Reference · built on requestConnectorIdentity, IT & observability

Cloudflare

Zones, DNS records, WAF custom rules, audit logs, and traffic analytics from a Cloudflare account.

Request accessPricing ↗

About

Cloudflare fronts websites and applications with DNS, a CDN, TLS termination and a web application firewall. An account holds zones, one per domain, and each zone holds DNS records, SSL/TLS certificates, cache settings and firewall rulesets. One API at api.cloudflare.com exposes all of it under one API token, and every change lands in the account audit log.

Through Fibric, an operator reads zone status, DNS records, audit log entries and traffic analytics, receives Cloudflare notification webhooks, and proposes DNS record or WAF rule changes for your approval. Each approved change leaves a receipt: what changed, why, and how to undo it.

This is a reference listing. It documents what Fibric would read from Cloudflare and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Zones and their status (initializing, pending, active, moved) through GET /zones
  • DNS records filtered by type, name, content, proxied and tag through GET /zones/{zone_id}/dns_records
  • SSL/TLS certificates and Universal SSL state through the zone SSL/TLS endpoints
  • WAF custom rules in the http_request_firewall_custom phase through the Rulesets API
  • Account audit logs filtered by actor email, action type, zone and date through GET /accounts/{account_id}/audit_logs
  • HTTP request and firewall event analytics through the GraphQL Analytics API at /client/v4/graphql
  • Cloudflare Notifications delivered to a webhook URL, authenticated with the cf-webhook-auth header

Proposed actions

  • Target capability: propose a DNS record create or update through POST /zones/{zone_id}/dns_records, with name, type, content, ttl and proxied
  • Target capability: propose a WAF custom rule with a block or challenge action through POST /zones/{zone_id}/rulesets/{ruleset_id}/rules
  • Target capability: propose a cache purge for a zone through the Cache endpoints

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Catch a DNS change nobody announced

    Read the account audit log by actor, action and zone, match each DNS record change against your change window, and raise the ones made outside it for review.

    With Audit Trail, Change Freeze

  • Route a Cloudflare alert to the person on call

    Receive Cloudflare Notifications on a webhook, drop duplicates, and hand the alert to the on-call rotation with the zone and rule it names.

    With Uptime Response, Alert Noise

  • Renew before a zone goes dark

    Watch zone status and SSL/TLS certificate state across every zone and propose a renewal task ahead of expiry, with the zone owner named.

    With Certificate Expiry, Domain Renewal

Requirements

  • A Cloudflare account and an API token created under My Profile > API Tokens or Manage Account > API Tokens
  • Zone Read, DNS Read and Account Settings Read permissions on the token for reading
  • DNS Write on the token if you want DNS record proposals carried out
  • At least one zone on a Pro plan or above to use webhooks as a notification destination
Authentication
An API token sent as Authorization: Bearer, scoped to the accounts, zones and permissions you grant, with optional client IP filtering and a TTL.

Limits

  • The API allows 1,200 requests per five-minute period per user; a 429 blocks calls for the next five minutes
  • GraphQL, cache purge, rulesets and lists endpoints carry their own separate rate limits
  • Audit logs are retained for 18 months; longer retention needs Logpush on an Enterprise plan
  • GraphQL analytics include DDoS traffic and are not the measure Cloudflare uses for billing

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Cloudflare ↗

Questions and answers

Which Cloudflare API token permissions does the connector need?
Zone Read to list zones, DNS Read or DNS Write for records, and Account Settings Read for audit logs. Add DNS Write only if you want record proposals carried out. Tokens can be limited to specific zones, client IP addresses and a TTL.
Does Cloudflare push events, or does the connector poll?
Both. Cloudflare Notifications can post alerts to a webhook URL with a cf-webhook-auth header, which needs at least one zone on a Pro plan or above. Zones, DNS records and audit logs are read by polling api.cloudflare.com within the 1,200 requests per five minutes limit.
What happens when the rate limit is hit?
Cloudflare returns HTTP 429 and blocks further calls for the next five minutes. The connector reads the Ratelimit and retry-after headers and waits before retrying. GraphQL, cache purge and rulesets calls count against separate limits.
Ask about Cloudflare

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Cloudflare through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy