Create

Create a Cloudflare R2 Access Key Rotation for the specified project.

POST /api/v2/secret-rotations/cloudflare-r2-access-key

cURL

cURL

curl --request POST \
  --url https://us.infisical.com/api/v2/secret-rotations/cloudflare-r2-access-key \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "projectId": "<string>",
  "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "environment": "<string>",
  "secretPath": "<string>",
  "rotationInterval": 2,
  "parameters": {
    "name": "<string>",
    "buckets": [
      {
        "name": "<string>",
        "jurisdiction": "default"
      }
    ],
    "accessLevel": "object-read",
    "allowedIps": [
      "<string>"
    ],
    "disallowedIps": [
      "<string>"
    ]
  },
  "secretsMapping": {
    "accessKeyId": "<string>",
    "secretAccessKey": "<string>"
  },
  "description": "<string>",
  "isAutoRotationEnabled": true
}
'

200

{
  "secretRotation": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "createdAt": "2023-11-07T05:31:56Z",
    "updatedAt": "2023-11-07T05:31:56Z",
    "rotationInterval": 123,
    "rotationStatus": "<string>",
    "lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
    "lastRotatedAt": "2023-11-07T05:31:56Z",
    "connection": {
      "app": "cloudflare",
      "name": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    },
    "environment": {
      "slug": "<string>",
      "name": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    },
    "projectId": "<string>",
    "folder": {
      "id": "<string>",
      "path": "<string>"
    },
    "rotateAtUtc": {
      "hours": 11.5,
      "minutes": 29.5
    },
    "type": "cloudflare-r2-access-key",
    "parameters": {
      "name": "<string>",
      "buckets": [
        {
          "name": "<string>",
          "jurisdiction": "default"
        }
      ],
      "accessLevel": "object-read",
      "allowedIps": [
        "<string>"
      ],
      "disallowedIps": [
        "<string>"
      ]
    },
    "secretsMapping": {
      "accessKeyId": "<string>",
      "secretAccessKey": "<string>"
    },
    "description": "<string>",
    "isAutoRotationEnabled": true,
    "activeIndex": 0,
    "lastRotationJobId": "<string>",
    "nextRotationAt": "2023-11-07T05:31:56Z",
    "isLastRotationManual": true,
    "lastRotationMessage": "<string>"
  }
}

Check out the configuration docs for Cloudflare R2 Access Key Rotations to learn how to obtain the required parameters.

Creates a Cloudflare R2 Access Key secret rotation. Infisical will create and rotate the underlying Cloudflare API token via your Cloudflare connection, derive the S3-compatible access key from it, and write the credentials to the specified secret path.

Request body

Field	Type	Required	Description
name	string	Yes	A unique name for the rotation (max 100 characters).
projectId	string (UUID)	Yes	The project ID.
connectionId	string (UUID)	Yes	ID of the Cloudflare app connection.
environment	string	Yes	Environment slug (e.g. dev, prod).
secretPath	string	Yes	Path where the generated access key secrets will be stored.
isAutoRotationEnabled	boolean	No	Whether to rotate automatically on the schedule. Defaults to true.
rotationInterval	number	Yes	Days between rotations (minimum 1).
rotateAtUtc	object	No	Time of day (UTC) to run rotation: { "hours", "minutes" }. Defaults to { "hours": 0, "minutes": 0 }.
parameters.name	string	Yes	The name for the generated Cloudflare API token that backs the access key (max 100 characters). A timestamp is appended to each generated token.
parameters.buckets	array	Yes	The R2 buckets the generated access key is scoped to. At least one bucket is required, and each entry must be unique.
parameters.buckets[].name	string	Yes	The bucket’s name, exactly as it appears in Cloudflare.
parameters.buckets[].jurisdiction	string	No	The bucket’s storage jurisdiction: "default", "eu", or "fedramp". Defaults to "default".
parameters.accessLevel	string	Yes	What the generated key can do on the selected buckets: "object-read" (get and list) or "object-read-write" (also put and delete).
parameters.allowedIps	string[]	No	The IP addresses or CIDR blocks the generated access key is restricted to.
parameters.disallowedIps	string[]	No	The IP addresses or CIDR blocks the generated access key is denied from.
secretsMapping.accessKeyId	string	Yes	Secret key name to store the generated access key ID (e.g. CLOUDFLARE_R2_ACCESS_KEY_ID).
secretsMapping.secretAccessKey	string	Yes	Secret key name to store the generated secret access key (e.g. CLOUDFLARE_R2_SECRET_ACCESS_KEY).
description	string	No	Optional description.

