{"openapi":"3.1.0","info":{"title":"Cloudflare Device Management (BYOK) API","version":"0.1.0","description":"Cloudflare Device Management (BYOK) lets an AI assistant read your own Cloudflare Device Management data through the Cloudflare Device Management API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 9 tools (list_posture_rules, list_posture_integrations, list_settings_profiles, get_device_settings, list_managed_networks, list_client_versions,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-cloudflare-device-management.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-cloudflare-device-management/docs"},"termsOfService":"https://connectorbay.com/byok-cloudflare-device-management/terms"},"servers":[{"url":"https://byok-cloudflare-device-management.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-cloudflare-device-management/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_posture_rules":{"post":{"operationId":"list_posture_rules","summary":"List device posture rules (file, application, disk encryption, serial number, WARP and similar checks) with type, platfo","description":"List device posture rules (file, application, disk encryption, serial number, WARP and similar checks) with type, platforms, schedule and enabled flag. Configuration only: no device or user records are returned. Use for \"Which device posture rules do I have in Cloudflare Zero Trust\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_posture_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_posture_integrations":{"post":{"operationId":"list_posture_integrations","summary":"List third-party device posture integrations (Intune, CrowdStrike, Kolide, SentinelOne and others) with type and check i","description":"List third-party device posture integrations (Intune, CrowdStrike, Kolide, SentinelOne and others) with type and check interval. Integration settings are left out. Use for \"Which device posture integrations are connected\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_posture_integrationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_settings_profiles":{"post":{"operationId":"list_settings_profiles","summary":"List device settings profiles (WARP or browser extension) with precedence, mode, tunnel protocol and switch, update and ","description":"List device settings profiles (WARP or browser extension) with precedence, mode, tunnel protocol and switch, update and uninstall protection flags. The match expression is left out. Use for \"Which device settings profiles exist and in what order\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"profile_type":{"anyOf":[{"enum":["warp","browser_extension"],"type":"string"},{"type":"null"}],"default":null,"description":"Which client type: warp (default) or browser_extension.","title":"Profile Type"}},"required":["account_id"],"title":"list_settings_profilesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_device_settings":{"post":{"operationId":"get_device_settings","summary":"Get account-level device settings: Gateway proxy flags, root certificate installation, virtual IP use and emergency sign","description":"Get account-level device settings: Gateway proxy flags, root certificate installation, virtual IP use and emergency signal configuration. Use for \"Is the Gateway proxy enabled for my devices\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"get_device_settingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_managed_networks":{"post":{"operationId":"list_managed_networks","summary":"List device managed networks (trusted TLS beacons) with name and type. Use for \"Which managed networks are defined for m","description":"List device managed networks (trusted TLS beacons) with name and type. Use for \"Which managed networks are defined for my devices\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_managed_networksArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_client_versions":{"post":{"operationId":"list_client_versions","summary":"List WARP client versions for one platform and release track with release date and package size. Use for \"What are the l","description":"List WARP client versions for one platform and release track with release date and package size. Use for \"What are the latest GA WARP client versions for Windows\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"target_environment":{"description":"Platform, for example windows or macos.","maxLength":40,"title":"Target Environment","type":"string"},"release_track":{"description":"Release track: ga or beta.","enum":["ga","beta"],"title":"Release Track","type":"string"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many versions per page (1 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id","target_environment","release_track"],"title":"list_client_versionsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_deployment_groups":{"post":{"operationId":"list_deployment_groups","summary":"List WARP client deployment groups with the target versions per platform and linked profile ids. Use for \"Which WARP dep","description":"List WARP client deployment groups with the target versions per platform and linked profile ids. Use for \"Which WARP deployment groups do I have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many groups per page (1 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_deployment_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_ip_profiles":{"post":{"operationId":"list_ip_profiles","summary":"List device IP profiles with precedence, enabled flag and linked subnet id. The match expression is left out. Use for \"W","description":"List device IP profiles with precedence, enabled flag and linked subnet id. The match expression is left out. Use for \"Which device IP profiles are configured\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many profiles per page (1 to 100).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_ip_profilesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_default_fallback_domains":{"post":{"operationId":"list_default_fallback_domains","summary":"List the account's default local domain fallback entries (suffix and DNS servers) that WARP resolves outside Gateway. Us","description":"List the account's default local domain fallback entries (suffix and DNS servers) that WARP resolves outside Gateway. Use for \"Which domains does WARP send to local DNS servers\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_default_fallback_domainsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}