--- title: IAM --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # IAM #### IAMPermission Groups ##### [List Account Permission Groups](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/permission_groups/methods/list) client.iam.permissionGroups.list(PermissionGroupListParams {account\_id, id, label, 3 more } params, RequestOptionsoptions?): V4PagePaginationArray< [PermissionGroupListResponse]() {id, meta, name } > GET/accounts/{account\_id}/iam/permission\_groups ##### [Permission Group Details](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/permission_groups/methods/get) client.iam.permissionGroups.get(stringpermissionGroupID, PermissionGroupGetParams {account\_id } params, RequestOptionsoptions?): [PermissionGroupGetResponse]() {id, meta, name } GET/accounts/{account\_id}/iam/permission\_groups/{permission\_group\_id} ##### ModelsExpand Collapse
PermissionGroupListResponse {id, meta, name } A named group of permissions that map to a group of operations against resources. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_list_response%20%3E%20(schema)>)
PermissionGroupGetResponse {id, meta, name } A named group of permissions that map to a group of operations against resources. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
[Link to this property](<#(resource)%20iam.permission_groups%20%3E%20(model)%20permission_group_get_response%20%3E%20(schema)>) #### IAMResource Groups ##### [List Resource Groups](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/resource_groups/methods/list) client.iam.resourceGroups.list(ResourceGroupListParams {account\_id, id, name } params, RequestOptionsoptions?): SinglePage< [ResourceGroupListResponse]() {id, scope, meta, name } > GET/accounts/{account\_id}/iam/resource\_groups ##### [Resource Group Details](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/resource_groups/methods/get) client.iam.resourceGroups.get(stringresourceGroupID, ResourceGroupGetParams {account\_id } params, RequestOptionsoptions?): [ResourceGroupGetResponse]() {id, scope, meta, name } GET/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Create Resource Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/resource_groups/methods/create) client.iam.resourceGroups.create(ResourceGroupCreateParams {account\_id, name, scope } params, RequestOptionsoptions?): [ResourceGroupCreateResponse]() {id, scope, meta, name } POST/accounts/{account\_id}/iam/resource\_groups ##### [Update Resource Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/resource_groups/methods/update) client.iam.resourceGroups.update(stringresourceGroupID, ResourceGroupUpdateParams {account\_id, name, scope } params, RequestOptionsoptions?): [ResourceGroupUpdateResponse]() {id, scope, meta, name } PUT/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### [Remove Resource Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/resource_groups/methods/delete) client.iam.resourceGroups.delete(stringresourceGroupID, ResourceGroupDeleteParams {account\_id } params, RequestOptionsoptions?): [ResourceGroupDeleteResponse]() {id } | null DELETE/accounts/{account\_id}/iam/resource\_groups/{resource\_group\_id} ##### ModelsExpand Collapse
ResourceGroupListResponse {id, scope, meta, name } A group of scoped resources. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_list_response%20%3E%20(schema)>)
ResourceGroupGetResponse {id, scope, meta, name } A group of scoped resources. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_get_response%20%3E%20(schema)>)
ResourceGroupCreateResponse {id, scope, meta, name } A group of scoped resources. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_create_response%20%3E%20(schema)>)
ResourceGroupUpdateResponse {id, scope, meta, name } A group of scoped resources. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_update_response%20%3E%20(schema)>)
ResourceGroupDeleteResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.resource_groups%20%3E%20(model)%20resource_group_delete_response%20%3E%20(schema)>) #### IAMUser Groups ##### [List User Groups](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/methods/list) client.iam.userGroups.list(UserGroupListParams {account\_id, id, direction, 4 more } params, RequestOptionsoptions?): V4PagePaginationArray< [UserGroupListResponse]() {id, created\_on, modified\_on, 2 more } > GET/accounts/{account\_id}/iam/user\_groups ##### [User Group Details](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/methods/get) client.iam.userGroups.get(stringuserGroupID, UserGroupGetParams {account\_id } params, RequestOptionsoptions?): [UserGroupGetResponse]() {id, created\_on, modified\_on, 2 more } GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Create User Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/methods/create) client.iam.userGroups.create(UserGroupCreateParams {account\_id, name, policies } params, RequestOptionsoptions?): [UserGroupCreateResponse]() {id, created\_on, modified\_on, 2 more } POST/accounts/{account\_id}/iam/user\_groups ##### [Update User Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/methods/update) client.iam.userGroups.update(stringuserGroupID, UserGroupUpdateParams {account\_id, name, policies } params, RequestOptionsoptions?): [UserGroupUpdateResponse]() {id, created\_on, modified\_on, 2 more } PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### [Remove User Group](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/methods/delete) client.iam.userGroups.delete(stringuserGroupID, UserGroupDeleteParams {account\_id } params, RequestOptionsoptions?): [UserGroupDeleteResponse]() {id } | null DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id} ##### ModelsExpand Collapse
UserGroupListResponse {id, created\_on, modified\_on, 2 more } A group of policies resources. id: string User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: string Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: string Last time the user group was modified. formatdate-time Link to this property name: string Name of the user group. Link to this property
