--- title: IAM --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # IAM #### IAMPermission Groups ##### [List Account Permission Groups](https://developers.cloudflare.com/api/python/resources/iam/subresources/permission_groups/methods/list) iam.permission\_groups.list(PermissionGroupListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[PermissionGroupListResponse]()] GET/accounts/{account\_id}/iam/permission\_groups ##### [Permission Group Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/permission_groups/methods/get) iam.permission\_groups.get(strpermission\_group\_id, PermissionGroupGetParams\*\*kwargs) -> [PermissionGroupGetResponse]() GET/accounts/{account\_id}/iam/permission\_groups/{permission\_group\_id} ##### ModelsExpand Collapse
class PermissionGroupListResponse: … A named group of permissions that map to a group of operations against resources. id: str Identifier of the permission group. Link to this property
meta: Optional\[Meta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_list_response%20%3E%20(schema)>)
class PermissionGroupGetResponse: … A named group of permissions that map to a group of operations against resources. id: str Identifier of the permission group. Link to this property
meta: Optional\[Meta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_get_response%20%3E%20(schema)>) #### IAMResource Groups ##### [List Resource Groups](https://developers.cloudflare.com/api/python/resources/iam/subresources/resource_groups/methods/list) iam.resource\_groups.list(ResourceGroupListParams\*\*kwargs) -> SyncSinglePage\[[ResourceGroupListResponse]()] GET/accounts/{account\_id}/iam/resource\_groups ##### [Resource Group Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/resource_groups/methods/get) iam.resource\_groups.get(strresource\_group\_id, ResourceGroupGetParams\*\*kwargs) -> [ResourceGroupGetResponse]() GET/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Create Resource Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/resource_groups/methods/create) iam.resource\_groups.create(ResourceGroupCreateParams\*\*kwargs) -> [ResourceGroupCreateResponse]() POST/accounts/{account\_id}/iam/resource\_groups ##### [Update Resource Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/resource_groups/methods/update) iam.resource\_groups.update(strresource\_group\_id, ResourceGroupUpdateParams\*\*kwargs) -> [ResourceGroupUpdateResponse]() PUT/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Remove Resource Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/resource_groups/methods/delete) iam.resource\_groups.delete(strresource\_group\_id, ResourceGroupDeleteParams\*\*kwargs) -> [ResourceGroupDeleteResponse]() DELETE/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### ModelsExpand Collapse
class ResourceGroupListResponse: … A group of scoped resources. id: str Identifier of the resource group. Link to this property
scope: Scope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[ScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[Meta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_list_response%20%3E%20(schema)>)
class ResourceGroupGetResponse: … A group of scoped resources. id: str Identifier of the resource group. Link to this property
scope: Scope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[ScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[Meta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_get_response%20%3E%20(schema)>)
class ResourceGroupCreateResponse: … A group of scoped resources. id: str Identifier of the resource group. Link to this property
scope: Scope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[ScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[Meta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_create_response%20%3E%20(schema)>)
class ResourceGroupUpdateResponse: … A group of scoped resources. id: str Identifier of the resource group. Link to this property
scope: Scope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[ScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[Meta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_update_response%20%3E%20(schema)>)
class ResourceGroupDeleteResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_delete_response%20%3E%20(schema)>) #### IAMUser Groups ##### [List User Groups](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/methods/list) iam.user\_groups.list(UserGroupListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[UserGroupListResponse]()] GET/accounts/{account\_id}/iam/user\_groups ##### [User Group Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/methods/get) iam.user\_groups.get(struser\_group\_id, UserGroupGetParams\*\*kwargs) -> [UserGroupGetResponse]() GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Create User Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/methods/create) iam.user\_groups.create(UserGroupCreateParams\*\*kwargs) -> [UserGroupCreateResponse]() POST/accounts/{account\_id}/iam/user\_groups ##### [Update User Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/methods/update) iam.user\_groups.update(struser\_group\_id, UserGroupUpdateParams\*\*kwargs) -> [UserGroupUpdateResponse]() PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Remove User Group](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/methods/delete) iam.user\_groups.delete(struser\_group\_id, UserGroupDeleteParams\*\*kwargs) -> [UserGroupDeleteResponse]() DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### ModelsExpand Collapse
class UserGroupListResponse: … A group of policies resources. id: str User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: datetime Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: datetime Last time the user group was modified. formatdate-time Link to this property name: str Name of the user group. Link to this property
policies: Optional\[List\[Policy]] Policies attached to the User group id: Optional\[str] Policy identifier. Link to this property
access: Optional\[Literal\["allow", "deny"]] Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups: Optional\[List\[PolicyPermissionGroup]] A set of permission groups that are specified to the policy. id: str Identifier of the permission group. Link to this property
