Get your Zero Trust organization

client.ZeroTrust.Organizations.List(ctx, query) (*OrganizationListResponse, error)

GET/{accounts_or_zones}/{account_or_zone_id}/access/organizations

Returns the configuration for your Zero Trust organization.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

Access: Organizations, Identity Providers, and Groups RevokeAccess: Organizations, Identity Providers, and Groups WriteAccess: Organizations, Identity Providers, and Groups Read

ParametersExpand Collapse

query OrganizationListParams

AccountID param.Field[string]Optional

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

ZoneID param.Field[string]Optional

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

ReturnsExpand Collapse

type OrganizationListResponse struct{…}

AllowAuthenticateViaWARP boolOptional

When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.

AuthDomain stringOptional

The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com).

AutoRedirectToIdentity boolOptional

When set to true, users skip the identity provider selection step during login.

CustomPages OrganizationListResponseCustomPagesOptional

Forbidden stringOptional

The uid of the custom page to use when a user is denied access after failing a non-identity rule.

IdentityDenied stringOptional

The uid of the custom page to use when a user is denied access.

DenyUnmatchedRequests boolOptional

Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.

DenyUnmatchedRequestsExemptedZoneNames []stringOptional

Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.

IsUIReadOnly boolOptional

Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.

LoginDesign LoginDesignOptional

BackgroundColor stringOptional

The background color on your login page.

FooterText stringOptional

The text at the bottom of your login page.

HeaderText stringOptional

The text at the top of your login page.

LogoPath stringOptional

The URL of the logo on your login page.

TextColor stringOptional

The text color on your login page.

MfaConfig OrganizationListResponseMfaConfigOptional

Configures multi-factor authentication (MFA) settings for an organization.

AllowedAuthenticators []OrganizationListResponseMfaConfigAllowedAuthenticatorOptional

Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications.

One of the following:

const OrganizationListResponseMfaConfigAllowedAuthenticatorTotp OrganizationListResponseMfaConfigAllowedAuthenticator = "totp"

const OrganizationListResponseMfaConfigAllowedAuthenticatorBiometrics OrganizationListResponseMfaConfigAllowedAuthenticator = "biometrics"

const OrganizationListResponseMfaConfigAllowedAuthenticatorSecurityKey OrganizationListResponseMfaConfigAllowedAuthenticator = "security_key"

const OrganizationListResponseMfaConfigAllowedAuthenticatorPivKey OrganizationListResponseMfaConfigAllowedAuthenticator = "piv_key"

const OrganizationListResponseMfaConfigAllowedAuthenticatorSSHFido2Key OrganizationListResponseMfaConfigAllowedAuthenticator = "ssh_fido2_key"

AmrMatchingSessionDuration stringOptional

Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).

RequiredAaguids stringOptional

Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.

formatuuid

SessionDuration stringOptional

Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.

MfaPivKeyRequirements OrganizationListResponseMfaPivKeyRequirementsOptional

Configures PIV key requirements for MFA using hardware security keys.

PinPolicy OrganizationListResponseMfaPivKeyRequirementsPinPolicyOptional

Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).

One of the following:

const OrganizationListResponseMfaPivKeyRequirementsPinPolicyNever OrganizationListResponseMfaPivKeyRequirementsPinPolicy = "never"

const OrganizationListResponseMfaPivKeyRequirementsPinPolicyOnce OrganizationListResponseMfaPivKeyRequirementsPinPolicy = "once"

const OrganizationListResponseMfaPivKeyRequirementsPinPolicyAlways OrganizationListResponseMfaPivKeyRequirementsPinPolicy = "always"

RequireFipsDevice boolOptional

Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.

SSHKeySize []OrganizationListResponseMfaPivKeyRequirementsSSHKeySizeOptional

Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.

One of the following:

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize256 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 256

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize384 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 384

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize521 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 521

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize2048 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 2048

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize3072 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 3072

const OrganizationListResponseMfaPivKeyRequirementsSSHKeySize4096 OrganizationListResponseMfaPivKeyRequirementsSSHKeySize = 4096

SSHKeyType []OrganizationListResponseMfaPivKeyRequirementsSSHKeyTypeOptional

Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.

One of the following:

const OrganizationListResponseMfaPivKeyRequirementsSSHKeyTypeEcdsa OrganizationListResponseMfaPivKeyRequirementsSSHKeyType = "ecdsa"

const OrganizationListResponseMfaPivKeyRequirementsSSHKeyTypeEd25519 OrganizationListResponseMfaPivKeyRequirementsSSHKeyType = "ed25519"

const OrganizationListResponseMfaPivKeyRequirementsSSHKeyTypeRSA OrganizationListResponseMfaPivKeyRequirementsSSHKeyType = "rsa"

TouchPolicy OrganizationListResponseMfaPivKeyRequirementsTouchPolicyOptional

Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds).

One of the following:

const OrganizationListResponseMfaPivKeyRequirementsTouchPolicyNever OrganizationListResponseMfaPivKeyRequirementsTouchPolicy = "never"

const OrganizationListResponseMfaPivKeyRequirementsTouchPolicyAlways OrganizationListResponseMfaPivKeyRequirementsTouchPolicy = "always"

const OrganizationListResponseMfaPivKeyRequirementsTouchPolicyCached OrganizationListResponseMfaPivKeyRequirementsTouchPolicy = "cached"

MfaRequiredForAllApps boolOptional

Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv_key’ and ‘ssh_fido2_key’) if the organization has any non-infrastructure applications.

