Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Cloudflare Provider
  3. API Docs
  4. ApiToken
Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi
pulumi/pulumi-cloudflare

cloudflare.ApiToken

Explore with Pulumi AI

Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi
pulumi/pulumi-cloudflare

Example Usage

Coming soon!

Coming soon!

Coming soon!

Coming soon!

Coming soon!

resources:
  exampleApiToken:
    type: cloudflare:ApiToken
    name: example_api_token
    properties:
      name: readonly token
      policies:
        - effect: allow
          permission_groups:
            - id: c8fed203ed3043cba015a93ad1616f1f
              meta:
                key: key
                value: value
            - id: 82e64a83756745bbbb1c9c2701bf816b
              meta:
                key: key
                value: value
          resources:
            com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43: '*'
            com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4: '*'
      condition:
        request_ip:
          in:
            - 123.123.123.0/24
            - 2606:4700::/32
          notIn:
            - 123.123.123.100/24
            - 2606:4700:4700::/48
      expiresOn: 2020-01-01T00:00:00Z
      notBefore: 2018-07-01T05:20:00Z
Copy

Create ApiToken Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new ApiToken(name: string, args: ApiTokenArgs, opts?: CustomResourceOptions);
@overload
def ApiToken(resource_name: str,
             args: ApiTokenArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def ApiToken(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             name: Optional[str] = None,
             policies: Optional[Sequence[ApiTokenPolicyArgs]] = None,
             condition: Optional[ApiTokenConditionArgs] = None,
             expires_on: Optional[str] = None,
             not_before: Optional[str] = None,
             status: Optional[str] = None)
func NewApiToken(ctx *Context, name string, args ApiTokenArgs, opts ...ResourceOption) (*ApiToken, error)
public ApiToken(string name, ApiTokenArgs args, CustomResourceOptions? opts = null)
public ApiToken(String name, ApiTokenArgs args)
public ApiToken(String name, ApiTokenArgs args, CustomResourceOptions options)

type: cloudflare:ApiToken
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. ApiTokenArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. ApiTokenArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. ApiTokenArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. ApiTokenArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. ApiTokenArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var apiTokenResource = new Cloudflare.ApiToken("apiTokenResource", new()
{
    Name = "string",
    Policies = new[]
    {
        new Cloudflare.Inputs.ApiTokenPolicyArgs
        {
            Effect = "string",
            PermissionGroups = new[]
            {
                new Cloudflare.Inputs.ApiTokenPolicyPermissionGroupArgs
                {
                    Id = "string",
                    Meta = new Cloudflare.Inputs.ApiTokenPolicyPermissionGroupMetaArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                    Name = "string",
                },
            },
            Resources = 
            {
                { "string", "string" },
            },
            Id = "string",
        },
    },
    Condition = new Cloudflare.Inputs.ApiTokenConditionArgs
    {
        RequestIp = new Cloudflare.Inputs.ApiTokenConditionRequestIpArgs
        {
            Ins = new[]
            {
                "string",
            },
            NotIns = new[]
            {
                "string",
            },
        },
    },
    ExpiresOn = "string",
    NotBefore = "string",
    Status = "string",
});
Copy
example, err := cloudflare.NewApiToken(ctx, "apiTokenResource", &cloudflare.ApiTokenArgs{
	Name: pulumi.String("string"),
	Policies: cloudflare.ApiTokenPolicyArray{
		&cloudflare.ApiTokenPolicyArgs{
			Effect: pulumi.String("string"),
			PermissionGroups: cloudflare.ApiTokenPolicyPermissionGroupArray{
				&cloudflare.ApiTokenPolicyPermissionGroupArgs{
					Id: pulumi.String("string"),
					Meta: &cloudflare.ApiTokenPolicyPermissionGroupMetaArgs{
						Key:   pulumi.String("string"),
						Value: pulumi.String("string"),
					},
					Name: pulumi.String("string"),
				},
			},
			Resources: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
			Id: pulumi.String("string"),
		},
	},
	Condition: &cloudflare.ApiTokenConditionArgs{
		RequestIp: &cloudflare.ApiTokenConditionRequestIpArgs{
			Ins: pulumi.StringArray{
				pulumi.String("string"),
			},
			NotIns: pulumi.StringArray{
				pulumi.String("string"),
			},
		},
	},
	ExpiresOn: pulumi.String("string"),
	NotBefore: pulumi.String("string"),
	Status:    pulumi.String("string"),
})
Copy
var apiTokenResource = new ApiToken("apiTokenResource", ApiTokenArgs.builder()
    .name("string")
    .policies(ApiTokenPolicyArgs.builder()
        .effect("string")
        .permissionGroups(ApiTokenPolicyPermissionGroupArgs.builder()
            .id("string")
            .meta(ApiTokenPolicyPermissionGroupMetaArgs.builder()
                .key("string")
                .value("string")
                .build())
            .name("string")
            .build())
        .resources(Map.of("string", "string"))
        .id("string")
        .build())
    .condition(ApiTokenConditionArgs.builder()
        .requestIp(ApiTokenConditionRequestIpArgs.builder()
            .ins("string")
            .notIns("string")
            .build())
        .build())
    .expiresOn("string")
    .notBefore("string")
    .status("string")
    .build());
Copy
api_token_resource = cloudflare.ApiToken("apiTokenResource",
    name="string",
    policies=[{
        "effect": "string",
        "permission_groups": [{
            "id": "string",
            "meta": {
                "key": "string",
                "value": "string",
            },
            "name": "string",
        }],
        "resources": {
            "string": "string",
        },
        "id": "string",
    }],
    condition={
        "request_ip": {
            "ins": ["string"],
            "not_ins": ["string"],
        },
    },
    expires_on="string",
    not_before="string",
    status="string")
Copy
const apiTokenResource = new cloudflare.ApiToken("apiTokenResource", {
    name: "string",
    policies: [{
        effect: "string",
        permissionGroups: [{
            id: "string",
            meta: {
                key: "string",
                value: "string",
            },
            name: "string",
        }],
        resources: {
            string: "string",
        },
        id: "string",
    }],
    condition: {
        requestIp: {
            ins: ["string"],
            notIns: ["string"],
        },
    },
    expiresOn: "string",
    notBefore: "string",
    status: "string",
});
Copy
type: cloudflare:ApiToken
properties:
    condition:
        requestIp:
            ins:
                - string
            notIns:
                - string
    expiresOn: string
    name: string
    notBefore: string
    policies:
        - effect: string
          id: string
          permissionGroups:
            - id: string
              meta:
                key: string
                value: string
              name: string
          resources:
            string: string
    status: string
Copy