meta: Optional\[PolicyPermissionGroupMeta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
Link to this property
resource\_groups: Optional\[List\[PolicyResourceGroup]] A list of resource groups that the policy applies to. id: str Identifier of the resource group. Link to this property
scope: PolicyResourceGroupScope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[PolicyResourceGroupScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[PolicyResourceGroupMeta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_list_response%20%3E%20(schema)>)
class UserGroupGetResponse: … A group of policies resources. id: str User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: datetime Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: datetime Last time the user group was modified. formatdate-time Link to this property name: str Name of the user group. Link to this property
policies: Optional\[List\[Policy]] Policies attached to the User group id: Optional\[str] Policy identifier. Link to this property
access: Optional\[Literal\["allow", "deny"]] Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups: Optional\[List\[PolicyPermissionGroup]] A set of permission groups that are specified to the policy. id: str Identifier of the permission group. Link to this property
meta: Optional\[PolicyPermissionGroupMeta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
Link to this property
resource\_groups: Optional\[List\[PolicyResourceGroup]] A list of resource groups that the policy applies to. id: str Identifier of the resource group. Link to this property
scope: PolicyResourceGroupScope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[PolicyResourceGroupScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[PolicyResourceGroupMeta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_get_response%20%3E%20(schema)>)
class UserGroupCreateResponse: … A group of policies resources. id: str User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: datetime Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: datetime Last time the user group was modified. formatdate-time Link to this property name: str Name of the user group. Link to this property
policies: Optional\[List\[Policy]] Policies attached to the User group id: Optional\[str] Policy identifier. Link to this property
access: Optional\[Literal\["allow", "deny"]] Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups: Optional\[List\[PolicyPermissionGroup]] A set of permission groups that are specified to the policy. id: str Identifier of the permission group. Link to this property
meta: Optional\[PolicyPermissionGroupMeta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
Link to this property
resource\_groups: Optional\[List\[PolicyResourceGroup]] A list of resource groups that the policy applies to. id: str Identifier of the resource group. Link to this property
scope: PolicyResourceGroupScope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[PolicyResourceGroupScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[PolicyResourceGroupMeta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_create_response%20%3E%20(schema)>)
class UserGroupUpdateResponse: … A group of policies resources. id: str User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: datetime Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: datetime Last time the user group was modified. formatdate-time Link to this property name: str Name of the user group. Link to this property
policies: Optional\[List\[Policy]] Policies attached to the User group id: Optional\[str] Policy identifier. Link to this property
access: Optional\[Literal\["allow", "deny"]] Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups: Optional\[List\[PolicyPermissionGroup]] A set of permission groups that are specified to the policy. id: str Identifier of the permission group. Link to this property
meta: Optional\[PolicyPermissionGroupMeta] Attributes associated to the permission group. category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property
Link to this property name: Optional\[str] Name of the permission group. Link to this property
Link to this property
resource\_groups: Optional\[List\[PolicyResourceGroup]] A list of resource groups that the policy applies to. id: str Identifier of the resource group. Link to this property
scope: PolicyResourceGroupScope A scope is a combination of scope objects which provides additional context. key: str This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: List\[PolicyResourceGroupScopeObject] A list of scope objects for additional context. key: str This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta: Optional\[PolicyResourceGroupMeta] Attributes associated to the resource group. key: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property name: Optional\[str] Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_update_response%20%3E%20(schema)>)
class UserGroupDeleteResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_delete_response%20%3E%20(schema)>) #### IAMUser GroupsMembers ##### [List User Group Members](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/subresources/members/methods/list) iam.user\_groups.members.list(struser\_group\_id, MemberListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[MemberListResponse]()] GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Get User Group Member](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/subresources/members/methods/get) iam.user\_groups.members.get(strmember\_id, MemberGetParams\*\*kwargs) -> [MemberGetResponse]() GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### [Add User Group Members](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/subresources/members/methods/create) iam.user\_groups.members.create(struser\_group\_id, MemberCreateParams\*\*kwargs) -> SyncSinglePage\[[MemberCreateResponse]()] POST/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Update User Group Members](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/subresources/members/methods/update) iam.user\_groups.members.update(struser\_group\_id, MemberUpdateParams\*\*kwargs) -> SyncSinglePage\[[MemberUpdateResponse]()] PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Remove User Group Member](https://developers.cloudflare.com/api/python/resources/iam/subresources/user_groups/subresources/members/methods/delete) iam.user\_groups.members.delete(strmember\_id, MemberDeleteParams\*\*kwargs) -> [MemberDeleteResponse]() DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### ModelsExpand Collapse
