Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare API Shield (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-api-shield.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-api-shield.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-api-shield.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare API Shield Cloudflare API token with API Gateway read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-api-shield.connectorbay.com/health · Tool schemas: https://byok-cloudflare-api-shield.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-api-shield · agent@connectorbay.com

What Cloudflare API Shield (BYOK) is for

Cloudflare API Shield (BYOK) lets an AI assistant read your own Cloudflare API Shield data through the Cloudflare API Shield API with a key you supply (Cloudflare API token with API Gateway read permission). Read-only: 10 tools (list_operations, get_operation, list_discovered_operations, list_labels, get_session_identifier_settings, list_schemas, list_schema_hosts, list_schema_operations, get_schema_validation_settings, get_operation_schema_validation). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare API Shield. Cloudflare API Shield and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which API endpoints does API Shield track on my zone?"
  • "Show API Shield operation f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  • "Which new API endpoints did API Discovery find on my zone?"
  • "Which API Shield labels exist on my zone?"
  • "How does API Shield identify sessions on my zone?"
  • "Which OpenAPI schemas are uploaded to API Shield?"

What it does

  • list_operations: List the API operations (host, method, endpoint) saved in a zone's API Shield endpoint management, 50 per page at most.
  • get_operation: Get one saved API operation with its host, method, endpoint and last update time.
  • list_discovered_operations: List operations API Discovery found in the zone's traffic, with review state (review, saved, ignored) and how they were found.
  • list_labels: List API Shield operation labels (managed and user-defined) with description, source and dates.
  • get_session_identifier_settings: Show which headers, cookies or JWT claims API Shield uses to identify sessions (names only, not values).
  • list_schemas: List the OpenAPI schemas uploaded for schema validation, with name, kind and whether validation is enabled. The schema source text is left out.
  • list_schema_hosts: List the hostnames covered by each uploaded schema.
  • list_schema_operations: List the operations (host, method, endpoint) contained in one uploaded schema.
  • get_schema_validation_settings: Show the zone-wide schema validation actions: the default action and the override action (none, log or block).
  • get_operation_schema_validation: Show the schema validation action (none, log or block) set for one operation.

BYOK key

You bring your own Cloudflare API Shield Cloudflare API token with API Gateway read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare API Shield API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/api_gateway/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare API Shield. Cloudflare API Shield and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare API Shield account.

Built for: Worldwide. Languages: English.