Core Platform

The Account Roles API is deprecated and replaced by the Permission Groups API, which uses a different response schema. Integrations must migrate to Permission Group IDs and remap any persisted legacy Role IDs.

We are turning on budget alerts by default for eligible Pay-as-you-go accounts. If your account does not already have a budget alert, Cloudflare will create one for you with a $10 account-level threshold. Your default alert will enable at the turn of your next billing cycle, so…

Distributor, MSSP, and Agency partners on Cloudflare Organizations can now add and manage members directly from the dashboard without Cloudflare assistance. Previously this required a manual request and closed beta enrollment.

Cache Rules expressions now support bot management fields (score, JA3/JA4 fingerprint, verified bot, etc.) and the ip.src.asnum field, enabling cache policies that differentiate by traffic type or autonomous system.

Markdown for Agents now preserves security and cache response headers from the origin, including HSTS, CSP, and CORS headers. The origin's content-signal header is authoritative, with a default Content-Signal added when the origin does not send one. Also fixed relative link resolution for directory-style base URLs that previously returned 404s.

CIDR-encoded route endpoints for the Zero Trust Networks API are being removed on October 5, 2026, in favor of standard route_id-based endpoints. The network parameter moves from the URL path into the request body on create. The connections array is also being removed from Cloudflare Tunnel and Cloudflare Mesh list and get responses; use the dedicated connections endpoint instead.

Enterprise customers can now push per-connection WebSocket analytics to any Logpush destination using the new websocket_analytics dataset. Each log record includes connection close reason, close source, TLS alert codes, RayID for correlation with HTTP logs, directional byte counts, and connection metadata from the WebSocket upgrade.

Cloudflare has added new fields to three Logpush datasets: AppliedMaxTTL and UpstreamRecordTTLs to Gateway DNS, Warnings to Gateway HTTP, and CacheLockWaitedMs to HTTP requests.

Logpush now supports firewall events as an account-scoped dataset, letting you configure a single job to receive events for every zone instead of maintaining separate jobs per zone. The dataset includes a new ZoneName field for identifying which zone each event came from.

New resource-scoped roles let administrators delegate access to specific Gateway policy types (DNS, HTTP, Network, Egress, Resolver) and Zero Trust lists without granting account-wide control. Existing account-level roles remain fully backward-compatible.

Both the dashboard and API now support filtering API tokens by name, eliminating the need to manually paginate through large token lists.

Organization Super Administrators can now view and search organization-level audit logs in the Cloudflare dashboard, with filtering by actor, action, result, and timestamp. Previously only available via API.

New WebSocket Analytics Logpush dataset with 16 fields including connection metrics and ray-level telemetry. Firewall events dataset gains ZoneName field and becomes available for account-scope Logpush; Email Security Alerts adds BCC, DKIMResult, DMARCPolicy, DMARCResult, and SPFResult fields.

Pay Per Crawl now supports disabling by URI pattern via Configuration Rules, and dynamic pricing through a crawler-price response header from the origin or a Cloudflare Worker. A cf-pay-per-crawl request header is added to origin requests when dynamic pricing is enabled.

Adds 24 new resources including AI Search namespaces, custom CSR, Flagship feature flags, and DLP data classes. The underlying Go SDK is bumped to cloudflare-go v7, and dozens of bug fixes address nil pointer panics, state migration gaps, and schema parity issues across the provider.

Cloudflare's Terraform v5 Provider makes it easy for developers to manage their Cloudflare infrastructure using a configuration as code approach. It releases every 2-3 weeks ↗ to ensure that you can…

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.