Driftwatch

APIs / Cloudflare

Cloudflare API changes

Breaking changes, deprecations and new fields in the Cloudflare API, as they ship.

Cloudflare · 8e378c741 breaking4 additive
  • Breaking

    Response field credential_update_fields removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    one_SetupFlow.credential_update_fields · reachable from 1 operation
    Code that breaks
    // response.credential_update_fields is now undefined
    const credential_update_fields = response.credential_update_fields;
4 new response fields
  • one_FormField.is_used_in_create
  • one_FormField.is_used_in_update
  • one_SetupFlowStep.is_used_in_create
  • one_SetupFlowStep.is_used_in_update
Cloudflare · 95716e104 breaking2 behavioral
  • Breaking

    Response field amount removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    aig-billing_SetTopupConfigResult.amount · reachable from 1 operation
    Code that breaks
    // response.amount is now undefined
    const amount = response.amount;
  • Breaking

    Response field threshold removed

    aig-billing_SetTopupConfigResult.threshold · reachable from 1 operation
    Code that breaks
    // response.threshold is now undefined
    const threshold = response.threshold;
  • Breakingdirection flip: their tools call this safe

    amount is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    POST /accounts/{account_id}/ai-gateway/billing/topup/config · amount
    Code that breaks
    await client.post("/accounts/{account_id}/ai-gateway/billing/topup/config", {
      // amount is now ignored, not rejected
      amount: value,
    });
  • Breakingdirection flip: their tools call this safe

    threshold is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    POST /accounts/{account_id}/ai-gateway/billing/topup/config · threshold
    Code that breaks
    await client.post("/accounts/{account_id}/ai-gateway/billing/topup/config", {
      // threshold is now ignored, not rejected
      threshold: value,
    });
  • Behavioral

    402 is now documented on /accounts/{account_id}/ai-gateway/billing/topup/config

    An unhandled branch in your error handling.

    POST /accounts/{account_id}/ai-gateway/billing/topup/config
  • Behavioral

    409 is now documented on /accounts/{account_id}/ai-gateway/billing/topup/config

    POST /accounts/{account_id}/ai-gateway/billing/topup/config
Cloudflare · 911ad78a2 additive
2 new response fields
  • result.records[].outcome
  • result.robots
Cloudflare · ca1630312 breaking1 behavioral
  • Breaking

    Response field code removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    POST /accounts/{account_id}/ai-search/instances/{id}/jobs · errors[].code · 2 call sites
    Code that breaks
    // response.errors[0].code is now undefined
    const code = response.errors[0].code;
  • Breaking

    Response field message removed

    POST /accounts/{account_id}/ai-search/instances/{id}/jobs · errors[].message · 2 call sites
    Code that breaks
    // response.errors[0].message is now undefined
    const message = response.errors[0].message;
  • Behavioral

    503 is now documented on /accounts/{account_id}/ai-search/instances

    An unhandled branch in your error handling.

    POST /accounts/{account_id}/ai-search/instances · 5 call sites
Cloudflare · ad7119d84 breaking15 additive
  • Breaking

    Response field comment removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    email-security_MessageDetails.validation.comment · reachable from 3 operations
    Code that breaks
    // response.validation.comment is now undefined
    const comment = response.validation.comment;
  • Breaking

    Response field dkim removed

    email-security_MessageDetails.validation.dkim · reachable from 3 operations
    Code that breaks
    // response.validation.dkim is now undefined
    const dkim = response.validation.dkim;
  • Breaking

    Response field dmarc removed

    email-security_MessageDetails.validation.dmarc · reachable from 3 operations
    Code that breaks
    // response.validation.dmarc is now undefined
    const dmarc = response.validation.dmarc;
  • Breaking

    Response field spf removed

    email-security_MessageDetails.validation.spf · reachable from 3 operations
    Code that breaks
    // response.validation.spf is now undefined
    const spf = response.validation.spf;
  • Additive

    expired is now optional

    No action needed.

