unmatched_requests": true, "deny_unmatched_requests_exempted_zone_names": [ "example.com" ], "is_ui_read_only": true, "login_design": { "background_color": "#c5ed1b", "footer_text": "This is an example description.", "header_text": "This is an example description.", "logo_path": "https://example.com/logo.png", "text_color": "#c5ed1b" }, "mfa_config": { "allowed_authenticators": [ "totp", "biometrics", "security_key" ], "amr_matching_session_duration": "12h", "required_aaguids": "2fc0579f-8113-47ea-b116-bb5a8db9202a", "session_duration": "24h" }, "mfa_piv_key_requirements": { "pin_policy": "always", "require_fips_device": true, "ssh_key_size": [ 256, 2048 ], "ssh_key_type": [ "ecdsa", "rsa" ], "touch_policy": "always" }, "mfa_required_for_all_apps": false, "name": "Widget Corps Internal Applications", "service_token_inactivity": { "action": "disable", "enabled": true, "inactivity_threshold_days": 30 }, "session_duration": "24h", "strict_service_token_auth": true, "ui_read_only_toggle_reason": "Temporarily turn off the UI read only lock to make a change via the UI", "updated_at": "2014-01-01T05:20:00.12345Z", "user_seat_expiration_inactive_time": "730h", "warp_auth_non_browser_401": false, "warp_auth_session_duration": "24h" } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "allow_authenticate_via_warp": true, "auth_domain": "test.cloudflareaccess.com", "auto_redirect_to_identity": true, "created_at": "2014-01-01T05:20:00.12345Z", "custom_pages": { "forbidden": "699d98642c564d2e855e9661899b7252", "identity_denied": "699d98642c564d2e855e9661899b7252" }, "deny_unmatched_requests": true, "deny_unmatched_requests_exempted_zone_names": [ "example.com" ], "is_ui_read_only": true, "login_design": { "background_color": "#c5ed1b", "footer_text": "This is an example description.", "header_text": "This is an example description.", "logo_path": "https://example.com/logo.png", "text_color": "#c5ed1b" }, "mfa_config": { "allowed_authenticators": [ "totp", "biometrics", "security_key" ], "amr_matching_session_duration": "12h", "required_aaguids": "2fc0579f-8113-47ea-b116-bb5a8db9202a", "session_duration": "24h" }, "mfa_piv_key_requirements": { "pin_policy": "always", "require_fips_device": true, "ssh_key_size": [ 256, 2048 ], "ssh_key_type": [ "ecdsa", "rsa" ], "touch_policy": "always" }, "mfa_required_for_all_apps": false, "name": "Widget Corps Internal Applications", "service_token_inactivity": { "action": "disable", "enabled": true, "inactivity_threshold_days": 30 }, "session_duration": "24h", "strict_service_token_auth": true, "ui_read_only_toggle_reason": "Temporarily turn off the UI read only lock to make a change via the UI", "updated_at": "2014-01-01T05:20:00.12345Z", "user_seat_expiration_inactive_time": "730h", "warp_auth_non_browser_401": false, "warp_auth_session_duration": "24h" } } ```