Sample request

curl --request POST \
  --url https://us.infisical.com/api/v2/secret-rotations/cloudflare-r2-access-key \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
  --data '{
    "name": "my-r2-access-key-rotation",
    "projectId": "<project-id>",
    "description": "Cloudflare R2 access key rotation",
    "connectionId": "<cloudflare-connection-id>",
    "environment": "dev",
    "secretPath": "/",
    "isAutoRotationEnabled": true,
    "rotationInterval": 30,
    "rotateAtUtc": { "hours": 0, "minutes": 0 },
    "parameters": {
      "name": "infisical-r2-access-key",
      "buckets": [
        { "name": "my-bucket", "jurisdiction": "default" },
        { "name": "my-eu-bucket", "jurisdiction": "eu" }
      ],
      "accessLevel": "object-read",
      "allowedIps": ["203.0.113.0/24"]
    },
    "secretsMapping": {
      "accessKeyId": "CLOUDFLARE_R2_ACCESS_KEY_ID",
      "secretAccessKey": "CLOUDFLARE_R2_SECRET_ACCESS_KEY"
    }
  }'

Sample response

{
  "secretRotation": {
    "id": "<rotation-id>",
    "name": "my-r2-access-key-rotation",
    "description": "Cloudflare R2 access key rotation",
    "secretsMapping": {
      "accessKeyId": "CLOUDFLARE_R2_ACCESS_KEY_ID",
      "secretAccessKey": "CLOUDFLARE_R2_SECRET_ACCESS_KEY"
    },
    "isAutoRotationEnabled": true,
    "activeIndex": 0,
    "connectionId": "<cloudflare-connection-id>",
    "rotationInterval": 30,
    "rotateAtUtc": { "hours": 0, "minutes": 0 },
    "type": "cloudflare-r2-access-key",
    "parameters": {
      "name": "infisical-r2-access-key",
      "buckets": [
        { "name": "my-bucket", "jurisdiction": "default" },
        { "name": "my-eu-bucket", "jurisdiction": "eu" }
      ],
      "accessLevel": "object-read",
      "allowedIps": ["203.0.113.0/24"]
    }
  }
}

Body

application/json

name · string · required

The name of the Cloudflare R2 Access Key Rotation to create. Must be slug-friendly.

Required string length: 1 - 64

projectId · string · required

The ID of the project to create the rotation in.

Minimum string length: 1

connectionId · string<uuid> · required

The ID of the Cloudflare Connection to use for rotation.

environment · string · required

The slug of the project environment to create the rotation in.

Required string length: 1 - 64

secretPath · string · required

The secret path of the project to create the rotation in.

Minimum string length: 1

rotationInterval · number · required

The interval, in days, to automatically rotate secrets.

Required range: x >= 1

parameters · object · required

Show child attributes

secretsMapping · object · required

Show child attributes

description · string | null

An optional description for the Cloudflare R2 Access Key Rotation.

Maximum string length: 256

isAutoRotationEnabled · boolean · default: true

Whether secrets should be automatically rotated when the specified rotation interval has elapsed.

rotateAtUtc · object

The hours and minutes rotation should occur at in UTC. Defaults to Midnight (00:00) UTC.

Show child attributes

Response

200

application/json

Default Response

secretRotation · object · required

Show child attributes