> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Create
> Create a Cloudflare R2 Access Key Rotation for the specified project.
Check out the configuration docs for [Cloudflare R2 Access Key Rotations](/docs/documentation/platform/secret-rotation/cloudflare-r2-access-key) to learn how to obtain the required parameters.
Creates a Cloudflare R2 Access Key secret rotation. Infisical will create and rotate the underlying Cloudflare API token via your [Cloudflare connection](/docs/integrations/app-connections/cloudflare), derive the S3-compatible access key from it, and write the credentials to the specified secret path.
## Request body
| Field | Type | Required | Description |
| ----------------------------------- | ------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `name` | string | Yes | A unique name for the rotation (max 100 characters). |
| `projectId` | string (UUID) | Yes | The project ID. |
| `connectionId` | string (UUID) | Yes | ID of the Cloudflare app connection. |
| `environment` | string | Yes | Environment slug (e.g. `dev`, `prod`). |
| `secretPath` | string | Yes | Path where the generated access key secrets will be stored. |
| `isAutoRotationEnabled` | boolean | No | Whether to rotate automatically on the schedule. Defaults to `true`. |
| `rotationInterval` | number | Yes | Days between rotations (minimum `1`). |
| `rotateAtUtc` | object | No | Time of day (UTC) to run rotation: `{ "hours", "minutes" }`. Defaults to `{ "hours": 0, "minutes": 0 }`. |
| `parameters.name` | string | Yes | The name for the generated Cloudflare API token that backs the access key (max 100 characters). A timestamp is appended to each generated token. |
| `parameters.buckets` | array | Yes | The R2 buckets the generated access key is scoped to. At least one bucket is required, and each entry must be unique. |
| `parameters.buckets[].name` | string | Yes | The bucket's name, exactly as it appears in Cloudflare. |
| `parameters.buckets[].jurisdiction` | string | No | The bucket's storage jurisdiction: `"default"`, `"eu"`, or `"fedramp"`. Defaults to `"default"`. |
| `parameters.accessLevel` | string | Yes | What the generated key can do on the selected buckets: `"object-read"` (get and list) or `"object-read-write"` (also put and delete). |
| `parameters.allowedIps` | string\[] | No | The IP addresses or CIDR blocks the generated access key is restricted to. |
| `parameters.disallowedIps` | string\[] | No | The IP addresses or CIDR blocks the generated access key is denied from. |
| `secretsMapping.accessKeyId` | string | Yes | Secret key name to store the generated access key ID (e.g. `CLOUDFLARE_R2_ACCESS_KEY_ID`). |
| `secretsMapping.secretAccessKey` | string | Yes | Secret key name to store the generated secret access key (e.g. `CLOUDFLARE_R2_SECRET_ACCESS_KEY`). |
| `description` | string | No | Optional description. |
## Sample request
```bash theme={"dark"}
curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/cloudflare-r2-access-key \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer ' \
--data '{
"name": "my-r2-access-key-rotation",
"projectId": "",
"description": "Cloudflare R2 access key rotation",
"connectionId": "",
"environment": "dev",
"secretPath": "/",
"isAutoRotationEnabled": true,
"rotationInterval": 30,
"rotateAtUtc": { "hours": 0, "minutes": 0 },
"parameters": {
"name": "infisical-r2-access-key",
"buckets": [
{ "name": "my-bucket", "jurisdiction": "default" },
{ "name": "my-eu-bucket", "jurisdiction": "eu" }
],
"accessLevel": "object-read",
"allowedIps": ["203.0.113.0/24"]
},
"secretsMapping": {
"accessKeyId": "CLOUDFLARE_R2_ACCESS_KEY_ID",
"secretAccessKey": "CLOUDFLARE_R2_SECRET_ACCESS_KEY"
}
}'
```
## Sample response
```json theme={"dark"}
{
"secretRotation": {
"id": "",
"name": "my-r2-access-key-rotation",
"description": "Cloudflare R2 access key rotation",
"secretsMapping": {
"accessKeyId": "CLOUDFLARE_R2_ACCESS_KEY_ID",
"secretAccessKey": "CLOUDFLARE_R2_SECRET_ACCESS_KEY"
},
"isAutoRotationEnabled": true,
"activeIndex": 0,
"connectionId": "",
"rotationInterval": 30,
"rotateAtUtc": { "hours": 0, "minutes": 0 },
"type": "cloudflare-r2-access-key",
"parameters": {
"name": "infisical-r2-access-key",
"buckets": [
{ "name": "my-bucket", "jurisdiction": "default" },
{ "name": "my-eu-bucket", "jurisdiction": "eu" }
],
"accessLevel": "object-read",
"allowedIps": ["203.0.113.0/24"]
}
}
}
```
## OpenAPI
````yaml POST /api/v2/secret-rotations/cloudflare-r2-access-key
openapi: 3.0.3
info:
title: Infisical API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
security: []
paths:
/api/v2/secret-rotations/cloudflare-r2-access-key:
post:
tags:
- Secret Rotations
description: Create a Cloudflare R2 Access Key Rotation for the specified project.
operationId: createCloudflareR2AccessKeyRotation
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 64
description: >-
The name of the Cloudflare R2 Access Key Rotation to create.