    GET /accounts/{account_id}/email-security/settings/block_senders · expired · 3 call sites
3 new response fields
  • email-security_AllowPolicy.expires_at
  • email-security_BlockedSender.expires_at
  • email-security_ContentPolicy.expires_at
11 new request properties
  • email-security_BlockedSender.expires_at
  • email-security_AllowPolicy.expires_at
  • email-security_ContentPolicy.expires_at
  • email-security_CreateAllowPolicy.expires_at
  • email-security_CreateBlockedSender.expires_at
  • patches[].expires_at
  • puts[].expires_at
  • email-security_UpdateContentPolicy.expires_at
  • email-security_CreateContentPolicy.expires_at
  • email-security_UpdateAllowPolicy.expires_at
  • email-security_UpdateBlockedSender.expires_at
Cloudflare · 8fd09b441 additive
  • Additive

    Response field source added

    No action needed unless you validate responses against a closed schema.

    security-center_issue.source · reachable from 3 operations
Cloudflare · 046aa6e74 breaking
  • Breaking

    Response field messages removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    POST /accounts/{account_id}/images/v1/direct_upload · messages · 31 call sites
    Code that breaks
    // response.messages is now undefined
    const messages = response.messages;
  • Breaking

    Response field result removed

    POST /accounts/{account_id}/images/v1/direct_upload · result · 31 call sites
    Code that breaks
    // response.result is now undefined
    const result = response.result;
  • Breaking

    Response field success removed

    POST /accounts/{account_id}/images/v1/direct_upload · success · 31 call sites
    Code that breaks
    // response.success is now undefined
    const success = response.success;
  • Breaking

    Response field errors removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    GET /accounts/{account_id}/images/v1/keys · errors · 31 call sites
    Code that breaks
    // response.errors is now undefined
    const errors = response.errors;
Cloudflare · 676b311d2 breaking1 additive
  • Breaking

    filter is now required

    Partial payloads are rejected.

    2 places: cws_CreatePolicyInputBody.filter, cws_UpdatePolicyInputBody.filter
    Code that breaks
    await client.post("/…", {
      // …
      filter: /* now required */,
    });
  • Breaking

    filter changed type

    Serialization mismatch. Integer-to-string moves are the usual cause and the usual outage.

    null|string → string

    2 places: cws_CreatePolicyInputBody.filter, cws_UpdatePolicyInputBody.filter
    Code that breaks
    // payload.filter
    // was: null|string
    // now: string
  • Additive

    Response type narrowed

    A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.

    cws_Policy.filter · reachable from 4 operations
Cloudflare · ec19e9f813 additive
2 new response fields
  • dlp_CustomEntry.validator_ids
  • dlp_Entry.validator_ids
4 new request properties
  • dlp_CustomEntryUpdateType.validator_ids
  • dlp_CustomEntryUpdate.validator_ids
  • dlp_EntryUpdateType.validator_ids
  • dlp_NewEntry.validator_ids
Cloudflare · 8a4d71f81 behavioral36 additive
22 new response fields
  • posture-api_BaseFindingType.match_count
  • posture-api_BaseFindingType.origin
  • posture-api_BaseFindingType.version
  • posture-api_BaseFindingType.updated_at
  • posture-api_BaseFindingType.applies_to_all_integrations
  • posture-api_BaseFindingType.asset_class
  • posture-api_BaseFindingType.asset_vendor
  • posture-api_BaseFindingType.created_at
  • posture-api_BaseFindingType.expression
  • posture-api_BaseFindingType.integration_ids
  • posture-api_BaseFindingType.quarantined
  • posture-api_FindingType.applies_to_all_integrations
  • posture-api_FindingType.quarantined
  • posture-api_FindingType.asset_class
  • posture-api_FindingType.asset_vendor
  • posture-api_FindingType.created_at
  • posture-api_FindingType.expression
  • posture-api_FindingType.integration_ids
  • posture-api_FindingType.match_count
  • posture-api_FindingType.origin
  • posture-api_FindingType.updated_at
  • posture-api_FindingType.version
Cloudflare · 2d7caf443 breaking2 behavioral1 additive
Cloudflare · 9b659c161 behavioral4 additive
3 new response fields
  • alexandria_api-response-collection.result_info.cursor
  • alexandria_get_applications_response.result_info.cursor
  • alexandria_get_categories_response.result_info
Cloudflare · f774b1fa3 additive
2 new response fields
  • teams-devices_device_settings_policy.enable_device_credential_authentication
  • teams-devices_default_device_settings_policy.enable_device_credential_authentication
Cloudflare · f816e2611 breaking
  • Breakingdirection flip: their tools call this safe

    Response values are no longer constrained

    The documented set of values is gone, so anything can appear. Every exhaustive switch and generated enum over this field is now incomplete.

    magic-transit_api-response-common-failure.result · reachable from 6 operations
Cloudflare · 322407891 breaking
  • Breaking

    scope changed type

    Serialization mismatch. Integer-to-string moves are the usual cause and the usual outage.

