Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare DLP (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-dlp.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-dlp.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-dlp.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare DLP Cloudflare API token with Zero Trust read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-dlp.connectorbay.com/health · Tool schemas: https://byok-cloudflare-dlp.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-dlp · agent@connectorbay.com

What Cloudflare DLP (BYOK) is for

Cloudflare DLP (BYOK) lets an AI assistant read your own Cloudflare DLP data through the Cloudflare DLP API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 10 tools (list_profiles, get_profile, list_entries, list_datasets, list_document_fingerprints, list_data_classes, list_sensitivity_groups, list_validators, get_limits, get_settings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare DLP. Cloudflare DLP and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which DLP profiles do I have in Cloudflare?"
  • "Show DLP profile f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  • "Which detection entries are defined in my DLP setup?"
  • "Which DLP datasets are uploaded and are they processed?"
  • "Which documents are fingerprinted for DLP?"
  • "Which data classes are defined in DLP?"

What it does

  • list_profiles: List DLP profiles (custom, predefined and integration) with type, match count threshold, confidence threshold, AI context and OCR flags. Only configuration is returned, never inspected data.
  • get_profile: Get one DLP profile with its settings and entries (patterns, not matched data). Only configuration is returned, never inspected data.
  • list_entries: List DLP detection entries (custom regex, predefined, prompt topic) with name, type, enabled flag and profile. Only configuration is returned, never inspected data. Only configuration is returned, never inspected data.
  • list_datasets: List exact-match DLP datasets with name, status, cell count and column headers. Dataset contents are not returned. Only configuration is returned, never inspected data.
  • list_document_fingerprints: List document fingerprints with file name, status and match percentage. Only configuration is returned, never inspected data.
  • list_data_classes: List DLP data classes with description, expression and linked tags. Only configuration is returned, never inspected data.
  • list_sensitivity_groups: List DLP sensitivity groups and their levels. Only configuration is returned, never inspected data.
  • list_validators: List DLP validators: proximity-word lists and worker validators with the entries that use them. Only configuration is returned, never inspected data.
  • get_limits: Show DLP limits and usage: custom regex entries, dataset cells and document fingerprints.
  • get_settings: Show account-level DLP settings: AI context analysis, OCR and the payload logging masking level.

BYOK key

You bring your own Cloudflare DLP Cloudflare API token with Zero Trust read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare DLP API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/zero_trust/subresources/dlp/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare DLP. Cloudflare DLP and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare DLP account.

Built for: Worldwide. Languages: English.