--- title: IAM --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # IAM #### IAMPermission Groups ##### [List Account Permission Groups](https://developers.cloudflare.com/api/resources/iam/subresources/permission_groups/methods/list) GET/accounts/{account\_id}/iam/permission\_groups ##### [Permission Group Details](https://developers.cloudflare.com/api/resources/iam/subresources/permission_groups/methods/get) GET/accounts/{account\_id}/iam/permission\_groups/{permission\_group\_id} ##### ModelsExpand Collapse

PermissionGroupListResponse object {id, meta, name } A named group of permissions that map to a group of operations against resources.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

category: optional string A category used to group permission groups. Link to this property deprecated: optional string Indicates whether the permission group is deprecated. Link to this property description: optional string Additional information about the permission group. Link to this property editable: optional string Indicates whether the permission group can be edited. Link to this property eol\_at: optional string The planned end-of-life date and time, when provided. formatdate-time Link to this property label: optional string A label identifying the permission group. Link to this property scopes: optional string The scope associated with the permission group. Link to this property visibility: optional string Indicates the permission group’s availability or visibility. Link to this property

Link to this property name: optional string Name of the permission group. Link to this property

[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_list_response%20%3E%20(schema)>)

PermissionGroupGetResponse object {id, meta, name } A named group of permissions that map to a group of operations against resources.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

Link to this property name: optional string Name of the permission group. Link to this property

[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_get_response%20%3E%20(schema)>) #### IAMResource Groups ##### [List Resource Groups](https://developers.cloudflare.com/api/resources/iam/subresources/resource_groups/methods/list) GET/accounts/{account\_id}/iam/resource\_groups ##### [Resource Group Details](https://developers.cloudflare.com/api/resources/iam/subresources/resource_groups/methods/get) GET/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Create Resource Group](https://developers.cloudflare.com/api/resources/iam/subresources/resource_groups/methods/create) POST/accounts/{account\_id}/iam/resource\_groups ##### [Update Resource Group](https://developers.cloudflare.com/api/resources/iam/subresources/resource_groups/methods/update) PUT/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Remove Resource Group](https://developers.cloudflare.com/api/resources/iam/subresources/resource_groups/methods/delete) DELETE/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### ModelsExpand Collapse

ResourceGroupListResponse object {id, scope, meta, name } A group of scoped resources.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_list_response%20%3E%20(schema)>)

ResourceGroupGetResponse object {id, scope, meta, name } A group of scoped resources.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_get_response%20%3E%20(schema)>)

ResourceGroupCreateResponse object {id, scope, meta, name } A group of scoped resources.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_create_response%20%3E%20(schema)>)

ResourceGroupUpdateResponse object {id, scope, meta, name } A group of scoped resources.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_update_response%20%3E%20(schema)>)

ResourceGroupDeleteResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_delete_response%20%3E%20(schema)>) #### IAMUser Groups ##### [List User Groups](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/methods/list) GET/accounts/{account\_id}/iam/user\_groups ##### [User Group Details](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/methods/get) GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Create User Group](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/methods/create) POST/accounts/{account\_id}/iam/user\_groups ##### [Update User Group](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/methods/update) PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Remove User Group](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/methods/delete) DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### ModelsExpand Collapse

UserGroupListResponse object {id, created\_on, modified\_on, 2 more } A group of policies resources.

id: string User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: string Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: string Last time the user group was modified. formatdate-time Link to this property name: string Name of the user group. Link to this property

policies: optional array of object {id, access, permission\_groups, resource\_groups } Policies attached to the User group

id: optional string Policy identifier. Link to this property

access: optional "allow"or "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: optional array of object {id, meta, name } A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

Link to this property name: optional string Name of the permission group. Link to this property

Link to this property

resource\_groups: optional array of object {id, scope, meta, name } A list of resource groups that the policy applies to.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_list_response%20%3E%20(schema)>)

UserGroupGetResponse object {id, created\_on, modified\_on, 2 more } A group of policies resources.