    PATCH /accounts/{account_id}/email/sending/suppressions/{suppression_id} · scope
    Code that breaks
    // payload.scope
    // was: null
    // now: object
Cloudflare · 416bb87d2 breaking
  • Breaking

    Response field retry removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    workers_binding_kind_durable_object_namespace.retry · reachable from 16 operations
    Code that breaks
    // response.retry is now undefined
    const retry = response.retry;
  • Breakingdirection flip: their tools call this safe

    retry is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    workers_binding_kind_durable_object_namespace.retry · reachable from 16 operations
    Code that breaks
    await client.post("/…", {
      // retry is now ignored, not rejected
      retry: value,
    });
Cloudflare · 6f60dafa2 breaking
  • Breaking

    Response field audit_ssh removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    zero-trust-gateway_rule-settings.audit_ssh · reachable from 8 operations
    Code that breaks
    // response.audit_ssh is now undefined
    const audit_ssh = response.audit_ssh;
  • Breakingdirection flip: their tools call this safe

    audit_ssh is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    zero-trust-gateway_rule-settings.audit_ssh · reachable from 8 operations
    Code that breaks
    await client.post("/…", {
      // audit_ssh is now ignored, not rejected
      audit_ssh: value,
    });
Cloudflare · b749ab912 additive
2 new response fields
  • one_FormField.description
  • one_SetupFlow.credential_update_fields
Cloudflare · 2cd37acd4 additive
4 new response fields
  • result.registered_at
  • result.servers[].registered_at
  • result[].servers[].registered_at
  • result[].registered_at
Cloudflare · f1373fcc12 breaking
  • Breaking

    Response field agentName removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    2 places: workers-observability_agent_session.agentName, workers-observability_agent_session_run.agentName
    Code that breaks
    // response.agentName is now undefined
    const agentName = response.agentName;
  • Breaking

    Response field agentId removed

    2 places: workers-observability_agent_session.agentId, workers-observability_agent_session_run.agentId
    Code that breaks
    // response.agentId is now undefined
    const agentId = response.agentId;
  • Breaking

    traceStartMs changed type

    Parse failure, or silent coercion depending on your client.

    workers-observability_agent_session_run.traceStartMs · reachable from 1 operation
    Code that breaks
    // payload.traceStartMs
    // was: number
    // now: integer
  • Breaking

    sessionStartMs changed type

    Parse failure, or silent coercion depending on your client.

    workers-observability_agent_session.sessionStartMs · reachable from 1 operation
    Code that breaks
    // payload.sessionStartMs
    // was: number
    // now: integer
  • Breaking

    Response field spanCount removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    workers-observability_agent_session.spanCount · reachable from 1 operation
    Code that breaks
    // response.spanCount is now undefined
    const spanCount = response.spanCount;
  • Breaking

    traceCount changed type

    Parse failure, or silent coercion depending on your client.

    workers-observability_agent_session.traceCount · reachable from 1 operation
    Code that breaks
    // payload.traceCount
    // was: number
    // now: integer
  • Breaking

    lastActiveMs changed type

    workers-observability_agent_session.lastActiveMs · reachable from 1 operation
    Code that breaks
    // payload.lastActiveMs
    // was: number
    // now: integer
  • Breaking

    Response field serviceName removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    workers-observability_agent_session.serviceName · reachable from 1 operation
    Code that breaks
    // response.serviceName is now undefined
    const serviceName = response.serviceName;
  • Breaking

    sessionDurationMs changed type

    Parse failure, or silent coercion depending on your client.

    workers-observability_agent_session.sessionDurationMs · reachable from 1 operation
    Code that breaks
    // payload.sessionDurationMs
    // was: number
    // now: integer
  • Breaking

    spans changed type

    Parse failure, or silent coercion depending on your client.

    workers-observability_agent_session_run.spans · reachable from 1 operation
    Code that breaks
    // payload.spans
    // was: number
    // now: integer
  • Breaking

    traceDurationMs changed type

    workers-observability_agent_session_run.traceDurationMs · reachable from 1 operation
    Code that breaks
    // payload.traceDurationMs
    // was: number
    // now: integer
  • Breaking

    traceEndMs changed type

    workers-observability_agent_session_run.traceEndMs · reachable from 1 operation
    Code that breaks
    // payload.traceEndMs
    // was: number
    // now: integer
Cloudflare · bfcf262b1 breaking
  • Breaking

    value changed type

    Serialization mismatch. Integer-to-string moves are the usual cause and the usual outage.