ApiToken Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The ApiToken resource accepts the following input properties:

Name This property is required. string
Token name.
Policies This property is required. List<ApiTokenPolicy>
List of access policies assigned to the token.
Condition ApiTokenCondition
ExpiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
NotBefore string
The time before which the token MUST NOT be accepted for processing.
Status string
Status of the token. Available values: "active", "disabled", "expired".
Name This property is required. string
Token name.
Policies This property is required. []ApiTokenPolicyArgs
List of access policies assigned to the token.
Condition ApiTokenConditionArgs
ExpiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
NotBefore string
The time before which the token MUST NOT be accepted for processing.
Status string
Status of the token. Available values: "active", "disabled", "expired".
name This property is required. String
Token name.
policies This property is required. List<ApiTokenPolicy>
List of access policies assigned to the token.
condition ApiTokenCondition
expiresOn String
The expiration time on or after which the JWT MUST NOT be accepted for processing.
notBefore String
The time before which the token MUST NOT be accepted for processing.
status String
Status of the token. Available values: "active", "disabled", "expired".
name This property is required. string
Token name.
policies This property is required. ApiTokenPolicy[]
List of access policies assigned to the token.
condition ApiTokenCondition
expiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
notBefore string
The time before which the token MUST NOT be accepted for processing.
status string
Status of the token. Available values: "active", "disabled", "expired".
name This property is required. str
Token name.
policies This property is required. Sequence[ApiTokenPolicyArgs]
List of access policies assigned to the token.
condition ApiTokenConditionArgs
expires_on str
The expiration time on or after which the JWT MUST NOT be accepted for processing.
not_before str
The time before which the token MUST NOT be accepted for processing.
status str
Status of the token. Available values: "active", "disabled", "expired".
name This property is required. String
Token name.
policies This property is required. List<Property Map>
List of access policies assigned to the token.
condition Property Map
expiresOn String
The expiration time on or after which the JWT MUST NOT be accepted for processing.
notBefore String
The time before which the token MUST NOT be accepted for processing.
status String
Status of the token. Available values: "active", "disabled", "expired".

Outputs

All input properties are implicitly available as output properties. Additionally, the ApiToken resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
IssuedOn string
The time on which the token was created.
LastUsedOn string
Last time the token was used.
ModifiedOn string
Last time the token was modified.
Value string
The token value.
Id string
The provider-assigned unique ID for this managed resource.
IssuedOn string
The time on which the token was created.
LastUsedOn string
Last time the token was used.
ModifiedOn string
Last time the token was modified.
Value string
The token value.
id String
The provider-assigned unique ID for this managed resource.
issuedOn String
The time on which the token was created.
lastUsedOn String
Last time the token was used.
modifiedOn String
Last time the token was modified.
value String
The token value.
id string
The provider-assigned unique ID for this managed resource.
issuedOn string
The time on which the token was created.
lastUsedOn string
Last time the token was used.
modifiedOn string
Last time the token was modified.
value string
The token value.
id str
The provider-assigned unique ID for this managed resource.
issued_on str
The time on which the token was created.
last_used_on str
Last time the token was used.
modified_on str
Last time the token was modified.
value str
The token value.
id String
The provider-assigned unique ID for this managed resource.
issuedOn String
The time on which the token was created.
lastUsedOn String
Last time the token was used.
modifiedOn String
Last time the token was modified.
value String
The token value.

