Create

Create a Cloudflare API Token Rotation for the specified project.

POST /api/v2/secret-rotations/cloudflare-api-token

cURL

cURL

curl --request POST \
  --url https://us.infisical.com/api/v2/secret-rotations/cloudflare-api-token \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "projectId": "<string>",
  "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "environment": "<string>",
  "secretPath": "<string>",
  "rotationInterval": 2,
  "parameters": {
    "name": "<string>",
    "policies": [
      {
        "permissionGroupIds": [
          "<string>"
        ],
        "zoneIds": [
          "<string>"
        ]
      }
    ],
    "allowedIps": [
      "<string>"
    ],
    "disallowedIps": [
      "<string>"
    ]
  },
  "secretsMapping": {
    "tokenId": "<string>",
    "apiToken": "<string>"
  },
  "description": "<string>",
  "isAutoRotationEnabled": true
}
'

200

{
  "secretRotation": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "createdAt": "2023-11-07T05:31:56Z",
    "updatedAt": "2023-11-07T05:31:56Z",
    "rotationInterval": 123,
    "rotationStatus": "<string>",
    "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
    "lastRotatedAt": "2023-11-07T05:31:56Z",
    "connection": {
      "app": "cloudflare",
      "name": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    },
    "environment": {
      "slug": "<string>",
      "name": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    },
    "projectId": "<string>",
    "folder": {
      "id": "<string>",
      "path": "<string>"
    },
    "rotateAtUtc": {
      "hours": 11.5,
      "minutes": 29.5
    },
    "type": "cloudflare-api-token",
    "parameters": {
      "name": "<string>",
      "policies": [
        {
          "permissionGroupIds": [
            "<string>"
          ],
          "zoneIds": [
            "<string>"
          ]
        }
      ],
      "allowedIps": [
        "<string>"
      ],
      "disallowedIps": [
        "<string>"
      ]
    },
    "secretsMapping": {
      "tokenId": "<string>",
      "apiToken": "<string>"
    },
    "description": "<string>",
    "isAutoRotationEnabled": true,
    "activeIndex": 0,
    "lastRotationJobId": "<string>",
    "nextRotationAt": "2023-11-07T05:31:56Z",
    "isLastRotationManual": true,
    "lastRotationMessage": "<string>"
  }
}

Check out the configuration docs for Cloudflare API Token Rotations to learn how to obtain the required parameters.

Creates a Cloudflare API Token secret rotation. Infisical will create and rotate API tokens via your Cloudflare connection and write them to the specified secret path.

Request body

Field	Type	Required	Description
name	string	Yes	A unique name for the rotation (max 100 characters).
projectId	string (UUID)	Yes	The project ID.
connectionId	string (UUID)	Yes	ID of the Cloudflare app connection.
environment	string	Yes	Environment slug (e.g. dev, prod).
secretPath	string	Yes	Path where the generated API token secrets will be stored.
isAutoRotationEnabled	boolean	No	Whether to rotate automatically on the schedule. Defaults to true.
rotationInterval	number	Yes	Days between rotations (minimum 1).
rotateAtUtc	object	No	Time of day (UTC) to run rotation: { "hours", "minutes" }. Defaults to { "hours": 0, "minutes": 0 }.
parameters.name	string	Yes	The name for the generated Cloudflare API token (max 100 characters). A timestamp is appended to each generated token.
parameters.policies	array	Yes	The access policies to attach to the generated Cloudflare API token. Each policy scopes a set of permission groups to either the entire account or a set of zones. At least one policy is required.
parameters.policies[].effect	string	Yes	Whether the policy grants or denies the permission groups: "allow" or "deny".
parameters.policies[].scope	string	Yes	The resources the policy applies to: "account" (the entire account), "all-zones" (every zone in the account), or "zones" (specific zones).
parameters.policies[].zoneIds	string[]	Conditional	The IDs of the zones the policy applies to. Required when scope is "zones", and rejected for the other scopes.
parameters.policies[].permissionGroupIds	string[]	Yes	The IDs of the Cloudflare permission groups to grant. At least one is required.
parameters.allowedIps	string[]	No	The IP addresses or CIDR blocks the generated Cloudflare API token is restricted to.
parameters.disallowedIps	string[]	No	The IP addresses or CIDR blocks the generated Cloudflare API token is denied from.
secretsMapping.tokenId	string	Yes	Secret key name to store the generated API token’s ID (e.g. CLOUDFLARE_API_TOKEN_ID).
secretsMapping.apiToken	string	Yes	Secret key name to store the generated API token’s value (e.g. CLOUDFLARE_API_TOKEN).
description	string	No	Optional description.