    PATCH /accounts/{account_id}/load_balancers/pools · 2 call sites
    Code that breaks
    // payload
    // was: string
    // now: object
Cloudflare · cc9059042 breaking4 additive
  • Breakingdirection flip: their tools call this safe

    id can now return "ZOOM"

    Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

    can now return "ZOOM"

    3 places: one_ApplicationDetail.id, one_ApplicationDetailResponse.result.id, one_ApplicationList.id
    Code that breaks
    switch (response.id) {
      // existing branches …
      // no branch for "ZOOM"
      default:
        throw new Error("unexpected id");
    }
  • Breaking

    use_cases is now required

    Partial payloads are rejected.

    one_IntegrationV2CreateRequest.use_cases · reachable from 1 operation
    Code that breaks
    await client.post("/…", {
      // …
      use_cases: /* now required */,
    });
4 new response fields
  • one_FormField.default_value
  • one_FormField.readonly
  • one_IntegrationV2ListItem.auth_method
  • one_IntegrationV2ListItem.use_cases
Cloudflare · 3605ac9c7 additive
3 new response fields
  • magic_wan.provisioned_download_kbps
  • magic_wan.provisioned_upload_kbps
  • magic_wan_static_addressing.secondary_gateway_address
4 new request properties
  • magic_wan_update_request.provisioned_download_kbps
  • magic_wan_update_request.provisioned_upload_kbps
  • magic_wans_add_single_request.provisioned_download_kbps
  • magic_wans_add_single_request.provisioned_upload_kbps
Cloudflare · f71fc0b41 breaking
  • Breaking

    Response field result removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    2 places: resource-sharing_api-response-collection.result, resource-sharing_api-response-common.result
    Code that breaks
    // response.result is now undefined
    const result = response.result;
Cloudflare · 26a6580c2 additive
  • Additive

    response_status is now optional

    No action needed.

    GET /accounts/{account_id}/access/ai-controls/mcp/analytics/tool-calls/timeseries · response_status · 3 call sites
  • Additive

    Response field response_status added

    No action needed unless you validate responses against a closed schema.

    GET /accounts/{account_id}/access/ai-controls/mcp/analytics/servers/{server_id}/tool-calls/timeseries · result.response_status · 3 call sites
Cloudflare · 89e9b9d75 breaking6 additive
  • Breaking

    Response field default_mode removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    precursor_precursor_config.default_mode · reachable from 2 operations
    Code that breaks
    // response.default_mode is now undefined
    const default_mode = response.default_mode;
  • Breaking

    Response field enforcement_rules removed

    precursor_precursor_config.enforcement_rules · reachable from 2 operations
    Code that breaks
    // response.enforcement_rules is now undefined
    const enforcement_rules = response.enforcement_rules;
  • Breakingdirection flip: their tools call this safe

    default_mode is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    precursor_precursor_config.default_mode · reachable from 2 operations
    Code that breaks
    await client.post("/…", {
      // default_mode is now ignored, not rejected
      default_mode: value,
    });
  • Breakingdirection flip: their tools call this safe

    enforcement_rules is no longer accepted

    Usually ignored rather than rejected, so the call succeeds and does something subtly different.

    precursor_precursor_config.enforcement_rules · reachable from 2 operations
    Code that breaks
    await client.post("/…", {
      // enforcement_rules is now ignored, not rejected
      enforcement_rules: value,
    });
  • Breaking

    Cloudflare-Version is now required

    Every existing call that omits it is rejected.

    GET /zones/{zone_id}/precursor · Cloudflare-Version · 2 call sites
    Code that breaks
    await client.post("/zones/{zone_id}/precursor", {
      // …
      Cloudflare-Version: /* now required */,
    });
3 new response fields
  • precursor_precursor_config.mode
  • precursor_precursor_config.rules
  • precursor_precursor_config.show_interstitial
3 new request properties
  • precursor_precursor_config.mode
  • precursor_precursor_config.rules
  • precursor_precursor_config.show_interstitial
Cloudflare · 422440996 additive
6 new response fields
  • result.records[].metadata.og:image
  • result.records[].metadata.lastModified
  • result.records[].metadata.og:description
  • result.records[].metadata.og:site_name
  • result.records[].metadata.og:title
  • result.records[].metadata.og:type
Cloudflare · e03c4ba38 additive
8 new response fields
  • chunks[].media_end_ms
  • chunks[].media_start_ms
  • chunks[].source_media_type
  • result.chunks[].media_end_ms
  • result.chunks[].media_start_ms
  • result.chunks[].source_media_type
  • errors[].code
  • errors[].message
Cloudflare · 03a744d41 behavioral14 additive
Cloudflare · 115a76a42 breaking
  • Breaking