policies: optional array of object {id, access, permission\_groups, resource\_groups } Policies attached to the User group

id: optional string Policy identifier. Link to this property

access: optional "allow"or "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: optional array of object {id, meta, name } A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

Link to this property name: optional string Name of the permission group. Link to this property

Link to this property

resource\_groups: optional array of object {id, scope, meta, name } A list of resource groups that the policy applies to.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_get_response%20%3E%20(schema)>)

UserGroupCreateResponse object {id, created\_on, modified\_on, 2 more } A group of policies resources.

policies: optional array of object {id, access, permission\_groups, resource\_groups } Policies attached to the User group

id: optional string Policy identifier. Link to this property

access: optional "allow"or "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: optional array of object {id, meta, name } A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

Link to this property name: optional string Name of the permission group. Link to this property

Link to this property

resource\_groups: optional array of object {id, scope, meta, name } A list of resource groups that the policy applies to.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_create_response%20%3E%20(schema)>)

UserGroupUpdateResponse object {id, created\_on, modified\_on, 2 more } A group of policies resources.

policies: optional array of object {id, access, permission\_groups, resource\_groups } Policies attached to the User group

id: optional string Policy identifier. Link to this property

access: optional "allow"or "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: optional array of object {id, meta, name } A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

Link to this property name: optional string Name of the permission group. Link to this property

Link to this property

resource\_groups: optional array of object {id, scope, meta, name } A list of resource groups that the policy applies to.

id: string Identifier of the resource group. Link to this property

scope: object {key, objects } A scope is a combination of scope objects which provides additional context.

key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property

objects: array of object {key } A list of scope objects for additional context.

key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property

Link to this property

meta: optional object {key, value } Attributes associated to the resource group.

key: optional string Link to this property value: optional string Link to this property

Link to this property name: optional string Name of the resource group. Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_update_response%20%3E%20(schema)>)

UserGroupDeleteResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_delete_response%20%3E%20(schema)>) #### IAMUser GroupsMembers ##### [List User Group Members](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/subresources/members/methods/list) GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Get User Group Member](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/subresources/members/methods/get) GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### [Add User Group Members](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/subresources/members/methods/create) POST/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Update User Group Members](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/subresources/members/methods/update) PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Remove User Group Member](https://developers.cloudflare.com/api/resources/iam/subresources/user_groups/subresources/members/methods/delete) DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### ModelsExpand Collapse

MemberListResponse object {id, email, status } Member attached to a User Group.

id: string Account member identifier. Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property

status: optional "accepted"or "pending" The member’s status in the account.

One of the following: "accepted" Link to this property "pending" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_list_response%20%3E%20(schema)>)

MemberGetResponse object {id, created\_at, email, 2 more } Detailed member information for a User Group member.

id: string Account member identifier. Link to this property created\_at: optional string When the member was added to the user group. formatdate-time Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property

status: optional "accepted"or "pending" The member’s status in the account.

One of the following: "accepted" Link to this property "pending" Link to this property

Link to this property

user: optional object {id, email, first\_name, last\_name } Details of the user associated with this membership.

id: optional string User identifier tag. Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property first\_name: optional string User’s first name. Link to this property last\_name: optional string User’s last name. Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_get_response%20%3E%20(schema)>)

MemberCreateResponse object {id, email, status } Member attached to a User Group.

id: string Account member identifier. Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property

status: optional "accepted"or "pending" The member’s status in the account.

One of the following: "accepted" Link to this property "pending" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_create_response%20%3E%20(schema)>)

MemberUpdateResponse object {id, email, status } Member attached to a User Group.

id: string Account member identifier. Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property

status: optional "accepted"or "pending" The member’s status in the account.

One of the following: "accepted" Link to this property "pending" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_update_response%20%3E%20(schema)>)

MemberDeleteResponse object {id, email, status } Member attached to a User Group.

id: string Account member identifier. Link to this property email: optional string The contact email address of the user. maxLength90 Link to this property

status: optional "accepted"or "pending" The member’s status in the account.

One of the following: "accepted" Link to this property "pending" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_delete_response%20%3E%20(schema)>) #### IAMSSO ##### [Get all SSO connectors](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/list) GET/accounts/{account\_id}/sso\_connectors ##### [Get single SSO connector](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/get) GET/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Initialize new SSO connector](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/create) POST/accounts/{account\_id}/sso\_connectors ##### [Update SSO connector state](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/update) PATCH/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Delete SSO connector](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/delete) DELETE/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Begin SSO connector verification](https://developers.cloudflare.com/api/resources/iam/subresources/sso/methods/begin_verification) POST/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id}/begin\_verification ##### ModelsExpand Collapse

SSOListResponse object {id, created\_on, email\_domain, 4 more }

id: optional string SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on: optional string Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain: optional string Link to this property enabled: optional boolean Link to this property updated\_on: optional string Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language: optional boolean Controls the display of FedRAMP language to the user during SSO login Link to this property

verification: optional object {code, status }

code: optional string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property

status: optional "awaiting"or "pending"or "failed"or "verified" The status of the verification code from the verification process.

One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_list_response%20%3E%20(schema)>)

SSOGetResponse object {id, created\_on, email\_domain, 4 more }

verification: optional object {code, status }

code: optional string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property

status: optional "awaiting"or "pending"or "failed"or "verified" The status of the verification code from the verification process.

One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_get_response%20%3E%20(schema)>)

SSOCreateResponse object {id, created\_on, email\_domain, 4 more }

verification: optional object {code, status }

code: optional string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property

status: optional "awaiting"or "pending"or "failed"or "verified" The status of the verification code from the verification process.

One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_create_response%20%3E%20(schema)>)

SSOUpdateResponse object {id, created\_on, email\_domain, 4 more }

verification: optional object {code, status }

code: optional string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property

status: optional "awaiting"or "pending"or "failed"or "verified" The status of the verification code from the verification process.

One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property

Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_update_response%20%3E%20(schema)>)

SSODeleteResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_delete_response%20%3E%20(schema)>)

SSOBeginVerificationResponse object {errors, messages, success }

errors: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

messages: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

Link to this property success: true Whether the API call was successful. Link to this property

[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_begin_verification_response%20%3E%20(schema)>) #### IAMOAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/list) GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/get) GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/create) POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/update) PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/delete) DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/rotate_secret) POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_clients/methods/delete_rotated_secret) DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse

OAuthClientListResponse object {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests.

client\_id: string The unique identifier for an OAuth client. Link to this property

visibility: "public"or "private" Visibility of the OAuth client.

One of the following: "public" Link to this property "private" Link to this property

client\_uri\_verification: optional object {status, text } Client URI domain control verification state.

status: optional "pending"or "in\_progress"or "verified"or "failed" Current verification status for the client URI host.

One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property

Link to this property text: optional string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property

Link to this property created\_at: optional string Timestamp when the OAuth client was created. formatdate-time Link to this property

grant\_types: optional array of "authorization\_code"or "refresh\_token" Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally.

One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property

Link to this property has\_rotated\_secret: optional boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri: optional string URL of the client’s logo. Link to this property optional\_scopes: optional array of string Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri: optional string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris: optional array of string Array of allowed post-logout redirect URIs. Link to this property promoted\_at: optional string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris: optional array of string Array of allowed redirect URIs for the client. Link to this property

response\_types: optional array of "token"or "id\_token"or "code" Array of OAuth response types the client is allowed to use.

One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property

Link to this property scopes: optional array of string Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property

token\_endpoint\_auth\_method: optional "none"or "client\_secret\_basic"or "client\_secret\_post" The authentication method the client uses at the token endpoint.

One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property

Link to this property tos\_uri: optional string URL that points to a terms of service document. Link to this property updated\_at: optional string Timestamp when the OAuth client was last updated. formatdate-time Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_list_response%20%3E%20(schema)>)

OAuthClientGetResponse object {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests.

client\_id: string The unique identifier for an OAuth client. Link to this property

visibility: "public"or "private" Visibility of the OAuth client.

