Skip to content

Commit 805b078

Browse files
ranbelsdnts
ranbel
authored and
sdnts
committed
[ZT] Implement APIRequest for Access, WARP, Tunnel (cloudflare#23143)
* dash SSO * dash sso permission * infra ssh * device info only mode * tunnel token * create remote tunnel * OTP * entra id * generic oidc * audit logs * convert legacy policy * egress ips with vnets * mtls cert * access groups * add missing component * add missing component * fix components
1 parent 4d63c57 commit 805b078

File tree

16 files changed

+380
-402
lines changed

16 files changed

+380
-402
lines changed

‎src/content/docs/cloudflare-one/applications/configure-apps/dash-sso-apps.mdx‎

Lines changed: 28 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 4
66
---
77

8-
import { FeatureTable } from "~/components";
8+
import { FeatureTable, APIRequest } from "~/components";
99

1010
By adding a Cloudflare Dashboard SSO application to your Cloudflare Zero Trust account, you can enforce single sign-on (SSO) to the Cloudflare dashboard with the identity provider (IdP) of your choice. SSO will be enforced for every user in your email domain.
1111

@@ -114,15 +114,14 @@ If there is an issue with your SSO IdP provider, you can add an alternate IdP us
114114

115115
1. [Add](/api/resources/zero_trust/subresources/identity_providers/methods/create/) one-time PIN login:
116116

117-
```bash title="cURL command"
118-
curl 'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/identity_providers' \
119-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
120-
--header "Content-Type: application/json" \
121-
--data '{
122-
"type": "onetimepin",
123-
"config": {}
124-
}'
125-
```
117+
<APIRequest
118+
path="/accounts/{account_id}/access/identity_providers"
119+
method="POST"
120+
json={{
121+
type: "onetimepin",
122+
config: {},
123+
}}
124+
/>
126125

127126
2. [Get](/api/resources/zero_trust/subresources/access/subresources/applications/methods/list/) the `id` of the `dash_sso` Access application. You can use [`jq`](https://jqlang.github.io/jq/download/) to quickly find the correct application:
128127

@@ -142,20 +141,24 @@ curl 'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps' \
142141
}
143142
```
144143

145-
3. Using the `id` obtained above, [update](/api/resources/zero_trust/subresources/access/subresources/applications/methods/update/) **SSO App** to accept all identity providers:
146-
147-
```bash title="cURL command"
148-
curl --request PUT \
149-
'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps/3537a672-e4d8-4d89-aab9-26cb622918a1' \
150-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
151-
--header "Content-Type: application/json" \
152-
--data '{
153-
"id": "3537a672-e4d8-4d89-aab9-26cb622918a1",
154-
...
155-
"allowed_idps": [],
156-
...
157-
}'
158-
```
144+
3. Using the `id` obtained above, [update](/api/resources/zero_trust/subresources/access/subresources/applications/methods/update/) **SSO App** to accept all identity providers. To avoid overwriting your existing configuration, the PUT request body should contain all fields returned by the previous GET request.
145+
146+
<APIRequest
147+
path="/accounts/{account_id}/access/apps/{app_id}"
148+
method="PUT"
149+
parameters={{ app_id: "3537a672-e4d8-4d89-aab9-26cb622918a1" }}
150+
json={{
151+
id: "3537a672-e4d8-4d89-aab9-26cb622918a1",
152+
uid: "3537a672-e4d8-4d89-aab9-26cb622918a1",
153+
type: "dash_sso",
154+
name: "SSO App",
155+
allowed_idps: [],
156+
// ... (other existing properties)
157+
}}
158+
code={{
159+
mark: [9]
160+
}}
161+
/>
159162

160163
Users will now have the option to log in using a one-time PIN.
161164

@@ -192,8 +195,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/sso/v2/connectors
192195
```bash title="cURL command"
193196
curl --request PATCH \
194197
'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/sso/v2/connectors/2828' \
195-
--header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
196-
--header "X-Auth-Key: $CLOUDFLARE_API_KEY" \
198+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
197199
--header "Content-Type: application/json" \
198200
--data '{
199201
"sso_connector_status": "DIS"

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/device-information-only.mdx‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66

77
---
88

9-
import { TabItem, Tabs, Details, Width } from "~/components"
9+
import { TabItem, Tabs, Details, Width, APIRequest } from "~/components"
1010

1111
<Details header="Feature availability">
1212

@@ -27,14 +27,13 @@ Device Information Only mode allows you to enforce device posture rules when a u
2727

2828
Using the API, enable client certificate provisioning for [your zone](/fundamentals/account/find-account-and-zone-ids/):
2929

