Skip to content

Update docs for R2 Account level and User level API tokens #21350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 4, 2025
Merged

Update docs for R2 Account level and User level API tokens #21350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion public/__redirects
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1187,7 +1187,8 @@

# r2
/r2/platform/s3-compatibility/api/ /r2/api/s3/api/ 301
/r2/platform/s3-compatibility/tokens/ /r2/api/s3/tokens/ 301
/r2/platform/s3-compatibility/tokens/ /r2/api/tokens/ 301
/r2/api/s3/tokens/ /r2/api/tokens/ 301
/r2/runtime-apis/ /r2/api/workers/workers-api-reference/ 301
/r2/data-access/ /r2/api/ 301
/r2/data-access/public-buckets/ /r2/buckets/public-buckets/ 301
Expand Down
33 changes: 15 additions & 18 deletions src/content/docs/data-localization/how-to/r2.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,9 @@ title: R2 Object Storage
pcx_content_type: how-to
sidebar:
order: 6

---

import { Details } from "~/components"
import { Details } from "~/components";

In the following sections, we will give you some details about how to configure R2 with Regional Services and Customer Metadata Boundary.

Expand All @@ -32,7 +31,7 @@ The following instructions will show you how to set up a Logpush job using an S3

<Details header="Generate a token for a specific bucket (recommended)">

Go to the R2 section of your Cloudflare dashboard and select **Manage R2 API Tokens** to generate a token directly tied to your specific bucket. You can follow the instructions in the [Authentication](/r2/api/s3/tokens/) section.
Go to the R2 section of your Cloudflare dashboard and select **Manage R2 API Tokens** to generate a token directly tied to your specific bucket. You can follow the instructions in the [Authentication](/r2/api/tokens/) section.

</Details>

Expand All @@ -54,19 +53,19 @@ The result:

```json
{
"result": {
"id": "325xxxxcd",
"status": "active"
},
"success": true,
"errors": [],
"messages": [
{
"code": 10000,
"message": "This API Token is valid and active",
"type": null
}
]
"result": {
"id": "325xxxxcd",
"status": "active"
},
"success": true,
"errors": [],
"messages": [
{
"code": 10000,
"message": "This API Token is valid and active",
"type": null
}
]
}
```

Expand Down Expand Up @@ -97,10 +96,8 @@ With Customer Metadata Boundary set to `EU`, **R2** > **Bucket** > [**Metrics**]

:::note


Additionally, customers can create R2 buckets with [jurisdictional restrictions set to EU](/r2/reference/data-location/#jurisdictional-restrictions). In this case, we recommend [using jurisdictions with the S3 API](/r2/reference/data-location/#using-jurisdictions-with-the-s3-api).


:::

Refer to the [R2 documentation](/r2/) for more information.
59 changes: 24 additions & 35 deletions src/content/docs/logs/R2-log-retrieval.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,9 @@ pcx_content_type: how-to
title: Logs Engine
sidebar:
order: 117

---

import { Details } from "~/components"
import { Details } from "~/components";

Logs Engine gives you the ability to store your logs in R2 and query them directly.

Expand All @@ -17,12 +16,12 @@ Logs Engine is going to be replaced by Log Explorer. For further details, consul

## Store logs in R2

* Set up a [Logpush to R2](/logs/get-started/enable-destinations/r2/) job.
* Create an [R2 access key](/r2/api/s3/tokens/) with at least R2 read permissions.
* Ensure that you have Logshare read permissions.
* Alternatively, create a Cloudflare API token with the following permissions:
* Account scope
* Logs read permissions
- Set up a [Logpush to R2](/logs/get-started/enable-destinations/r2/) job.
- Create an [R2 access key](/r2/api/tokens/) with at least R2 read permissions.
- Ensure that you have Logshare read permissions.
- Alternatively, create a Cloudflare API token with the following permissions:
- Account scope
- Logs read permissions

## Query logs

Expand All @@ -32,49 +31,49 @@ You can use the API to query and download your logs by time range or RayID.

The following headers are required for all API calls:

* `X-Auth-Email` - the Cloudflare account email address associated with the domain
* `X-Auth-Key` - the Cloudflare API key
- `X-Auth-Email` - the Cloudflare account email address associated with the domain
- `X-Auth-Key` - the Cloudflare API key

Alternatively, API tokens with Logs edit permissions can also be used for authentication:

* `Authorization: Bearer <API_TOKEN>`
- `Authorization: Bearer <API_TOKEN>`

### Required headers

In addition to the required authentication headers mentioned, the following headers are required for the API to access logs stored in your R2 bucket.

