Rulesets API docs don't mention which permissions are needed to handle Zone-level rulesets

[lwille]

Which Cloudflare product does this pertain to?

Ruleset Engine

Existing documentation URL(s)

• https://developers.cloudflare.com/ruleset-engine/rulesets-api/view/
• https://developers.cloudflare.com/fundamentals/api/reference/permissions/#:~:text=Account%20Rulesets%20Edit

What changes are you suggesting?

• Docs are updated to reflect that one needs to grant Account.Account Rulesets in order to manage Zone rulesets.

Additional information

No response

[pedrosousa]

Hi @lwille
It guess it depends on the operation you're performing via API, and the phase you're configuring. Can you tell me which zone-level operation failed without the Account.Account Rulesets permission?

For context, I created an API token that only had the Zone.Zone WAF permission and I was able to deploy a WAF managed ruleset to a zone.

[AssafKatz3]

Hi,
There is virtually no documentation regarding this issue, and it was not resolved.
I'm having trouble finding out what kind of permission is needed to get or set a rate limit.
Regards

[ts-web]

There's a serious issue here.

The API docs list these permissions:

And I added all of them I could find:

But still I get the error:

│ Error: failed to make http request
│ 
│   with cloudflare_ruleset.www_redirect,
│   on main.tf line 31, in resource "cloudflare_ruleset" "www_redirect":
│   31: resource "cloudflare_ruleset" "www_redirect" {
│ 
│ POST
│ "https://api.cloudflare.com/client/v4/zones/***/rulesets":
│ 403 Forbidden {
│   "result": null,
│   "success": false,
│   "errors": [
│     {
│       "message": "request is not authorized"
│     }
│   ],
│   "messages": []
│ }
│ 

This is not user error; this is running in CI where other cloudflare resources have been created successfully.

I have no other options now except to try using less fine-grained access control, up to possibly switching to a global API key.

[ts-web]

Opened a new issue: #22808