releases.shpreview
CloudflareCloudflare/Core Platform

Account Roles API deprecated; Permissions Groups API replaces it

July 21, 2026Core Platform ChangelogView original ↗
1 enhancementThis release1 enhancementImprovements to existing featuresAI-tallied from the release notes
From the original release noteView original ↗

The Account Roles API is deprecated and is being replaced by the Permission Groups API. An end of life date has not yet been established.

What you need to do

Review the Permission Groups API documentation; the response schema differs from the legacy Roles response.

Highlights
  • Integrations migrating to the Permission Groups API must obtain Permission Group IDs from that API and use them in the Account Members API policies request shape. Integrations that persist legacy Role IDs will need to remap their assignments.
  • The legacy Role response includes a top-level description and a permissions object keyed by resource type with edit/read flags.
  • The PermissionGroup response replaces those with a meta object containing label and scopes. Individual permissions are not returned as part of the permission group.
  • The new API supports the API Token authorization scheme. The legacy Email + API Key authorization schema is provided for backwards compatibility.

For more information, refer to API deprecations.

Fetched July 21, 2026

Account Roles API deprecated; Permissions Groups API… — releases.sh