Sample request

curl --request POST \
  --url https://us.infisical.com/api/v2/secret-rotations/cloudflare-api-token \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
  --data '{
    "name": "my-cloudflare-rotation",
    "projectId": "<project-id>",
    "description": "Cloudflare API token rotation",
    "connectionId": "<cloudflare-connection-id>",
    "environment": "dev",
    "secretPath": "/",
    "isAutoRotationEnabled": true,
    "rotationInterval": 30,
    "rotateAtUtc": { "hours": 0, "minutes": 0 },
    "parameters": {
      "name": "infisical-rotated-token",
      "policies": [
        {
          "effect": "allow",
          "scope": "zones",
          "zoneIds": ["<zone-id>"],
          "permissionGroupIds": ["<permission-group-id>"]
        }
      ],
      "allowedIps": ["203.0.113.0/24"]
    },
    "secretsMapping": {
      "tokenId": "CLOUDFLARE_API_TOKEN_ID",
      "apiToken": "CLOUDFLARE_API_TOKEN"
    }
  }'

Sample response

{
  "secretRotation": {
    "id": "<rotation-id>",
    "name": "my-cloudflare-rotation",
    "description": "Cloudflare API token rotation",
    "secretsMapping": {
      "tokenId": "CLOUDFLARE_API_TOKEN_ID",
      "apiToken": "CLOUDFLARE_API_TOKEN"
    },
    "isAutoRotationEnabled": true,
    "activeIndex": 0,
    "connectionId": "<cloudflare-connection-id>",
    "rotationInterval": 30,
    "rotateAtUtc": { "hours": 0, "minutes": 0 },
    "type": "cloudflare-api-token",
    "parameters": {
      "name": "infisical-rotated-token",
      "policies": [
        {
          "effect": "allow",
          "scope": "zones",
          "zoneIds": ["<zone-id>"],
          "permissionGroupIds": ["<permission-group-id>"]
        }
      ],
      "allowedIps": ["203.0.113.0/24"]
    }
  }
}

Body

application/json

name · string · required

The name of the Cloudflare API Token Rotation to create. Must be slug-friendly.

Required string length: 1 - 64

projectId · string · required

The ID of the project to create the rotation in.

Minimum string length: 1

connectionId · string<uuid> · required

The ID of the Cloudflare Connection to use for rotation.

environment · string · required

The slug of the project environment to create the rotation in.

Required string length: 1 - 64

secretPath · string · required

The secret path of the project to create the rotation in.

Minimum string length: 1

rotationInterval · number · required

The interval, in days, to automatically rotate secrets.

Required range: x >= 1

parameters · object · required

Show child attributes

secretsMapping · object · required

Show child attributes

description · string | null

An optional description for the Cloudflare API Token Rotation.

Maximum string length: 256

isAutoRotationEnabled · boolean · default: true

Whether secrets should be automatically rotated when the specified rotation interval has elapsed.

rotateAtUtc · object

The hours and minutes rotation should occur at in UTC. Defaults to Midnight (00:00) UTC.

Show child attributes

Response

200

application/json

Default Response

secretRotation · object · required

Show child attributes