policies?: Array<Policy> Policies attached to the User group id?: string Policy identifier. Link to this property
access?: "allow"| "deny" Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups?: Array<PermissionGroup> A set of permission groups that are specified to the policy. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
Link to this property
resource\_groups?: Array<ResourceGroup> A list of resource groups that the policy applies to. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_list_response%20%3E%20(schema)>)
UserGroupGetResponse {id, created\_on, modified\_on, 2 more } A group of policies resources. id: string User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: string Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: string Last time the user group was modified. formatdate-time Link to this property name: string Name of the user group. Link to this property
policies?: Array<Policy> Policies attached to the User group id?: string Policy identifier. Link to this property
access?: "allow"| "deny" Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups?: Array<PermissionGroup> A set of permission groups that are specified to the policy. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
Link to this property
resource\_groups?: Array<ResourceGroup> A list of resource groups that the policy applies to. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_get_response%20%3E%20(schema)>)
UserGroupCreateResponse {id, created\_on, modified\_on, 2 more } A group of policies resources. id: string User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: string Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: string Last time the user group was modified. formatdate-time Link to this property name: string Name of the user group. Link to this property
policies?: Array<Policy> Policies attached to the User group id?: string Policy identifier. Link to this property
access?: "allow"| "deny" Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups?: Array<PermissionGroup> A set of permission groups that are specified to the policy. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
Link to this property
resource\_groups?: Array<ResourceGroup> A list of resource groups that the policy applies to. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_create_response%20%3E%20(schema)>)
UserGroupUpdateResponse {id, created\_on, modified\_on, 2 more } A group of policies resources. id: string User Group identifier tag. maxLength32 minLength32 Link to this property created\_on: string Timestamp for the creation of the user group formatdate-time Link to this property modified\_on: string Last time the user group was modified. formatdate-time Link to this property name: string Name of the user group. Link to this property
policies?: Array<Policy> Policies attached to the User group id?: string Policy identifier. Link to this property
access?: "allow"| "deny" Allow or deny operations against the resources. One of the following: "allow" Link to this property "deny" Link to this property
Link to this property
permission\_groups?: Array<PermissionGroup> A set of permission groups that are specified to the policy. id: string Identifier of the permission group. Link to this property
meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group. category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property
Link to this property name?: string Name of the permission group. Link to this property
Link to this property
resource\_groups?: Array<ResourceGroup> A list of resource groups that the policy applies to. id: string Identifier of the resource group. Link to this property
scope: Scope {key, objects } A scope is a combination of scope objects which provides additional context. key: string This is a combination of pre-defined resource name and identifier (like Account ID etc.) Link to this property
objects: Array<Object> A list of scope objects for additional context. key: string This is a combination of pre-defined resource name and identifier (like Zone ID etc.) Link to this property
Link to this property
Link to this property
meta?: Meta {key, value } Attributes associated to the resource group. key?: string Link to this property value?: string Link to this property
Link to this property name?: string Name of the resource group. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_update_response%20%3E%20(schema)>)
UserGroupDeleteResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.user_groups%20%3E%20(model)%20user_group_delete_response%20%3E%20(schema)>) #### IAMUser GroupsMembers ##### [List User Group Members](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/subresources/members/methods/list) client.iam.userGroups.members.list(stringuserGroupID, MemberListParams {account\_id, direction, fuzzyEmail, 2 more } params, RequestOptionsoptions?): V4PagePaginationArray< [MemberListResponse]() {id, email, status } > GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Get User Group Member](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/subresources/members/methods/get) client.iam.userGroups.members.get(stringmemberID, MemberGetParams {account\_id, user\_group\_id } params, RequestOptionsoptions?): [MemberGetResponse]() {id, created\_at, email, 2 more } GET/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### [Add User Group Members](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/subresources/members/methods/create) client.iam.userGroups.members.create(stringuserGroupID, MemberCreateParams {account\_id, members } params, RequestOptionsoptions?): SinglePage< [MemberCreateResponse]() {id, email, status } > POST/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Update User Group Members](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/subresources/members/methods/update) client.iam.userGroups.members.update(stringuserGroupID, MemberUpdateParams {account\_id, members } params, RequestOptionsoptions?): SinglePage< [MemberUpdateResponse]() {id, email, status } > PUT/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members ##### [Remove User Group Member](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/user_groups/subresources/members/methods/delete) client.iam.userGroups.members.delete(stringmemberID, MemberDeleteParams {account\_id, user\_group\_id } params, RequestOptionsoptions?): [MemberDeleteResponse]() {id, email, status } DELETE/accounts/{account\_id}/iam/user\_groups/{user\_group\_id}/members/{member\_id} ##### ModelsExpand Collapse
MemberListResponse {id, email, status } Member attached to a User Group. id: string Account member identifier. Link to this property email?: string The contact email address of the user. maxLength90 Link to this property
status?: "accepted"| "pending" The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_list_response%20%3E%20(schema)>)
MemberGetResponse {id, created\_at, email, 2 more } Detailed member information for a User Group member. id: string Account member identifier. Link to this property created\_at?: string When the member was added to the user group. formatdate-time Link to this property email?: string The contact email address of the user. maxLength90 Link to this property
status?: "accepted"| "pending" The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
user?: User {id, email, first\_name, last\_name } Details of the user associated with this membership. id?: string User identifier tag. Link to this property email?: string The contact email address of the user. maxLength90 Link to this property first\_name?: string User’s first name. Link to this property last\_name?: string User’s last name. Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_get_response%20%3E%20(schema)>)
MemberCreateResponse {id, email, status } Member attached to a User Group. id: string Account member identifier. Link to this property email?: string The contact email address of the user. maxLength90 Link to this property
status?: "accepted"| "pending" The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_create_response%20%3E%20(schema)>)
MemberUpdateResponse {id, email, status } Member attached to a User Group. id: string Account member identifier. Link to this property email?: string The contact email address of the user. maxLength90 Link to this property
status?: "accepted"| "pending" The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_update_response%20%3E%20(schema)>)
MemberDeleteResponse {id, email, status } Member attached to a User Group. id: string Account member identifier. Link to this property email?: string The contact email address of the user. maxLength90 Link to this property
status?: "accepted"| "pending" The member’s status in the account. One of the following: "accepted" Link to this property "pending" Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.user_groups.members%20%3E%20(model)%20member_delete_response%20%3E%20(schema)>) #### IAMSSO ##### [Get all SSO connectors](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/list) client.iam.sso.list(SSOListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [SSOListResponse]() {id, created\_on, email\_domain, 4 more } > GET/accounts/{account\_id}/sso\_connectors ##### [Get single SSO connector](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/get) client.iam.sso.get(stringssoConnectorID, SSOGetParams {account\_id } params, RequestOptionsoptions?): [SSOGetResponse]() {id, created\_on, email\_domain, 4 more } GET/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Initialize new SSO connector](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/create) client.iam.sso.create(SSOCreateParams {account\_id, email\_domain, begin\_verification, use\_fedramp\_language } params, RequestOptionsoptions?): [SSOCreateResponse]() {id, created\_on, email\_domain, 4 more } POST/accounts/{account\_id}/sso\_connectors ##### [Update SSO connector state](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/update) client.iam.sso.update(stringssoConnectorID, SSOUpdateParams {account\_id, enabled, use\_fedramp\_language } params, RequestOptionsoptions?): [SSOUpdateResponse]() {id, created\_on, email\_domain, 4 more } PATCH/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Delete SSO connector](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/delete) client.iam.sso.delete(stringssoConnectorID, SSODeleteParams {account\_id } params, RequestOptionsoptions?): [SSODeleteResponse]() {id } | null DELETE/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id} ##### [Begin SSO connector verification](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/sso/methods/begin_verification) client.iam.sso.beginVerification(stringssoConnectorID, SSOBeginVerificationParams {account\_id } params, RequestOptionsoptions?): [SSOBeginVerificationResponse]() {errors, messages, success } POST/accounts/{account\_id}/sso\_connectors/{sso\_connector\_id}/begin\_verification ##### ModelsExpand Collapse
SSOListResponse {id, created\_on, email\_domain, 4 more } id?: string SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on?: string Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain?: string Link to this property enabled?: boolean Link to this property updated\_on?: string Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language?: boolean Controls the display of FedRAMP language to the user during SSO login Link to this property
verification?: Verification {code, status } code?: string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status?: "awaiting"| "pending"| "failed"| "verified" The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_list_response%20%3E%20(schema)>)
SSOGetResponse {id, created\_on, email\_domain, 4 more } id?: string SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on?: string Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain?: string Link to this property enabled?: boolean Link to this property updated\_on?: string Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language?: boolean Controls the display of FedRAMP language to the user during SSO login Link to this property
verification?: Verification {code, status } code?: string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status?: "awaiting"| "pending"| "failed"| "verified" The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_get_response%20%3E%20(schema)>)