30-
```bash
31-
curl --request PATCH \
32-
"https://api.cloudflare.com/client/v4/zones/{zone_id}/devices/policy/certificates" \
33-
--header "X-Auth-Email: <EMAIL>" \
34-
--header "X-Auth-Key: <API_KEY>" \
35-
--header "Content-Type: application/json" \
36-
--data '{"enabled": true}'
37-
```
30+
<APIRequest
31+
path="/zones/{zone_id}/devices/policy/certificates"
32+
method="PATCH"
33+
json={{
34+
enabled: true,
35+
}}
36+
/>
3837

3938
## 2. Configure the WARP client
4039

‎src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx‎

Lines changed: 23 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 10
66
---
77

8-
import { TabItem, Tabs, Render } from "~/components";
8+
import { TabItem, Tabs, Render, APIRequest } from "~/components";
99

1010
A remotely-managed tunnel only requires the tunnel token to run. Anyone with access to the token will be able to run the tunnel.
1111

@@ -23,7 +23,12 @@ To get the token for a remotely-managed tunnel:
2323
</TabItem>
2424
<TabItem label="API">
2525

26-
Make a `GET` request to the [Cloudflare Tunnel token](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/token/methods/get/) endpoint. The token value can be found in the `result`:
26+
Make a `GET` request to the [Cloudflare Tunnel token](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/token/methods/get/) endpoint:
27+
28+
<APIRequest
29+
path="/accounts/{account_id}/cfd_tunnel/{tunnel_id}/token"
30+
method="GET"
31+
/>
2732

2833
```sh output
2934
{
@@ -34,6 +39,8 @@ Make a `GET` request to the [Cloudflare Tunnel token](/api/resources/zero_trust/
3439
}
3540
```
3641

42+
The token value can be found in the `result`.
43+
3744
</TabItem>
3845

3946
<TabItem label="Terraform (v5)">
@@ -73,16 +80,15 @@ To rotate a tunnel token:
7380
```
7481

7582
2. Make a `PATCH` request to the [Cloudflare Tunnel](/api/resources/zero_trust/subresources/tunnels/methods/edit/) endpoint:
76-
```sh
77-
curl --request PATCH \
78-
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
79-
--header 'Content-Type: application/json' \
80-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
81-
--data '{
82-
"name": "Example tunnel",
83-
"tunnel_secret": "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg="
84-
}'
85-
```
83+
84+
<APIRequest
85+
path="/accounts/{account_id}/cfd_tunnel/{tunnel_id}"
86+
method="PATCH"
87+
json={{
88+
name: "Example tunnel",
89+
tunnel_secret: "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg=",
90+
}}
91+
/>
8692

8793
```sh output {18}
8894
{
@@ -144,11 +150,11 @@ If your tunnel token is compromised, we recommend taking the following steps:
144150

145151
1. Refresh the token using the dashboard or API. Refer to Step 1 of [Rotate a token without service disruption](#rotate-a-token-without-service-disruption).
146152
2. [Delete all connections](/api/resources/zero_trust/subresources/tunnels/subresources/connections/methods/delete/) between `cloudflared` and Cloudflare:
147-
```sh
148-
curl --request DELETE \
149-
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
150-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
151-
```
153+
154+
<APIRequest
155+
path="/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections"
156+
method="DELETE"
157+
/>
152158

153159
This will clean up any unauthorized connections and prevent users from connecting to your network.
154160

‎src/content/docs/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel-api.mdx‎

Lines changed: 54 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ sidebar:
55
order: 2
66
---
77

8-
import { Render } from "~/components";
8+
import { Render, APIRequest } from "~/components";
99

1010
Follow this guide to set up a Cloudflare Tunnel using the API.
1111

12-
## 1. Create an API token
12+
## Create an API token
1313

1414
[Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
1515

@@ -22,15 +22,14 @@ Follow this guide to set up a Cloudflare Tunnel using the API.
2222

2323
Make a `POST` request to the [Cloudflare Tunnel](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/create/) endpoint:
2424

25-
```sh
26-
curl 'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel' \
27-
--header 'Content-Type: application/json' \
28-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
29-
--data '{
30-
"name": "api-tunnel",
31-
"config_src": "cloudflare"
32-
}'
33-
```
25+
<APIRequest
26+
path="/accounts/{account_id}/cfd_tunnel"
27+
method="POST"
28+
json={{
29+
name: "api-tunnel",
30+
config_src: "cloudflare",
31+
}}
32+
/>
3433

