API Definition and Developer Experience

4/13/2026

This post introduces a new TypeScript schema for defining APIs, CLI commands, and other interfaces, enabling code generation for SDKs, Terraform providers, Agent Skills, and the CLI. It also announces a technical preview of a rebuilt Wrangler CLI (now `cf`) that aims to cover all Cloudflare products and introduces Local Explorer for introspecting simulated local resources during development.

2/20/2026

This post introduces a new application of Code Mode for AI agents, enabling them to interact with the entire Cloudflare API via MCP with drastically reduced token usage. It highlights the development of a new MCP server that exposes thousands of API endpoints through just two tools, `search()` and `execute()`, and open-sources a Code Mode SDK for developers to implement similar patterns. This significantly enhances the developer experience for AI agents interacting with Cloudflare's extensive API surface.

4/23/2024

This post details the development of an automated SDK pipeline using OpenAPI schemas and the Stainless generation engine. It outlines the guiding principles for SDK generation: language-agnostic generation, lowering the mean time to uniform support, and fast feedback loops with clear conventions. The post describes the implementation of CI checks using Redocly CLI for API schema quality and adherence to conventions, and the use of Stainless to generate SDKs from OpenAPI schemas, enabling consistent SDK development across multiple languages.

5/15/2023

This post introduces two new ChatGPT plugins: one for Cloudflare Radar and one for Cloudflare Docs. The Radar plugin leverages an OpenAPI specification to allow natural language queries about internet patterns. The Docs plugin uses a retrieval-based approach with embeddings stored in KV to provide up-to-date documentation information to ChatGPT. Both plugins are built on Cloudflare Workers and showcase how OpenAPI definitions and advanced data handling can be used to integrate Cloudflare services with emerging AI platforms, significantly enhancing developer experience and access to information.

3/15/2023

Introduced machine learning-based API Discovery to automatically identify all API endpoints without requiring customer input like session identifiers. Developed Schema Learning to automatically generate OpenAPI schemas for discovered endpoints, enabling real-time schema validation and positive security model enforcement.

3/7/2023

Introduced Scout, a Python-based automated testing system leveraging Pytest and OpenAPI schemas to verify the end-to-end behavior of Cloudflare's APIs. Scout addresses limitations of previous testing frameworks by enabling easier JSON response matching, request validation against OpenAPI schemas, parallel test execution, and environment-specific testing. It uses Pytest fixtures and marks for targeted resource allocation and validation, and stores results in Cloudflare Workers KV for presentation via a Worker.

11/16/2022

This post details the technical implementation of a new API documentation site. Key contributions include: transitioning from JSON hyper-schemas to the OpenAPI specification for API definition, adopting Stoplight Elements (an open-source React framework) for site design and customization, and leveraging Cloudflare Pages with Pages Functions for building, deploying, and optimizing the documentation site. Pages Functions are used to optimize the OpenAPI schema file for Stoplight's UI and cache it on Cloudflare's network. This architecture enables dynamic schema loading, allowing documentation updates to reflect schema changes without full site redeployments.

11/16/2022

This post details Cloudflare's transition from JSON Hyper-Schema to OpenAPI for defining its APIs. It explains the benefits of OpenAPI, including improved tooling support for API documentation generation (using Stoplight Elements), local API mocking for testing (using Stoplight Prism), and automatic library generation for various programming languages (using openapi-generator). The post also describes the technical approach to migrating existing APIs, which involved building an auto-conversion tool from JSON Hyper-Schema to OpenAPI, allowing for a seamless transition without halting ongoing API development.

9/22/2022

This post announces the General Availability (GA) of API Endpoint Management and Metrics within API Shield. Key contributions include: 1. GA of Endpoint Management: Allows saving, updating, and monitoring API endpoints, including manual addition and deletion. 2. GA of Performance Metrics: Provides real-time data on latency, error rate (4xx, 5xx), request count, and response size for API endpoints. 3. Enhanced API Discovery: Now accepts cookies as session identifiers in addition to authorization headers. 4. Schema Validation for Request Bodies: Enables validation of the request body against an OpenAPI schema.