class MemberListResponse: … Member attached to a User Group. id: str Account member identifier. Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property
status: Optional\[Literal\["accepted", "pending"]] The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_list_response%20%3E%20(schema)>)
class MemberGetResponse: … Detailed member information for a User Group member. id: str Account member identifier. Link to this property created\_at: Optional\[datetime] When the member was added to the user group. formatdate-time Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property
status: Optional\[Literal\["accepted", "pending"]] The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
user: Optional\[User] Details of the user associated with this membership. id: Optional\[str] User identifier tag. Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property first\_name: Optional\[str] User’s first name. Link to this property last\_name: Optional\[str] User’s last name. Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_get_response%20%3E%20(schema)>)
class MemberCreateResponse: … Member attached to a User Group. id: str Account member identifier. Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property
status: Optional\[Literal\["accepted", "pending"]] The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_create_response%20%3E%20(schema)>)
class MemberUpdateResponse: … Member attached to a User Group. id: str Account member identifier. Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property
status: Optional\[Literal\["accepted", "pending"]] The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_update_response%20%3E%20(schema)>)
class MemberDeleteResponse: … Member attached to a User Group. id: str Account member identifier. Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property
status: Optional\[Literal\["accepted", "pending"]] The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_delete_response%20%3E%20(schema)>) #### IAMSSO ##### [Get all SSO connectors](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/list) iam.sso.list(SSOListParams\*\*kwargs) -> SyncSinglePage\[[SSOListResponse]()] GET/accounts/{account\_id}/sso\_connectors ##### [Get single SSO connector](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/get) iam.sso.get(strsso\_connector\_id, SSOGetParams\*\*kwargs) -> [SSOGetResponse]() GET/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Initialize new SSO connector](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/create) iam.sso.create(SSOCreateParams\*\*kwargs) -> [SSOCreateResponse]() POST/accounts/{account\_id}/sso\_connectors ##### [Update SSO connector state](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/update) iam.sso.update(strsso\_connector\_id, SSOUpdateParams\*\*kwargs) -> [SSOUpdateResponse]() PATCH/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Delete SSO connector](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/delete) iam.sso.delete(strsso\_connector\_id, SSODeleteParams\*\*kwargs) -> [SSODeleteResponse]() DELETE/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Begin SSO connector verification](https://developers.cloudflare.com/api/python/resources/iam/subresources/sso/methods/begin_verification) iam.sso.begin\_verification(strsso\_connector\_id, SSOBeginVerificationParams\*\*kwargs) -> [SSOBeginVerificationResponse]() POST/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id}/begin\_verification ##### ModelsExpand Collapse
class SSOListResponse: … id: Optional\[str] SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on: Optional\[datetime] Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain: Optional\[str] Link to this property enabled: Optional\[bool] Link to this property updated\_on: Optional\[datetime] Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language: Optional\[bool] Controls the display of FedRAMP language to the user during SSO login Link to this property
verification: Optional\[Verification] code: Optional\[str] DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status: Optional\[Literal\["awaiting", "pending", "failed", "verified"]] The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_list_response%20%3E%20(schema)>)
class SSOGetResponse: … id: Optional\[str] SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on: Optional\[datetime] Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain: Optional\[str] Link to this property enabled: Optional\[bool] Link to this property updated\_on: Optional\[datetime] Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language: Optional\[bool] Controls the display of FedRAMP language to the user during SSO login Link to this property
verification: Optional\[Verification] code: Optional\[str] DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status: Optional\[Literal\["awaiting", "pending", "failed", "verified"]] The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_get_response%20%3E%20(schema)>)
class SSOCreateResponse: … id: Optional\[str] SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on: Optional\[datetime] Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain: Optional\[str] Link to this property enabled: Optional\[bool] Link to this property updated\_on: Optional\[datetime] Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language: Optional\[bool] Controls the display of FedRAMP language to the user during SSO login Link to this property
verification: Optional\[Verification] code: Optional\[str] DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status: Optional\[Literal\["awaiting", "pending", "failed", "verified"]] The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_create_response%20%3E%20(schema)>)
class SSOUpdateResponse: … id: Optional\[str] SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on: Optional\[datetime] Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain: Optional\[str] Link to this property enabled: Optional\[bool] Link to this property updated\_on: Optional\[datetime] Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language: Optional\[bool] Controls the display of FedRAMP language to the user during SSO login Link to this property
