--- title: Organizations --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Zero Trust](https://developers.cloudflare.com/api/python/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Organizations ##### [Get your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/list) zero\_trust.organizations.list(OrganizationListParams\*\*kwargs) -> [OrganizationListResponse]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Create your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/create) zero\_trust.organizations.create(OrganizationCreateParams\*\*kwargs) -> [Organization]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Update your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/update) zero\_trust.organizations.update(OrganizationUpdateParams\*\*kwargs) -> [Organization]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Revoke all Access tokens for a user](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/revoke_users) zero\_trust.organizations.revoke\_users(OrganizationRevokeUsersParams\*\*kwargs) -> [OrganizationRevokeUsersResponse]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations/revoke\_user ##### ModelsExpand Collapse
class LoginDesign: … background\_color: Optional\[str] The background color on your login page. Link to this property footer\_text: Optional\[str] The text at the bottom of your login page. Link to this property header\_text: Optional\[str] The text at the top of your login page. Link to this property logo\_path: Optional\[str] The URL of the logo on your login page. Link to this property text\_color: Optional\[str] The text color on your login page. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20login_design%20%3E%20(schema)>)
class Organization: … allow\_authenticate\_via\_warp: Optional\[bool] When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property auth\_domain: Optional\[str] The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. Link to this property
custom\_pages: Optional\[CustomPages] forbidden: Optional\[str] The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property identity\_denied: Optional\[str] The uid of the custom page to use when a user is denied access. Link to this property
Link to this property deny\_unmatched\_requests: Optional\[bool] Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property deny\_unmatched\_requests\_exempted\_zone\_names: Optional\[List\[str]] Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property is\_ui\_read\_only: Optional\[bool] Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property login\_design: Optional\[LoginDesign] Link to this property
mfa\_config: Optional\[MfaConfig] Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key", 2 more]]] Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property "piv\_key" Link to this property "ssh\_fido2\_key" Link to this property
Link to this property amr\_matching\_session\_duration: Optional\[str] Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property required\_aaguids: Optional\[str] Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
mfa\_piv\_key\_requirements: Optional\[MfaPivKeyRequirements] Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: Optional\[Literal\["never", "once", "always"]] Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: "never" Link to this property "once" Link to this property "always" Link to this property
Link to this property require\_fips\_device: Optional\[bool] Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
ssh\_key\_size: Optional\[List\[Literal\[256, 384, 521, 3 more]]] Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: 256 Link to this property 384 Link to this property 521 Link to this property 2048 Link to this property 3072 Link to this property 4096 Link to this property
Link to this property
ssh\_key\_type: Optional\[List\[Literal\["ecdsa", "ed25519", "rsa"]]] Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: "ecdsa" Link to this property "ed25519" Link to this property "rsa" Link to this property
Link to this property
touch\_policy: Optional\[Literal\["never", "always", "cached"]] Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: "never" Link to this property "always" Link to this property "cached" Link to this property
Link to this property
Link to this property mfa\_required\_for\_all\_apps: Optional\[bool] Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property name: Optional\[str] The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
service\_token\_inactivity: Optional\[ServiceTokenInactivity] Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: Literal\["disable", "delete"] The action applied to an inactive service token. One of the following: "disable" Link to this property "delete" Link to this property
Link to this property enabled: bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property inactivity\_threshold\_days: int The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property strict\_service\_token\_auth: Optional\[bool] Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property ui\_read\_only\_toggle\_reason: Optional\[str] A description of the reason why the UI read only field is being toggled. Link to this property user\_seat\_expiration\_inactive\_time: Optional\[str] The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property warp\_auth\_non\_browser\_401: Optional\[bool] When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property warp\_auth\_session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization%20%3E%20(schema)>)
class OrganizationListResponse: … allow\_authenticate\_via\_warp: Optional\[bool] When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property auth\_domain: Optional\[str] The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. Link to this property