SSOCreateResponse {id, created\_on, email\_domain, 4 more } id?: string SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on?: string Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain?: string Link to this property enabled?: boolean Link to this property updated\_on?: string Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language?: boolean Controls the display of FedRAMP language to the user during SSO login Link to this property
verification?: Verification {code, status } code?: string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status?: "awaiting"| "pending"| "failed"| "verified" The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_create_response%20%3E%20(schema)>)
SSOUpdateResponse {id, created\_on, email\_domain, 4 more } id?: string SSO Connector identifier tag. maxLength32 minLength32 Link to this property created\_on?: string Timestamp for the creation of the SSO connector formatdate-time Link to this property email\_domain?: string Link to this property enabled?: boolean Link to this property updated\_on?: string Timestamp for the last update of the SSO connector formatdate-time Link to this property use\_fedramp\_language?: boolean Controls the display of FedRAMP language to the user during SSO login Link to this property
verification?: Verification {code, status } code?: string DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership. Link to this property
status?: "awaiting"| "pending"| "failed"| "verified" The status of the verification code from the verification process. One of the following: "awaiting" Link to this property "pending" Link to this property "failed" Link to this property "verified" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_update_response%20%3E%20(schema)>)
SSODeleteResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_delete_response%20%3E%20(schema)>)
SSOBeginVerificationResponse {errors, messages, success }
errors: Array<Error> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property
messages: Array<Message> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property success: true Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20iam.sso%20%3E%20(model)%20sso_begin_verification_response%20%3E%20(schema)>) #### IAMOAuth Clients ##### [List OAuth Clients](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/list) client.iam.oauthClients.list(OAuthClientListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [OAuthClientListResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } > GET/accounts/{account\_id}/oauth\_clients ##### [OAuth Client Details](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/get) client.iam.oauthClients.get(stringoauthClientID, OAuthClientGetParams {account\_id } params, RequestOptionsoptions?): [OAuthClientGetResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } GET/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Create OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/create) client.iam.oauthClients.create(OAuthClientCreateParams {account\_id, client\_name, grant\_types, 11 more } params, RequestOptionsoptions?): [OAuthClientCreateResponse]() {client\_id, visibility, allowed\_cors\_origins, 18 more } POST/accounts/{account\_id}/oauth\_clients ##### [Update OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/update) client.iam.oauthClients.update(stringoauthClientID, OAuthClientUpdateParams {account\_id, allowed\_cors\_origins, client\_name, 12 more } params, RequestOptionsoptions?): [OAuthClientUpdateResponse]() {client\_id, visibility, allowed\_cors\_origins, 17 more } PATCH/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Delete OAuth Client](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/delete) client.iam.oauthClients.delete(stringoauthClientID, OAuthClientDeleteParams {account\_id } params, RequestOptionsoptions?): [OAuthClientDeleteResponse]() {id } | null DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id} ##### [Rotate OAuth Client Secret](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/rotate_secret) client.iam.oauthClients.rotateSecret(stringoauthClientID, OAuthClientRotateSecretParams {account\_id } params, RequestOptionsoptions?): [OAuthClientRotateSecretResponse]() {client\_secret } POST/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### [Delete Rotated OAuth Client Secret](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_clients/methods/delete_rotated_secret) client.iam.oauthClients.deleteRotatedSecret(stringoauthClientID, OAuthClientDeleteRotatedSecretParams {account\_id } params, RequestOptionsoptions?): [OAuthClientDeleteRotatedSecretResponse]() {id } | null DELETE/accounts/{account\_id}/oauth\_clients/{oauth\_client\_id}/rotate\_secret ##### ModelsExpand Collapse
OAuthClientListResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_list_response%20%3E%20(schema)>)
OAuthClientGetResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_get_response%20%3E%20(schema)>)
OAuthClientCreateResponse {client\_id, visibility, allowed\_cors\_origins, 18 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_secret?: string The client secret. This is the only time the secret is returned in a response. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_create_response%20%3E%20(schema)>)
OAuthClientUpdateResponse {client\_id, visibility, allowed\_cors\_origins, 17 more } Fields shared by OAuth client responses and create/update requests. client\_id: string The unique identifier for an OAuth client. Link to this property
visibility: "public"| "private" Visibility of the OAuth client. One of the following: "public" Link to this property "private" Link to this property
Link to this property allowed\_cors\_origins?: Array<string> Array of allowed CORS origins. Link to this property client\_name?: string Human-readable name of the OAuth client. Link to this property client\_uri?: string URL of the home page of the client. Link to this property
client\_uri\_verification?: ClientURIVerification {status, text } Client URI domain control verification state.
