Core Platform Changelog

Markdown for Agents now preserves security and cache response headers from the origin, including HSTS, CSP, and CORS headers. The origin's content-signal header is authoritative, with a default Content-Signal added when the origin does not send one. Also fixed relative link resolution for directory-style base URLs that previously returned 404s.

CIDR-encoded route endpoints for the Zero Trust Networks API are being removed on October 5, 2026, in favor of standard route_id-based endpoints. The network parameter moves from the URL path into the request body on create. The connections array is also being removed from Cloudflare Tunnel and Cloudflare Mesh list and get responses; use the dedicated connections endpoint instead.

Enterprise customers can now push per-connection WebSocket analytics to any Logpush destination using the new websocket_analytics dataset. Each log record includes connection close reason, close source, TLS alert codes, RayID for correlation with HTTP logs, directional byte counts, and connection metadata from the WebSocket upgrade.

Cloudflare has added new fields to three Logpush datasets: AppliedMaxTTL and UpstreamRecordTTLs to Gateway DNS, Warnings to Gateway HTTP, and CacheLockWaitedMs to HTTP requests.

Logpush now supports firewall events as an account-scoped dataset, letting you configure a single job to receive events for every zone instead of maintaining separate jobs per zone. The dataset includes a new ZoneName field for identifying which zone each event came from.

New resource-scoped roles let administrators delegate access to specific Gateway policy types (DNS, HTTP, Network, Egress, Resolver) and Zero Trust lists without granting account-wide control. Existing account-level roles remain fully backward-compatible.

Both the dashboard and API now support filtering API tokens by name, eliminating the need to manually paginate through large token lists.

Organization Super Administrators can now view and search organization-level audit logs in the Cloudflare dashboard, with filtering by actor, action, result, and timestamp. Previously only available via API.

New WebSocket Analytics Logpush dataset with 16 fields including connection metrics and ray-level telemetry. Firewall events dataset gains ZoneName field and becomes available for account-scope Logpush; Email Security Alerts adds BCC, DKIMResult, DMARCPolicy, DMARCResult, and SPFResult fields.

Adds 24 new resources including AI Search namespaces, custom CSR, Flagship feature flags, and DLP data classes. The underlying Go SDK is bumped to cloudflare-go v7, and dozens of bug fixes address nil pointer panics, state migration gaps, and schema parity issues across the provider.

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.

Cloudflare has updated Logpush datasets:

Cloudflare has updated Logpush datasets:

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access…

Cloudflare has updated Logpush datasets:

Keyboard shortcuts for the Cloudflare dashboard