Look up Existing ApiToken Resource

Get an existing ApiToken resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ApiTokenState, opts?: CustomResourceOptions): ApiToken
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        condition: Optional[ApiTokenConditionArgs] = None,
        expires_on: Optional[str] = None,
        issued_on: Optional[str] = None,
        last_used_on: Optional[str] = None,
        modified_on: Optional[str] = None,
        name: Optional[str] = None,
        not_before: Optional[str] = None,
        policies: Optional[Sequence[ApiTokenPolicyArgs]] = None,
        status: Optional[str] = None,
        value: Optional[str] = None) -> ApiToken
func GetApiToken(ctx *Context, name string, id IDInput, state *ApiTokenState, opts ...ResourceOption) (*ApiToken, error)
public static ApiToken Get(string name, Input<string> id, ApiTokenState? state, CustomResourceOptions? opts = null)
public static ApiToken get(String name, Output<String> id, ApiTokenState state, CustomResourceOptions options)
resources:  _:    type: cloudflare:ApiToken    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Condition ApiTokenCondition
ExpiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
IssuedOn string
The time on which the token was created.
LastUsedOn string
Last time the token was used.
ModifiedOn string
Last time the token was modified.
Name string
Token name.
NotBefore string
The time before which the token MUST NOT be accepted for processing.
Policies List<ApiTokenPolicy>
List of access policies assigned to the token.
Status string
Status of the token. Available values: "active", "disabled", "expired".
Value string
The token value.
Condition ApiTokenConditionArgs
ExpiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
IssuedOn string
The time on which the token was created.
LastUsedOn string
Last time the token was used.
ModifiedOn string
Last time the token was modified.
Name string
Token name.
NotBefore string
The time before which the token MUST NOT be accepted for processing.
Policies []ApiTokenPolicyArgs
List of access policies assigned to the token.
Status string
Status of the token. Available values: "active", "disabled", "expired".
Value string
The token value.
condition ApiTokenCondition
expiresOn String
The expiration time on or after which the JWT MUST NOT be accepted for processing.
issuedOn String
The time on which the token was created.
lastUsedOn String
Last time the token was used.
modifiedOn String
Last time the token was modified.
name String
Token name.
notBefore String
The time before which the token MUST NOT be accepted for processing.
policies List<ApiTokenPolicy>
List of access policies assigned to the token.
status String
Status of the token. Available values: "active", "disabled", "expired".
value String
The token value.
condition ApiTokenCondition
expiresOn string
The expiration time on or after which the JWT MUST NOT be accepted for processing.
issuedOn string
The time on which the token was created.
lastUsedOn string
Last time the token was used.
modifiedOn string
Last time the token was modified.
name string
Token name.
notBefore string
The time before which the token MUST NOT be accepted for processing.
policies ApiTokenPolicy[]
List of access policies assigned to the token.
status string
Status of the token. Available values: "active", "disabled", "expired".
value string
The token value.
condition ApiTokenConditionArgs
expires_on str
The expiration time on or after which the JWT MUST NOT be accepted for processing.
issued_on str
The time on which the token was created.
last_used_on str
Last time the token was used.
modified_on str
Last time the token was modified.
name str
Token name.
not_before str
The time before which the token MUST NOT be accepted for processing.
policies Sequence[ApiTokenPolicyArgs]
List of access policies assigned to the token.
status str
Status of the token. Available values: "active", "disabled", "expired".
value str
The token value.
condition Property Map
expiresOn String
The expiration time on or after which the JWT MUST NOT be accepted for processing.
issuedOn String
The time on which the token was created.
lastUsedOn String
Last time the token was used.
modifiedOn String
Last time the token was modified.
name String
Token name.
notBefore String
The time before which the token MUST NOT be accepted for processing.
policies List<Property Map>
List of access policies assigned to the token.
status String
Status of the token. Available values: "active", "disabled", "expired".
value String
The token value.

Supporting Types

ApiTokenCondition
, ApiTokenConditionArgs

RequestIp ApiTokenConditionRequestIp
Client IP restrictions.
RequestIp ApiTokenConditionRequestIp
Client IP restrictions.
requestIp ApiTokenConditionRequestIp
Client IP restrictions.
requestIp ApiTokenConditionRequestIp
Client IP restrictions.
request_ip ApiTokenConditionRequestIp
Client IP restrictions.
requestIp Property Map
Client IP restrictions.