One of the following: "public" Link to this property "private" Link to this property

client\_uri\_verification: optional object {status, text } Client URI domain control verification state.

status: optional "pending"or "in\_progress"or "verified"or "failed" Current verification status for the client URI host.

One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property

Link to this property text: optional string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property

Link to this property created\_at: optional string Timestamp when the OAuth client was created. formatdate-time Link to this property

One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property

response\_types: optional array of "token"or "id\_token"or "code" Array of OAuth response types the client is allowed to use.

One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property

token\_endpoint\_auth\_method: optional "none"or "client\_secret\_basic"or "client\_secret\_post" The authentication method the client uses at the token endpoint.

One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_get_response%20%3E%20(schema)>)

OAuthClientCreateResponse object {client\_id, visibility, allowed\_cors\_origins, 18 more } Fields shared by OAuth client responses and create/update requests.

client\_id: string The unique identifier for an OAuth client. Link to this property

visibility: "public"or "private" Visibility of the OAuth client.

One of the following: "public" Link to this property "private" Link to this property

Link to this property allowed\_cors\_origins: optional array of string Array of allowed CORS origins. Link to this property client\_name: optional string Human-readable name of the OAuth client. Link to this property client\_secret: optional string The client secret. This is the only time the secret is returned in a response. Link to this property client\_uri: optional string URL of the home page of the client. Link to this property

client\_uri\_verification: optional object {status, text } Client URI domain control verification state.

status: optional "pending"or "in\_progress"or "verified"or "failed" Current verification status for the client URI host.

One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property

Link to this property text: optional string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property

Link to this property created\_at: optional string Timestamp when the OAuth client was created. formatdate-time Link to this property

One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property

response\_types: optional array of "token"or "id\_token"or "code" Array of OAuth response types the client is allowed to use.

One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property

token\_endpoint\_auth\_method: optional "none"or "client\_secret\_basic"or "client\_secret\_post" The authentication method the client uses at the token endpoint.

One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_create_response%20%3E%20(schema)>)

OAuthClientUpdateResponse object {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests.

client\_id: string The unique identifier for an OAuth client. Link to this property

visibility: "public"or "private" Visibility of the OAuth client.

One of the following: "public" Link to this property "private" Link to this property

client\_uri\_verification: optional object {status, text } Client URI domain control verification state.

status: optional "pending"or "in\_progress"or "verified"or "failed" Current verification status for the client URI host.

One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property

Link to this property text: optional string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property

Link to this property created\_at: optional string Timestamp when the OAuth client was created. formatdate-time Link to this property

One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property

response\_types: optional array of "token"or "id\_token"or "code" Array of OAuth response types the client is allowed to use.

One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property

token\_endpoint\_auth\_method: optional "none"or "client\_secret\_basic"or "client\_secret\_post" The authentication method the client uses at the token endpoint.

One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_update_response%20%3E%20(schema)>)

OAuthClientDeleteResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_response%20%3E%20(schema)>)

OAuthClientRotateSecretResponse object {client\_secret }

client\_secret: optional string The new client secret. Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_rotate_secret_response%20%3E%20(schema)>)

OAuthClientDeleteRotatedSecretResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_rotated_secret_response%20%3E%20(schema)>) #### IAMOAuth Scopes ##### [List OAuth Scopes](https://developers.cloudflare.com/api/resources/iam/subresources/oauth_scopes/methods/list) GET/oauth/scopes ##### ModelsExpand Collapse

OAuthScopeListResponse object {id, name, category, scopes } An available OAuth scope that can be assigned to an OAuth client.

id: string The scope label to use in the scopes array when creating or updating an OAuth client. Link to this property name: string Human-readable name of the OAuth scope. Link to this property category: optional string Category for grouping scopes in the UI. Link to this property scopes: optional array of string The underlying resource scopes (Bach scopes) that define which resources this OAuth scope can act upon. Link to this property

[Link to this property](<#(resource)%20iam.oauth_scopes%20%3E%20(model)%20oauth_scope_list_response%20%3E%20(schema)>)