{"openapi":"3.1.0","info":{"title":"Cloudflare Account IAM (BYOK) API","version":"0.1.0","description":"Cloudflare Account IAM (BYOK) lets an AI assistant read your own Cloudflare Account IAM data through the Cloudflare Account IAM API with a key you supply (Cloudflare API token with Account Settings read permission). Read-only: 8 tools (list_roles, get_role, list_permission_groups, get_permission_group, list_resource_groups, get_resource_group, list_user_groups, get_user_group). The BYOK key...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-cloudflare-account-iam.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-cloudflare-account-iam/docs"},"termsOfService":"https://connectorbay.com/byok-cloudflare-account-iam/terms"},"servers":[{"url":"https://byok-cloudflare-account-iam.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-cloudflare-account-iam/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_roles":{"post":{"operationId":"list_roles","summary":"List the account roles with description and the read/write permissions per area (DNS, billing, zones, SSL, WAF and more)","description":"List the account roles with description and the read/write permissions per area (DNS, billing, zones, SSL, WAF and more). No member records are returned. Use for \"What roles exist on my Cloudflare account and what can they do\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"per_page":{"anyOf":[{"maximum":50,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results per page (1 to 50).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_rolesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_role":{"post":{"operationId":"get_role","summary":"Get one account role with description and the read/write permissions per area. Use for \"What can the Administrator role ","description":"Get one account role with description and the read/write permissions per area. Use for \"What can the Administrator role do on my Cloudflare account\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"role_id":{"description":"Role id (32-character hex string), as returned by list_roles.","maxLength":64,"title":"Role Id","type":"string"}},"required":["account_id","role_id"],"title":"get_roleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_permission_groups":{"post":{"operationId":"list_permission_groups","summary":"List account permission groups (named bundles of API permissions) with category, label, description and scopes. Use for ","description":"List account permission groups (named bundles of API permissions) with category, label, description and scopes. Use for \"Which permission groups can I assign on my Cloudflare account\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only the permission group with this exact name.","title":"Name"},"label":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only the permission group with this label.","title":"Label"},"per_page":{"anyOf":[{"maximum":50,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results per page (1 to 50).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_permission_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_permission_group":{"post":{"operationId":"get_permission_group","summary":"Get one permission group with name, category, label, description and scopes. Use for \"What does permission group 6c9b8f3","description":"Get one permission group with name, category, label, description and scopes. Use for \"What does permission group 6c9b8f3a5d2e4a7b8c1d0e9f8a7b6c5d grant\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"permission_group_id":{"description":"Permission group id, as returned by list_permission_groups.","maxLength":64,"title":"Permission Group Id","type":"string"}},"required":["account_id","permission_group_id"],"title":"get_permission_groupArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_resource_groups":{"post":{"operationId":"list_resource_groups","summary":"List account resource groups (named sets of accounts, zones or other resources a policy applies to) with scope. Use for ","description":"List account resource groups (named sets of accounts, zones or other resources a policy applies to) with scope. Use for \"Which resource groups are defined on my Cloudflare account\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only the resource group with this exact name.","title":"Name"}},"required":["account_id"],"title":"list_resource_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_resource_group":{"post":{"operationId":"get_resource_group","summary":"Get one resource group with its metadata and scope objects. Use for \"What does resource group 6c9b8f3a5d2e4a7b8c1d0e9f8a","description":"Get one resource group with its metadata and scope objects. Use for \"What does resource group 6c9b8f3a5d2e4a7b8c1d0e9f8a7b6c5d cover\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"resource_group_id":{"description":"Resource group id, as returned by list_resource_groups.","maxLength":64,"title":"Resource Group Id","type":"string"}},"required":["account_id","resource_group_id"],"title":"get_resource_groupArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_user_groups":{"post":{"operationId":"list_user_groups","summary":"List account user groups with their access policies (allow or deny, permission groups, resource groups). Group members a","description":"List account user groups with their access policies (allow or deny, permission groups, resource groups). Group members are not returned. Use for \"Which user groups and policies exist on my Cloudflare account\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only the user group with this exact name.","title":"Name"},"fuzzy_name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only user groups whose name contains this text.","title":"Fuzzy Name"},"direction":{"anyOf":[{"enum":["asc","desc"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort direction.","title":"Direction"},"per_page":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":100,"description":"How many groups per page (1 to 500).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_user_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_user_group":{"post":{"operationId":"get_user_group","summary":"Get one user group with its access policies. Group members are not returned. Use for \"Which policies does user group c8f","description":"Get one user group with its access policies. Group members are not returned. Use for \"Which policies does user group c8fae8ce-3a4b-4c6a-9e0d-1a2b3c4d5e6f have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"user_group_id":{"description":"User group id, as returned by list_user_groups.","maxLength":64,"title":"User Group Id","type":"string"}},"required":["account_id","user_group_id"],"title":"get_user_groupArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}