Name stringOptional

The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b).

ServiceTokenInactivity OrganizationListResponseServiceTokenInactivityOptional

Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.

Action OrganizationListResponseServiceTokenInactivityAction

The action applied to an inactive service token.

One of the following:

const OrganizationListResponseServiceTokenInactivityActionDisable OrganizationListResponseServiceTokenInactivityAction = "disable"

const OrganizationListResponseServiceTokenInactivityActionDelete OrganizationListResponseServiceTokenInactivityAction = "delete"

Enabled bool

Whether automatic enforcement for inactive service tokens is enabled.

InactivityThresholdDays int64

The number of days a service token must be inactive before the configured action is applied.

maximum365

minimum30

SessionDuration stringOptional

The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

StrictServiceTokenAuth boolOptional

Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it.

TrustedAccounts []stringOptional

The account tags of organizations trusted by this organization for policy and device posture sharing.

UIReadOnlyToggleReason stringOptional

A description of the reason why the UI read only field is being toggled.

UserSeatExpirationInactiveTime stringOptional

The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

WARPAuthNonBrowser401 boolOptional

When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.

WARPAuthSessionDuration stringOptional

The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.

Get your Zero Trust organization

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/zero_trust"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  organizations, err := client.ZeroTrust.Organizations.List(context.TODO(), zero_trust.OrganizationListParams{

  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", organizations.AutoRedirectToIdentity)
}

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "allow_authenticate_via_warp": true,
    "auth_domain": "test.cloudflareaccess.com",
    "auto_redirect_to_identity": true,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "custom_pages": {
      "forbidden": "699d98642c564d2e855e9661899b7252",
      "identity_denied": "699d98642c564d2e855e9661899b7252"
    },
    "deny_unmatched_requests": true,
    "deny_unmatched_requests_exempted_zone_names": [
      "example.com"
    ],
    "is_ui_read_only": true,
    "login_design": {
      "background_color": "#c5ed1b",
      "footer_text": "This is an example description.",
      "header_text": "This is an example description.",
      "logo_path": "https://example.com/logo.png",
      "text_color": "#c5ed1b"
    },
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "amr_matching_session_duration": "12h",
      "required_aaguids": "2fc0579f-8113-47ea-b116-bb5a8db9202a",
      "session_duration": "24h"
    },
    "mfa_piv_key_requirements": {
      "pin_policy": "always",
      "require_fips_device": true,
      "ssh_key_size": [
        256,
        2048
      ],
      "ssh_key_type": [
        "ecdsa",
        "rsa"
      ],
      "touch_policy": "always"
    },
    "mfa_required_for_all_apps": false,
    "name": "Widget Corps Internal Applications",
    "service_token_inactivity": {
      "action": "disable",
      "enabled": true,
      "inactivity_threshold_days": 30
    },
    "session_duration": "24h",
    "strict_service_token_auth": true,
    "trusted_accounts": [
      "023e105f4ecef8ad9ca31a8372d0c353"
    ],
    "ui_read_only_toggle_reason": "Temporarily turn off the UI read only lock to make a change via the UI",
    "updated_at": "2014-01-01T05:20:00.12345Z",
    "user_seat_expiration_inactive_time": "730h",
    "warp_auth_non_browser_401": false,
    "warp_auth_session_duration": "24h"
  }
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "allow_authenticate_via_warp": true,
    "auth_domain": "test.cloudflareaccess.com",
    "auto_redirect_to_identity": true,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "custom_pages": {
      "forbidden": "699d98642c564d2e855e9661899b7252",
      "identity_denied": "699d98642c564d2e855e9661899b7252"
    },
    "deny_unmatched_requests": true,
    "deny_unmatched_requests_exempted_zone_names": [
      "example.com"
    ],
    "is_ui_read_only": true,
    "login_design": {
      "background_color": "#c5ed1b",
      "footer_text": "This is an example description.",
      "header_text": "This is an example description.",
      "logo_path": "https://example.com/logo.png",
      "text_color": "#c5ed1b"
    },
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "amr_matching_session_duration": "12h",
      "required_aaguids": "2fc0579f-8113-47ea-b116-bb5a8db9202a",
      "session_duration": "24h"
    },
    "mfa_piv_key_requirements": {
      "pin_policy": "always",
      "require_fips_device": true,
      "ssh_key_size": [
        256,
        2048
      ],
      "ssh_key_type": [
        "ecdsa",
        "rsa"
      ],
      "touch_policy": "always"
    },
    "mfa_required_for_all_apps": false,
    "name": "Widget Corps Internal Applications",
    "service_token_inactivity": {
      "action": "disable",
      "enabled": true,
      "inactivity_threshold_days": 30
    },
    "session_duration": "24h",
    "strict_service_token_auth": true,
    "trusted_accounts": [
      "023e105f4ecef8ad9ca31a8372d0c353"
    ],
    "ui_read_only_toggle_reason": "Temporarily turn off the UI read only lock to make a change via the UI",
    "updated_at": "2014-01-01T05:20:00.12345Z",
    "user_seat_expiration_inactive_time": "730h",
    "warp_auth_non_browser_401": false,
    "warp_auth_session_duration": "24h"
  }
}