Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Device Management (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-device-management.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-device-management.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-device-management.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Device Management Cloudflare API token with Zero Trust read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-device-management.connectorbay.com/health · Tool schemas: https://byok-cloudflare-device-management.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-device-management · agent@connectorbay.com

What Cloudflare Device Management (BYOK) is for

Cloudflare Device Management (BYOK) lets an AI assistant read your own Cloudflare Device Management data through the Cloudflare Device Management API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 9 tools (list_posture_rules, list_posture_integrations, list_settings_profiles, get_device_settings, list_managed_networks, list_client_versions, list_deployment_groups, list_ip_profiles, list_default_fallback_domains). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Device Management. Cloudflare Device Management and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which device posture rules do I have in Cloudflare Zero Trust?"
  • "Which device posture integrations are connected?"
  • "Which device settings profiles exist and in what order?"
  • "Is the Gateway proxy enabled for my devices?"
  • "Which managed networks are defined for my devices?"
  • "What are the latest GA WARP client versions for Windows?"

What it does

  • list_posture_rules: List device posture rules (file, application, disk encryption, serial number, WARP and similar checks) with type, platforms, schedule and enabled flag. Configuration only: no device or user records are returned.
  • list_posture_integrations: List third-party device posture integrations (Intune, CrowdStrike, Kolide, SentinelOne and others) with type and check interval. Integration settings are left out.
  • list_settings_profiles: List device settings profiles (WARP or browser extension) with precedence, mode, tunnel protocol and switch, update and uninstall protection flags. The match expression is left out.
  • get_device_settings: Get account-level device settings: Gateway proxy flags, root certificate installation, virtual IP use and emergency signal configuration.
  • list_managed_networks: List device managed networks (trusted TLS beacons) with name and type.
  • list_client_versions: List WARP client versions for one platform and release track with release date and package size.
  • list_deployment_groups: List WARP client deployment groups with the target versions per platform and linked profile ids.
  • list_ip_profiles: List device IP profiles with precedence, enabled flag and linked subnet id. The match expression is left out.
  • list_default_fallback_domains: List the account's default local domain fallback entries (suffix and DNS servers) that WARP resolves outside Gateway.

BYOK key

You bring your own Cloudflare Device Management Cloudflare API token with Zero Trust read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Device Management API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Device Management. Cloudflare Device Management and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Device Management account.

Built for: Worldwide. Languages: English.