3/16/2022

This post announces the Cloudflare API Gateway, a new product that packages existing and new features for API security, management, and monitoring. It details the security features: Discovery (identifying API endpoints, methods, paths, and collapsing variable paths), Schema Validation (validating incoming traffic against OpenAPI schemas, with body validation coming soon), Abuse Detection (suggesting rate limits based on discovered endpoints and traffic patterns, leveraging ML from Bot Management, with sequential abuse detection in early access), and mTLS (for certificate-based traffic validation, offering unlimited certificates for API Gateway customers). It also introduces authentication features (API keys, JWT, OAuth 2.0) leveraging Cloudflare Access for validation and token exchange, and routing/management features built on Transform Rules for microservice orchestration.

9/23/2021

This post introduces the implementation of the OAuth 2.0 Authorization Code Flow with PKCE challenges for the `wrangler login` command. This change replaces API token-based authentication for Wrangler, offering a more streamlined and secure user experience. Key technical details include the definition of OAuth 2.0 roles (Resource Owner, Resource Server, Client, Authorization Server), the Authorization Code Flow with PKCE, the use of CSRF states, and the management of short-lived access tokens and refresh tokens. The post also details how users can specify scopes for authorization and revoke access via `wrangler logout`.

9/23/2017

This post introduces the official cloudflare-php API binding, available via Packagist. It details design decisions made for the binding, including the exclusive use of PHP 7 for its type hinting features and the implementation of object composition and dependency injection for flexibility. The post also explains how PSR-7 is used for testing and mocking HTTP requests.

12/28/2016

This post introduces a method for automated REST API testing using PHP, Guzzle (HTTP client), and PHPUnit (testing framework). It details setting up the environment with Composer, configuring PHPUnit with `phpunit.xml`, and writing test cases for GET and PUT HTTP verbs against endpoints like httpbin.org/user-agent. The post demonstrates how to assert status codes, content types, and JSON response bodies, and provides a GitHub repository link for the complete code.

8/3/2016

This post details Cloudflare's internal tooling for generating API documentation from JSON Hyper-Schema. It introduces the JSON Schema Docs Generator (JSDC) and a new toolchain based on Webpack loaders (json-schema-loader, json-schema-example-loader) and React themes (doca-bootstrap-theme) for a more modular and extensible documentation generation process. The new toolchain addresses configuration complexity, build speed, template dependency management, and customization challenges.

5/10/2016

This post introduces python-cloudflare, a Python wrapper providing full access to the Cloudflare v4 API. It details how the library mirrors the API structure, provides examples for common operations like listing zones and managing DNS records, and highlights the availability of a command-line interface (CLI) for interacting with the API. It also mentions the existence of client libraries for Go and Node.js.

5/9/2016

This post announces the sunsetting of Cloudflare's API v1 in favor of API v4, effective November 9th, 2016. API v4 offers significantly expanded functionality, including management of Page Rules, SSL certificates, Railgun connections, custom error pages, analytics, firewall access rules (with IPv6, CIDR, ASN, and country support), mobile redirects, response buffering/streaming toggles, query string sorting, Polish, HSTS, TLS Client Auth settings, True-Client-IP header management, TLS 1.2 enforcement, Purge by Tag, zone management, user account management, billing history, and subscription management. It also introduces Multi-User support for Enterprise customers and Virtual DNS management. A key technical improvement is the consistent use of JSON for both requests and responses, simplifying data handling. The namespacing has also been made more human-readable, with examples like 'always_online' replacing 'ob'. Migration documentation and client libraries for Go, Python, and Node.js are provided.

9/16/2011

This post introduces the Cloudflare API as a means to programmatically control various aspects of the Cloudflare service, including development mode, cache purging, statistics retrieval, spam reporting, and challenge page customization. It provides essential prerequisites like API keys, zone IDs, and account email, and points to the Client Interface API documentation for detailed call parameters.