Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Account IAM (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-account-iam.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-account-iam.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-account-iam.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Account IAM Cloudflare API token with Account Settings read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-account-iam.connectorbay.com/health · Tool schemas: https://byok-cloudflare-account-iam.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-account-iam · agent@connectorbay.com

What Cloudflare Account IAM (BYOK) is for

Cloudflare Account IAM (BYOK) lets an AI assistant read your own Cloudflare Account IAM data through the Cloudflare Account IAM API with a key you supply (Cloudflare API token with Account Settings read permission). Read-only: 8 tools (list_roles, get_role, list_permission_groups, get_permission_group, list_resource_groups, get_resource_group, list_user_groups, get_user_group). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Account IAM. Cloudflare Account IAM and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "What roles exist on my Cloudflare account and what can they do?"
  • "What can the Administrator role do on my Cloudflare account?"
  • "Which permission groups can I assign on my Cloudflare account?"
  • "What does permission group 6c9b8f3a5d2e4a7b8c1d0e9f8a7b6c5d grant?"
  • "Which resource groups are defined on my Cloudflare account?"
  • "What does resource group 6c9b8f3a5d2e4a7b8c1d0e9f8a7b6c5d cover?"

What it does

  • list_roles: List the account roles with description and the read/write permissions per area (DNS, billing, zones, SSL, WAF and more). No member records are returned.
  • get_role: Get one account role with description and the read/write permissions per area.
  • list_permission_groups: List account permission groups (named bundles of API permissions) with category, label, description and scopes.
  • get_permission_group: Get one permission group with name, category, label, description and scopes.
  • list_resource_groups: List account resource groups (named sets of accounts, zones or other resources a policy applies to) with scope.
  • get_resource_group: Get one resource group with its metadata and scope objects.
  • list_user_groups: List account user groups with their access policies (allow or deny, permission groups, resource groups). Group members are not returned.
  • get_user_group: Get one user group with its access policies. Group members are not returned.

BYOK key

You bring your own Cloudflare Account IAM Cloudflare API token with Account Settings read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Account IAM API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/iam/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Account IAM. Cloudflare Account IAM and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Account IAM account.

Built for: Worldwide. Languages: English.