3534
```sh output
3635
{
@@ -76,27 +75,24 @@ Follow these steps to connect an application through your tunnel. If you are loo
7675

7776
1. Make a [`PUT` request](/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/configurations/methods/update/) to route your local service URL to a public hostname. For example,
7877

79-
```sh
80-
curl --request PUT \
81-
'https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/c1744f8b-faa1-48a4-9e5c-02ac921467fa/configurations' \
82-
--header 'Content-Type: application/json' \
83-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
84-
--data '{
85-
"config": {
86-
"ingress": [
87-
{
88-
"hostname": "app.example.com",
89-
"service": "http://localhost:8001",
90-
"originRequest": {}
91-
},
92-
{
93-
"service": "http_status:404"
94-
}
95-
]
96-
}
97-
}'
98-
```
99-
78+
<APIRequest
79+
path="/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations"
80+
method="PUT"
81+
json={{
82+
config: {
83+
ingress: [
84+
{
85+
hostname: "app.example.com",
86+
service: "http://localhost:8001",
87+
originRequest: {},
88+
},
89+
{
90+
service: "http_status:404",
91+
},
92+
],
93+
},
94+
}}
95+
/>
10096
:::note
10197
If you add a multi-level subdomain (more than one level of subdomain), you must [order an Advanced Certificate for the hostname](/cloudflare-one/faq/troubleshooting/#i-see-this-site-cant-provide-a-secure-connection).
10298
:::
@@ -105,17 +101,16 @@ Follow these steps to connect an application through your tunnel. If you are loo
105101

106102
2. [Create a DNS record](/api/resources/dns/subresources/records/methods/create/) for your application:
107103

108-
```sh
109-
curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records \
110-
--header 'Content-Type: application/json' \
111-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
112-
--data '{
113-
"type": "CNAME",
114-
"proxied": true,
115-
"name": "app.example.com",
116-
"content": "c1744f8b-faa1-48a4-9e5c-02ac921467fa.cfargotunnel.com"
117-
}'
118-
```
104+
<APIRequest
105+
path="/zones/{zone_id}/dns_records"
106+
method="POST"
107+
json={{
108+
type: "CNAME",
109+
proxied: true,
110+
name: "app.example.com",
111+
content: "c1744f8b-faa1-48a4-9e5c-02ac921467fa.cfargotunnel.com",
112+
}}
113+
/>
119114

120115
This DNS record allows Cloudflare to proxy `app.example.com` traffic to your Cloudflare Tunnel (`<tunnel-id>.cfargotunnel.com`).
121116

@@ -125,16 +120,15 @@ This application will be publicly available on the Internet once you [run the tu
125120

126121
To connect a private network through your tunnel, [add a tunnel route](/api/resources/zero_trust/subresources/networks/subresources/routes/methods/create/):
127122

128-
```sh
129-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \
130-
--header 'Content-Type: application/json' \
131-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
132-
--data '{
133-
"network": "172.16.0.0/16",
134-
"tunnel_id": "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
135-
"comment": "Example private network route"
136-
}'
137-
```
123+
<APIRequest
124+
path="/accounts/{account_id}/teamnet/routes"
125+
method="POST"
126+
json={{
127+
network: "172.16.0.0/16",
128+
tunnel_id: "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
129+
comment: "Example private network route",
130+
}}
131+
/>
138132

139133
To configure Zero Trust policies and connect as a user, refer to [Connect private networks](/cloudflare-one/connections/connect-networks/private-net/cloudflared/).
140134

@@ -148,11 +142,13 @@ Install `cloudflared` on your server and run the tunnel using the `token` value
148142

149143
To check if the tunnel is serving traffic:
150144

151-
```sh
152-
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/c1744f8b-faa1-48a4-9e5c-02ac921467fa \
153-
--header 'Content-Type: application/json' \
154-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
155-
```
145+
<APIRequest
146+
path="/accounts/{account_id}/cfd_tunnel/{tunnel_id}"
147+
method="GET"
148+
parameters={{
149+
tunnel_id: "c1744f8b-faa1-48a4-9e5c-02ac921467fa",
150+
}}
151+
/>
156152

157153
```sh output
158154
{

‎src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
label: SSH with Access for Infrastructure
77
---
88

9-
import { Tabs, TabItem, Badge, Render } from "~/components";
9+
import { Tabs, TabItem, Badge, Render, APIRequest } from "~/components";
1010

1111
[Access for Infrastructure](/cloudflare-one/applications/non-http/infrastructure-apps/) provides granular control over how users can connect to your SSH servers. This feature uses the same deployment model as [WARP-to-Tunnel](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/) but unlocks more policy options and command logging functionality.
1212

@@ -121,13 +121,13 @@ Cloudflare will stop logging SSH commands to your targets, as well as any comman
121121

122122
To delete the SSH encryption public key using the [API](/api/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/update/):
123123

124-
```sh
125-
curl --request PUT https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/audit_ssh_settings \
126-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
127-
--data '{
128-
"public_key": ""
129-
}'
130-
```
124+
<APIRequest
125+
path="/accounts/{account_id}/gateway/audit_ssh_settings"
126+
method="PUT"
127+
json={{
128+
public_key: "",
129+
}}
130+
/>
131131

132132
</TabItem>
133133
</Tabs>

0 commit comments

Comments
 (0)