Must be slug-friendly.
projectId:
type: string
minLength: 1
description: The ID of the project to create the rotation in.
description:
type: string
maxLength: 256
nullable: true
description: >-
An optional description for the Cloudflare R2 Access Key
Rotation.
connectionId:
type: string
format: uuid
description: The ID of the Cloudflare Connection to use for rotation.
environment:
type: string
minLength: 1
maxLength: 64
description: >-
The slug of the project environment to create the rotation
in.
secretPath:
type: string
minLength: 1
description: The secret path of the project to create the rotation in.
isAutoRotationEnabled:
type: boolean
default: true
description: >-
Whether secrets should be automatically rotated when the
specified rotation interval has elapsed.
rotationInterval:
type: number
minimum: 1
description: The interval, in days, to automatically rotate secrets.
rotateAtUtc:
type: object
properties:
hours:
type: number
minimum: 0
maximum: 23
minutes:
type: number
minimum: 0
maximum: 59
required:
- hours
- minutes
additionalProperties: false
description: >-
The hours and minutes rotation should occur at in UTC.
Defaults to Midnight (00:00) UTC.
parameters:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 100
description: >-
The name for the generated Cloudflare API token that
backs the R2 access key.
buckets:
type: array
items:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 64
jurisdiction:
type: string
enum:
- default
- eu
- fedramp
default: default
required:
- name
additionalProperties: false
minItems: 1
description: >-
The R2 buckets the generated access key is scoped to.
Each entry is a bucket name plus its jurisdiction
(default, eu, or fedramp).
accessLevel:
type: string
enum:
- object-read
- object-read-write
default: object-read
description: >-
The level of access the generated key has over the
selected buckets (object-read for read and list,
object-read-write to also write).
allowedIps:
type: array
items:
type: string
description: >-
The IP addresses or CIDR blocks the generated R2 access
key is restricted to.
disallowedIps:
type: array
items:
type: string
description: >-
The IP addresses or CIDR blocks the generated R2 access
key is denied from.
required:
- name
- buckets
additionalProperties: false
secretsMapping:
type: object
properties:
accessKeyId:
type: string
minLength: 1
description: >-
The name of the secret that the rotated R2 access key ID
will be mapped to.
secretAccessKey:
type: string
minLength: 1
description: >-
The name of the secret that the rotated R2 secret access
key will be mapped to.
required:
- accessKeyId
- secretAccessKey
additionalProperties: false
required:
- name
- projectId
- connectionId
- environment
- secretPath
- rotationInterval
- parameters
- secretsMapping
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
secretRotation:
type: object
properties:
id:
type: string
format: uuid
name:
type: string
description:
type: string
nullable: true
isAutoRotationEnabled:
type: boolean
default: true
activeIndex:
type: number
default: 0
folderId:
type: string
format: uuid
connectionId:
type: string
format: uuid
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
rotationInterval:
type: number
rotationStatus:
type: string
lastRotationAttemptedAt:
type: string
format: date-time
lastRotatedAt:
type: string
format: date-time
lastRotationJobId:
type: string
nullable: true
nextRotationAt:
type: string
format: date-time
nullable: true
isLastRotationManual:
type: boolean
default: true
connection:
type: object
properties:
app:
type: string
enum:
- cloudflare
name:
type: string
id:
type: string
format: uuid
required:
- app
- name
- id
additionalProperties: false
environment:
type: object
properties:
slug:
type: string
name:
type: string
id:
type: string
format: uuid
required:
- slug
- name
- id
additionalProperties: false
projectId:
type: string
folder:
type: object
properties:
id:
type: string
path:
type: string
required:
- id
- path
additionalProperties: false
rotateAtUtc:
type: object
properties:
hours:
type: number
minimum: 0
maximum: 23
minutes:
type: number
minimum: 0
maximum: 59
required:
- hours
- minutes
additionalProperties: false
lastRotationMessage:
type: string
nullable: true
type:
type: string
enum:
- cloudflare-r2-access-key
parameters:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 100
description: >-
The name for the generated Cloudflare API token
that backs the R2 access key.
buckets:
type: array
items:
type: object
properties:
name:
type: string
minLength: 1
maxLength: 64
jurisdiction:
type: string
enum:
- default
- eu
- fedramp
default: default
required:
- name
additionalProperties: false
minItems: 1
description: >-
The R2 buckets the generated access key is scoped
to. Each entry is a bucket name plus its
jurisdiction (default, eu, or fedramp).
accessLevel:
type: string
enum:
- object-read
- object-read-write
default: object-read
description: >-
The level of access the generated key has over the
selected buckets (object-read for read and list,
object-read-write to also write).
allowedIps:
type: array
items:
type: string
description: >-
The IP addresses or CIDR blocks the generated R2
access key is restricted to.
disallowedIps:
type: array
items:
type: string
description: >-
The IP addresses or CIDR blocks the generated R2
access key is denied from.
required:
- name
- buckets
additionalProperties: false
secretsMapping:
type: object
properties:
accessKeyId:
type: string
minLength: 1
description: >-
The name of the secret that the rotated R2 access
key ID will be mapped to.
secretAccessKey:
type: string
minLength: 1
description: >-
The name of the secret that the rotated R2 secret
access key will be mapped to.
required:
- accessKeyId
- secretAccessKey
additionalProperties: false
required:
- id
- name
- folderId
- connectionId
- createdAt
- updatedAt
- rotationInterval
- rotationStatus
- lastRotationAttemptedAt
- lastRotatedAt
- connection
- environment
- projectId
- folder
- rotateAtUtc
- type
- parameters
- secretsMapping
additionalProperties: false
required:
- secretRotation
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
````