`R2-access-key-id` (required) - [R2 Access Key Id](/r2/api/s3/tokens/)
`R2-secret-access-key` (required) - [R2 Secret Access Key](/r2/api/s3/tokens/)
- `R2-access-key-id` (required) - [R2 Access Key Id](/r2/api/tokens/)
- `R2-secret-access-key` (required) - [R2 Secret Access Key](/r2/api/tokens/)

## List files

List relevant R2 objects containing logs matching the provided query parameters, using the endpoint `GET /accounts/{accountId}/logs/list`.

### Query parameters

* `start` (required) string (TimestampRFC3339) - Start time in RFC 3339 format, for example `start=2022-06-06T16:00:00Z`.
- `start` (required) string (TimestampRFC3339) - Start time in RFC 3339 format, for example `start=2022-06-06T16:00:00Z`.

* `end` (required) string (TimestampRFC3339) - End time in RFC 3339 format, for example `end=2022-06-06T16:00:00Z`.
- `end` (required) string (TimestampRFC3339) - End time in RFC 3339 format, for example `end=2022-06-06T16:00:00Z`.

* `bucket` (required) string (Bucket) - R2 bucket name, for example `bucket=cloudflare-logs`.
- `bucket` (required) string (Bucket) - R2 bucket name, for example `bucket=cloudflare-logs`.

* `prefix` string (Prefix) - R2 bucket prefix logs are stored under, for example `prefix=http_requests/example.com/{DATE}`.
- `prefix` string (Prefix) - R2 bucket prefix logs are stored under, for example `prefix=http_requests/example.com/{DATE}`.

* `limit` number (Limit) - Maximum number of results to return, for example `limit=100`.
- `limit` number (Limit) - Maximum number of results to return, for example `limit=100`.

## Retrieve logs by time range

Stream logs stored in R2 that match the provided query parameters, using the endpoint `GET /accounts/{accountId}/logs/retrieve`.

### Query parameters

* `start` (required) string (TimestampRFC3339) - Start time in RFC 3339 format, for example `start=2022-06-06T16:00:00Z`
- `start` (required) string (TimestampRFC3339) - Start time in RFC 3339 format, for example `start=2022-06-06T16:00:00Z`

* `end` (required) string (TimestampRFC3339) - End time in RFC 3339 format, for example `end=2022-06-06T16:00:00Z`
- `end` (required) string (TimestampRFC3339) - End time in RFC 3339 format, for example `end=2022-06-06T16:00:00Z`

* `bucket` (required) string (Bucket) - R2 bucket name, for example `bucket=cloudflare-logs`
- `bucket` (required) string (Bucket) - R2 bucket name, for example `bucket=cloudflare-logs`

* `prefix` string (Prefix) - R2 bucket prefix logs are stored under, for example `prefix=http_requests/example.com/{DATE}`
- `prefix` string (Prefix) - R2 bucket prefix logs are stored under, for example `prefix=http_requests/example.com/{DATE}`

### Example API request

Expand Down Expand Up @@ -133,52 +132,42 @@ curl --globoff "https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/

## Troubleshooting


<Details header="I am getting an error when accessing the API">

* **Error**: Time range returned too many results. Try reducing the time range and try again.
- **Error**: Time range returned too many results. Try reducing the time range and try again.

HTTP status code `422` will be returned if the time range between the start and end parameters is too wide. Try querying a shorter time range if you are running into this limit.

* **Error**: Provided token does not have the required features enabled.
- **Error**: Provided token does not have the required features enabled.

Contact your account representative to have the beta Logpull RayID Lookup subscription added to your account.

* **Error**: Time range returned too many results. Try reducing the time range and try again.
- **Error**: Time range returned too many results. Try reducing the time range and try again.

High volume zones can produce many log files in R2. Try reducing your start and end time range until you find a duration that works best for your log volume.


</Details>


<Details header="How do I know what time range to index?">

Currently, there is no process to index logs as they arrive. If you have the RayID and know the time the request was made, try indexing the next 5-10 minutes of logs after the request was completed.


</Details>


<Details header="What is the time delay between when an event happens and when I can query for it?">

Logpush delivers logs in batches as soon as possible, generally in less than one minute. After this, logs can be accessed using Logs Engine.


</Details>


<Details header="Does R2 have retention controls?">

R2 does not currently have retention controls in place. You can query back as far as when you created the Logpush job.


</Details>


<Details header="Which datasets is Logs Engine compatible with?">

The retrieval API is compatible with all the datasets we support. The full list is available on the [Log fields](/logs/reference/log-fields/) section.


</Details>
Loading