ApiTokenConditionRequestIp
, ApiTokenConditionRequestIpArgs

Ins List<string>
List of IPv4/IPv6 CIDR addresses.
NotIns List<string>
List of IPv4/IPv6 CIDR addresses.
Ins []string
List of IPv4/IPv6 CIDR addresses.
NotIns []string
List of IPv4/IPv6 CIDR addresses.
ins List<String>
List of IPv4/IPv6 CIDR addresses.
notIns List<String>
List of IPv4/IPv6 CIDR addresses.
ins string[]
List of IPv4/IPv6 CIDR addresses.
notIns string[]
List of IPv4/IPv6 CIDR addresses.
ins Sequence[str]
List of IPv4/IPv6 CIDR addresses.
not_ins Sequence[str]
List of IPv4/IPv6 CIDR addresses.
ins List<String>
List of IPv4/IPv6 CIDR addresses.
notIns List<String>
List of IPv4/IPv6 CIDR addresses.

ApiTokenPolicy
, ApiTokenPolicyArgs

Effect This property is required. string
Allow or deny operations against the resources. Available values: "allow", "deny".
PermissionGroups This property is required. List<ApiTokenPolicyPermissionGroup>
A set of permission groups that are specified to the policy.
Resources This property is required. Dictionary<string, string>
A list of resource names that the policy applies to.
Id string
Policy identifier.
Effect This property is required. string
Allow or deny operations against the resources. Available values: "allow", "deny".
PermissionGroups This property is required. []ApiTokenPolicyPermissionGroup
A set of permission groups that are specified to the policy.
Resources This property is required. map[string]string
A list of resource names that the policy applies to.
Id string
Policy identifier.
effect This property is required. String
Allow or deny operations against the resources. Available values: "allow", "deny".
permissionGroups This property is required. List<ApiTokenPolicyPermissionGroup>
A set of permission groups that are specified to the policy.
resources This property is required. Map<String,String>
A list of resource names that the policy applies to.
id String
Policy identifier.
effect This property is required. string
Allow or deny operations against the resources. Available values: "allow", "deny".
permissionGroups This property is required. ApiTokenPolicyPermissionGroup[]
A set of permission groups that are specified to the policy.
resources This property is required. {[key: string]: string}
A list of resource names that the policy applies to.
id string
Policy identifier.
effect This property is required. str
Allow or deny operations against the resources. Available values: "allow", "deny".
permission_groups This property is required. Sequence[ApiTokenPolicyPermissionGroup]
A set of permission groups that are specified to the policy.
resources This property is required. Mapping[str, str]
A list of resource names that the policy applies to.
id str
Policy identifier.
effect This property is required. String
Allow or deny operations against the resources. Available values: "allow", "deny".
permissionGroups This property is required. List<Property Map>
A set of permission groups that are specified to the policy.
resources This property is required. Map<String>
A list of resource names that the policy applies to.
id String
Policy identifier.

ApiTokenPolicyPermissionGroup
, ApiTokenPolicyPermissionGroupArgs

Id This property is required. string
Identifier of the group.
Meta ApiTokenPolicyPermissionGroupMeta
Attributes associated to the permission group.
Name string
Name of the group.
Id This property is required. string
Identifier of the group.
Meta ApiTokenPolicyPermissionGroupMeta
Attributes associated to the permission group.
Name string
Name of the group.
id This property is required. String
Identifier of the group.
meta ApiTokenPolicyPermissionGroupMeta
Attributes associated to the permission group.
name String
Name of the group.
id This property is required. string
Identifier of the group.
meta ApiTokenPolicyPermissionGroupMeta
Attributes associated to the permission group.
name string
Name of the group.
id This property is required. str
Identifier of the group.
meta ApiTokenPolicyPermissionGroupMeta
Attributes associated to the permission group.
name str
Name of the group.
id This property is required. String
Identifier of the group.
meta Property Map
Attributes associated to the permission group.
name String
Name of the group.

ApiTokenPolicyPermissionGroupMeta
, ApiTokenPolicyPermissionGroupMetaArgs

Key string
Value string
Key string
Value string
key String
value String
key string
value string
key str
value str
key String
value String

Import

$ pulumi import cloudflare:index/apiToken:ApiToken example '<token_id>'
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
Cloudflare pulumi/pulumi-cloudflare
License
Apache-2.0
Notes
This Pulumi package is based on the cloudflare Terraform Provider.
Cloudflare v6.0.1 published on Wednesday, Apr 16, 2025 by Pulumi
pulumi/pulumi-cloudflare