status?: "pending"| "in\_progress"| "verified"| "failed" Current verification status for the client URI host. One of the following: "pending" Link to this property "in\_progress" Link to this property "verified" Link to this property "failed" Link to this property
Link to this property text?: string Exact TXT record value that must be added to DNS to prove ownership of the client URI host. Link to this property
Link to this property created\_at?: string Timestamp when the OAuth client was created. formatdate-time Link to this property
grant\_types?: Array<"authorization\_code"| "refresh\_token"> Array of OAuth grant types the client is allowed to use. authorization_code is required; refresh_token may be included optionally. One of the following: "authorization\_code" Link to this property "refresh\_token" Link to this property
Link to this property has\_rotated\_secret?: boolean Indicates whether the client has a rotated secret that has not yet been deleted. Link to this property logo\_uri?: string URL of the client’s logo. Link to this property optional\_scopes?: Array<string> Scopes that the authorizing user may decline during consent. Each value must also appear in scopes. The scopes openid, offline, and offline_access cannot be optional. Link to this property policy\_uri?: string URL that points to a privacy policy document. Link to this property post\_logout\_redirect\_uris?: Array<string> Array of allowed post-logout redirect URIs. Link to this property promoted\_at?: string Timestamp when the OAuth client was promoted to public visibility. formatdate-time Link to this property redirect\_uris?: Array<string> Array of allowed redirect URIs for the client. Link to this property
response\_types?: Array<"token"| "id\_token"| "code"> Array of OAuth response types the client is allowed to use. One of the following: "token" Link to this property "id\_token" Link to this property "code" Link to this property
Link to this property scopes?: Array<string> Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes offline_access and openid are added or removed automatically based on grant_types and response_types. Link to this property
token\_endpoint\_auth\_method?: "none"| "client\_secret\_basic"| "client\_secret\_post" The authentication method the client uses at the token endpoint. One of the following: "none" Link to this property "client\_secret\_basic" Link to this property "client\_secret\_post" Link to this property
Link to this property tos\_uri?: string URL that points to a terms of service document. Link to this property updated\_at?: string Timestamp when the OAuth client was last updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_update_response%20%3E%20(schema)>)
OAuthClientDeleteResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_response%20%3E%20(schema)>)
OAuthClientRotateSecretResponse {client\_secret } client\_secret?: string The new client secret. Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_rotate_secret_response%20%3E%20(schema)>)
OAuthClientDeleteRotatedSecretResponse {id } id: string Identifier maxLength32 minLength32 Link to this property
[Link to this property](<#(resource)%20iam.oauth_clients%20%3E%20(model)%20oauth_client_delete_rotated_secret_response%20%3E%20(schema)>) #### IAMOAuth Scopes ##### [List OAuth Scopes](https://developers.cloudflare.com/api/typescript/resources/iam/subresources/oauth_scopes/methods/list) client.iam.oauthScopes.list(RequestOptionsoptions?): SinglePage< [OAuthScopeListResponse]() {id, name, category, scopes } > GET/oauth/scopes ##### ModelsExpand Collapse
OAuthScopeListResponse {id, name, category, scopes } An available OAuth scope that can be assigned to an OAuth client. id: string The scope label to use in the scopes array when creating or updating an OAuth client. Link to this property name: string Human-readable name of the OAuth scope. Link to this property category?: string Category for grouping scopes in the UI. Link to this property scopes?: Array<string> The underlying resource scopes (Bach scopes) that define which resources this OAuth scope can act upon. Link to this property
[Link to this property](<#(resource)%20iam.oauth_scopes%20%3E%20(model)%20oauth_scope_list_response%20%3E%20(schema)>)