custom\_pages: Optional\[CustomPages] forbidden: Optional\[str] The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property identity\_denied: Optional\[str] The uid of the custom page to use when a user is denied access. Link to this property
Link to this property deny\_unmatched\_requests: Optional\[bool] Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property deny\_unmatched\_requests\_exempted\_zone\_names: Optional\[List\[str]] Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property is\_ui\_read\_only: Optional\[bool] Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property login\_design: Optional\[LoginDesign] Link to this property
mfa\_config: Optional\[MfaConfig] Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key", 2 more]]] Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property "piv\_key" Link to this property "ssh\_fido2\_key" Link to this property
Link to this property amr\_matching\_session\_duration: Optional\[str] Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property required\_aaguids: Optional\[str] Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
mfa\_piv\_key\_requirements: Optional\[MfaPivKeyRequirements] Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: Optional\[Literal\["never", "once", "always"]] Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: "never" Link to this property "once" Link to this property "always" Link to this property
Link to this property require\_fips\_device: Optional\[bool] Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
ssh\_key\_size: Optional\[List\[Literal\[256, 384, 521, 3 more]]] Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: 256 Link to this property 384 Link to this property 521 Link to this property 2048 Link to this property 3072 Link to this property 4096 Link to this property
Link to this property
ssh\_key\_type: Optional\[List\[Literal\["ecdsa", "ed25519", "rsa"]]] Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: "ecdsa" Link to this property "ed25519" Link to this property "rsa" Link to this property
Link to this property
touch\_policy: Optional\[Literal\["never", "always", "cached"]] Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: "never" Link to this property "always" Link to this property "cached" Link to this property
Link to this property
Link to this property mfa\_required\_for\_all\_apps: Optional\[bool] Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property name: Optional\[str] The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
service\_token\_inactivity: Optional\[ServiceTokenInactivity] Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: Literal\["disable", "delete"] The action applied to an inactive service token. One of the following: "disable" Link to this property "delete" Link to this property
Link to this property enabled: bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property inactivity\_threshold\_days: int The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property strict\_service\_token\_auth: Optional\[bool] Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property trusted\_accounts: Optional\[List\[str]] The account tags of organizations trusted by this organization for policy and device posture sharing. Link to this property ui\_read\_only\_toggle\_reason: Optional\[str] A description of the reason why the UI read only field is being toggled. Link to this property user\_seat\_expiration\_inactive\_time: Optional\[str] The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property warp\_auth\_non\_browser\_401: Optional\[bool] When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property warp\_auth\_session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_list_response%20%3E%20(schema)>)
Literal\[true, false] One of the following: true Link to this property false Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_revoke_users_response%20%3E%20(schema)>) #### OrganizationsDOH ##### [Get your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/subresources/doh/methods/get) zero\_trust.organizations.doh.get(DOHGetParams\*\*kwargs) -> [DOHGetResponse]() GET/accounts/{account\_id}/access/organizations/doh ##### [Update your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/subresources/doh/methods/update) zero\_trust.organizations.doh.update(DOHUpdateParams\*\*kwargs) -> [DOHUpdateResponse]() PUT/accounts/{account\_id}/access/organizations/doh ##### ModelsExpand Collapse
class DOHGetResponse: … id: Optional\[str] The ID of the service token. maxLength36 Link to this property client\_id: Optional\[str] The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header. Link to this property doh\_jwt\_duration: Optional\[str] The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Link to this property duration: Optional\[str] The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). Link to this property enabled: Optional\[bool] Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. Link to this property expires\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] The name of the service token. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_get_response%20%3E%20(schema)>)
class DOHUpdateResponse: … id: Optional\[str] The ID of the service token. maxLength36 Link to this property client\_id: Optional\[str] The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header. Link to this property doh\_jwt\_duration: Optional\[str] The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h Link to this property duration: Optional\[str] The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). Link to this property enabled: Optional\[bool] Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. Link to this property expires\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] The name of the service token. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_update_response%20%3E%20(schema)>)