verification: Optional\[Verification] code: Optional\[str] DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status: Optional\[Literal\["awaiting", "pending", "failed", "verified"]] The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_update_response%20%3E%20(schema)>)
class SSODeleteResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_delete_response%20%3E%20(schema)>)
class SSOBeginVerificationResponse: …
errors: List\[Error] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[ErrorSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property
messages: List\[Message] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[MessageSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property success: Literal\[true] Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_begin_verification_response%20%3E%20(schema)>) #### IAMOAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/list) iam.oauth\_clients.list(OAuthClientListParams\*\*kwargs) -> SyncSinglePage\[[OAuthClientListResponse]()] GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/get) iam.oauth\_clients.get(stroauth\_client\_id, OAuthClientGetParams\*\*kwargs) -> [OAuthClientGetResponse]() GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/create) iam.oauth\_clients.create(OAuthClientCreateParams\*\*kwargs) -> [OAuthClientCreateResponse]() POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/update) iam.oauth\_clients.update(stroauth\_client\_id, OAuthClientUpdateParams\*\*kwargs) -> [OAuthClientUpdateResponse]() PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/delete) iam.oauth\_clients.delete(stroauth\_client\_id, OAuthClientDeleteParams\*\*kwargs) -> [OAuthClientDeleteResponse]() DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/rotate_secret) iam.oauth\_clients.rotate\_secret(stroauth\_client\_id, OAuthClientRotateSecretParams\*\*kwargs) -> [OAuthClientRotateSecretResponse]() POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_clients/methods/delete_rotated_secret) iam.oauth\_clients.delete\_rotated\_secret(stroauth\_client\_id, OAuthClientDeleteRotatedSecretParams\*\*kwargs) -> [OAuthClientDeleteRotatedSecretResponse]() DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse
class OAuthClientListResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_list_response%20%3E%20(schema)>)
class OAuthClientGetResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_get_response%20%3E%20(schema)>)
class OAuthClientCreateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_secret: Optional\[str] The client secret. This is the only time the secret is returned in a response. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_create_response%20%3E%20(schema)>)
class OAuthClientUpdateResponse: … Fields shared by OAuth client responses and create/update requests. client\_id: str The unique identifier for an OAuth client. Link to this property
visibility: Literal\["public", "private"] Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins: Optional\[List\[str]] Array of allowed CORS origins. Link to this property client\_name: Optional\[str] Human-readable name of the OAuth client. Link to this property client\_uri: Optional\[str] URL of the home page of the client. Link to this property
client\_uri\_verification: Optional\[ClientURIVerification] Client URI domain control verification state.
status: Optional\[Literal\["pending", "in\_progress", "verified", "failed"]] Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text: Optional\[str] Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at: Optional\[datetime] Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "refresh\_token"]]] Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret: Optional\[bool] Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: Optional\[str] URL of the client’s logo. Link to this property optional\_scopes: Optional\[List\[str]] Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: Optional\[str] URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: Optional\[List\[str]] Array of allowed post-logout redirect URIs. Link to this property promoted\_at: Optional\[datetime] Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: Optional\[List\[str]] Array of allowed redirect URIs for the client. Link to this property
response\_types: Optional\[List\[Literal\["token", "id\_token", "code"]]] Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes: Optional\[List\[str]] Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method: Optional\[Literal\["none", "client\_secret\_basic", "client\_secret\_post"]] The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri: Optional\[str] URL that points to a terms of service document. Link to this property updated\_at: Optional\[datetime] Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_update_response%20%3E%20(schema)>)
class OAuthClientDeleteResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_response%20%3E%20(schema)>)
class OAuthClientRotateSecretResponse: … client\_secret: Optional\[str] The new client secret. Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_rotate_secret_response%20%3E%20(schema)>)
class OAuthClientDeleteRotatedSecretResponse: … id: str Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_rotated_secret_response%20%3E%20(schema)>) #### IAMOAuth Scopes ##### [List OAuth Scopes](https://developers.cloudflare.com/api/python/resources/iam/subresources/oauth_scopes/methods/list) iam.oauth\_scopes.list() -> SyncSinglePage\[[OAuthScopeListResponse]()] GET/oauth/scopes ##### ModelsExpand Collapse
class OAuthScopeListResponse: … An available OAuth scope that can be assigned to an OAuth client. id: str The scope label to use in the scopes array when creating or updating an OAuth client. Link to this property name: str Human-readable name of the OAuth scope. Link to this property category: Optional\[str] Category for grouping scopes in the UI. Link to this property scopes: Optional\[List\[str]] The underlying resource scopes (Bach scopes) that define which resources this OAuth scope can act upon. Link to this property
[Link to this property](<#(resource)%20iam.oauth_scopes%20%3E%20(model)%20oauth_scope_list_response%20%3E%20(schema)>)