    Response field documentation_url removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    5 places: request-tracer_api-response-common-failure.errors[].documentation_url, request-tracer_api-response-common-failure.messages[].documentation_url, request-tracer_messages.documentation_url, POST /accounts/{account_id}/request-tracer/trace · errors[].documentation_url, POST /accounts/{account_id}/request-tracer/trace · messages[].documentation_url
    Code that breaks
    // response.errors[0].documentation_url is now undefined
    const documentation_url = response.errors[0].documentation_url;
  • Breaking

    Response field source removed

    5 places: request-tracer_api-response-common-failure.errors[].source, request-tracer_api-response-common-failure.messages[].source, request-tracer_messages.source, POST /accounts/{account_id}/request-tracer/trace · errors[].source, POST /accounts/{account_id}/request-tracer/trace · messages[].source
    Code that breaks
    // response.errors[0].source is now undefined
    const source = response.errors[0].source;
Cloudflare · 9f0353151 breaking15 additive
10 new response fields
  • access_service-tokens.leak_report_url
  • access_service-tokens.leak_reported_at
  • access_service-tokens.leak_reporter
  • access_infra_props.session_duration
  • access_app_response.session_duration
  • access_service-tokens-2.leak_report_url
  • access_service-tokens-2.leak_reported_at
  • access_service-tokens-2.leak_reporter
  • access_organizations.disable_end_user_app_creation
  • access_get_response.result.disable_end_user_app_creation
3 new request properties
  • access_infra_props.session_duration
  • access_app_request.session_duration
  • disable_end_user_app_creation
Cloudflare · c7237c962 behavioral9 additive
9 new request properties
  • intent
  • dataset_scope
  • model
  • notification_mode
  • query
  • query_source
  • status
  • title
  • confirm_query
Cloudflare · ef481f102 breaking
  • Breaking

    Response field code removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    PATCH /accounts/{account_id}/ai-search/namespaces/{name}/instances/{id} · errors[].code · 3 call sites
    Code that breaks
    // response.errors[0].code is now undefined
    const code = response.errors[0].code;
  • Breaking

    Response field message removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    POST /accounts/{account_id}/ai-search/instances · errors[].message · 3 call sites
    Code that breaks
    // response.errors[0].message is now undefined
    const message = response.errors[0].message;
Cloudflare · 3a9c5f0f30 additive
Cloudflare · 69fee7692 breaking8 additive
  • Breaking

    enabled is now required

    Partial payloads are rejected.

    2 places: workers_Domain.enabled, PUT /accounts/{account_id}/workers/domains · enabled
    Code that breaks
    await client.post("/…", {
      // …
      enabled: /* now required */,
    });
  • Breaking

    previews_enabled is now required

    2 places: workers_Domain.previews_enabled, PUT /accounts/{account_id}/workers/domains · previews_enabled
    Code that breaks
    await client.post("/…", {
      // …
      previews_enabled: /* now required */,
    });
  • Additive

    enabled is now optional

    No action needed.

    GET /accounts/{account_id}/workers/domains · enabled
  • Additive

    previews_enabled is now optional

    GET /accounts/{account_id}/workers/domains · previews_enabled
2 new response fields
  • workers_Domain.previews_enabled
  • workers_Domain.enabled
4 new request properties
  • workers_Domain.enabled
  • workers_Domain.previews_enabled
  • enabled
  • previews_enabled
Cloudflare · a0ec7bd91 additive
  • Additive

    tz is now optional

    No action needed.

    GET /accounts/{account_id}/workers/observability/usage · tz
Cloudflare · 41d8341c2 behavioral3 additive
Cloudflare · d8f415c12 breaking1 behavioral
  • Breaking

    Response field message removed

    Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.

    POST /accounts/{account_id}/ai-search/namespaces/{name}/instances/{id}/items · errors[].message · 4 call sites
    Code that breaks
    // response.errors[0].message is now undefined
    const message = response.errors[0].message;
  • Breaking

    Response field code removed

    POST /accounts/{account_id}/ai-search/namespaces/{name}/instances/{id}/items · errors[].code · 4 call sites
    Code that breaks
    // response.errors[0].code is now undefined
    const code = response.errors[0].code;
  • Behavioral

    409 is now documented on /accounts/{account_id}/ai-search/namespaces/{name}/instances/{id}/items/{item_id}

    An unhandled branch in your error handling.

    DELETE /accounts/{account_id}/ai-search/namespaces/{name}/instances/{id}/items/{item_id} · 2 call sites