cf 0.0.6 → 0.1.0

package/dist/_meta/agent-context.json

@@ -11,7 +11,7 @@
 		"ai-search": "# ai-search — Managed search-as-a-service — crawl, index, and query content with AI-powered relevance and chat completions\n\n## Commands\n\n### Read Operations\n\n- `cf ai-search jobs get <jobId>` — Retrieves details for a specific AI Search indexing job.\n- `cf ai-search jobs list` — Lists indexing jobs for an AI Search instance.\n- `cf ai-search list` — List instances.\n- `cf ai-search namespaces get <name>` — Read namespace.\n- `cf ai-search namespaces instances get <id>` — Read instances.\n- `cf ai-search namespaces instances items chunks list` — Lists chunks for a specific item in an AI Search instance, including their text content.\n- `cf ai-search namespaces instances items content get <itemId>` — Downloads the raw file content for a specific item from the managed AI Search instance storage.\n- `cf ai-search namespaces instances items get <itemId>` — Retrieves a specific indexed item from an AI Search instance.\n- `cf ai-search namespaces instances items list` — Lists indexed items in an AI Search instance.\n- `cf ai-search namespaces instances jobs get <jobId>` — Retrieves details for a specific AI Search indexing job.\n- `cf ai-search namespaces instances jobs list` — Lists indexing jobs for an AI Search instance.\n- `cf ai-search namespaces instances list` — List instances.\n- `cf ai-search namespaces list` — List namespaces.\n- `cf ai-search tokens list` — List tokens.\n\n### Create Operations\n\n- `cf ai-search create` — Create a new instances. (supports --dry-run, --body)\n- `cf ai-search jobs create <id>` — Creates a new indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search namespaces create` — Create a new namespace. (supports --dry-run, --body)\n- `cf ai-search namespaces instances create <name>` — Create a new instances. (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs create <id>` — Creates a new indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search tokens create` — Create a new token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-search jobs edit <jobId>` — Updates the status of an AI Search indexing job. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items create or update <id>` — Creates or updates an indexed item in an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs edit <jobId>` — Updates the status of an AI Search indexing job. (supports --dry-run, --body)\n- `cf ai-search namespaces instances update <id>` — Update instances. (supports --dry-run, --body)\n- `cf ai-search namespaces update <name>` — Update namespace. (supports --dry-run, --body)\n- `cf ai-search tokens update <id>` — Update token. (supports --dry-run, --body)\n- `cf ai-search update <id>` — Update instances. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-search delete <id>` — Delete instances. (supports --dry-run)\n- `cf ai-search namespaces delete <name>` — Delete namespace. (supports --dry-run)\n- `cf ai-search namespaces instances delete <id>` — Delete instances. (supports --dry-run)\n- `cf ai-search namespaces instances items delete <itemId>` — Deletes a file from a managed AI Search instance and triggers a reindex. (supports --dry-run)\n- `cf ai-search tokens delete <id>` — Delete token. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-search chat-completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search jobs logs <jobId>` — Lists log entries for an AI Search indexing job. (supports --dry-run)\n- `cf ai-search namespaces instances chat completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items logs <itemId>` — Lists processing logs for a specific item in an AI Search instance. (supports --dry-run)\n- `cf ai-search namespaces instances items sync <itemId>` — Syncs an item to an AI Search instance index. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items upload <id>` — Uploads a file to a managed AI Search instance via multipart/form-data (max 4MB). (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs logs <jobId>` — Lists log entries for an AI Search indexing job. (supports --dry-run)\n- `cf ai-search namespaces instances search <id>` — Executes a semantic search query against an AI Search instance to find relevant indexed content. (supports --dry-run, --body)\n- `cf ai-search namespaces move instance <id>` — Moves an instance from its current namespace to the specified target namespace. Use 'default' as new_namespace to move the instance back to the default namespace. Fails with 400 if the target namespace already has an instance with the same id (ids must be unique within a namespace — the same id can exist in different namespaces). (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance chat completions <name>` — Performs a chat completion request against multiple AI Search instances in parallel, merging retrieved content as context for generating a response. (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance search <name>` — Search across multiple instances in a namespace (supports --dry-run, --body)\n- `cf ai-search namespaces stats <id>` — Retrieves usage statistics for AI Search instances. (supports --dry-run)\n- `cf ai-search read <id>` — Read instances. (supports --dry-run)\n- `cf ai-search search <id>` — Executes a semantic search query against an AI Search instance to find relevant indexed content. (supports --dry-run, --body)\n- `cf ai-search stats <id>` — Retrieves usage statistics for AI Search instances. (supports --dry-run)\n- `cf ai-search tokens read <id>` — Read token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"alerting": "# alerting — Notification policies, delivery destinations, silence windows, and alert history\n\n## Commands\n\n### Read Operations\n\n- `cf alerting available-alerts list` — Gets a list of all alert types for which an account is eligible.\n- `cf alerting destinations eligible get` — Get a list of all delivery mechanism types for which an account is eligible.\n- `cf alerting destinations pagerduty get` — Get a list of all configured PagerDuty services.\n- `cf alerting destinations webhooks get <webhookId>` — Get details for a single webhooks destination.\n- `cf alerting destinations webhooks list` — Gets a list of all configured webhook destinations.\n- `cf alerting history list` — Gets a list of history records for notifications sent to an account. The records are displayed for last `x` number of days based on the zone plan (free = 30, pro = 30, biz = 30, ent = 90).\n- `cf alerting policies get <policyId>` — Get details for a single policy.\n- `cf alerting policies list` — Get a list of all Notification policies.\n- `cf alerting silences get <silenceId>` — Gets a specific silence for an account.\n- `cf alerting silences list` — Gets a list of silences for an account.\n\n### Create Operations\n\n- `cf alerting destinations pagerduty create` — Creates a new token for integrating with PagerDuty. (supports --dry-run)\n- `cf alerting destinations webhooks create` — Creates a new webhook destination. (supports --dry-run, --body)\n- `cf alerting policies create` — Creates a new Notification policy. (supports --dry-run, --body)\n- `cf alerting silences create` — Creates a new silence for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf alerting destinations webhooks update <webhookId>` — Update a webhook destination. (supports --dry-run, --body)\n- `cf alerting policies update <policyId>` — Update a Notification policy. (supports --dry-run, --body)\n- `cf alerting silences update` — Updates existing silences for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf alerting destinations pagerduty delete` — Deletes all the PagerDuty Services connected to the account. (supports --dry-run)\n- `cf alerting destinations webhooks delete <webhookId>` — Delete a configured webhook destination. (supports --dry-run)\n- `cf alerting policies delete <policyId>` — Delete a Notification policy. (supports --dry-run)\n- `cf alerting silences delete <silenceId>` — Deletes an existing silence for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf alerting destinations pagerduty link <tokenId>` — Links PagerDuty with the account using the integration token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"analytics": "# analytics — Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics\n\n## Commands\n\n### Read Operations\n\n- `cf analytics colo get <zoneIdentifier>` — This view provides a breakdown of analytics data by datacenter. Note: This is available to Enterprise customers only.\n- `cf analytics dashboard get <zoneIdentifier>` — The dashboard view provides both totals and timeseries data for the given zone and time period across the entire Cloudflare network.\n- `cf analytics latency colos get` — Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.\n- `cf analytics latency get` — Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"api-gateway": "# api-gateway — Discover, monitor, and protect your API endpoints with schema validation, abuse detection, and routing\n\n## Commands\n\n### Read Operations\n\n- `cf api-gateway configurations get` — Gets the current API Shield configuration settings for a zone, including validation behavior and enforcement mode.\n- `cf api-gateway discovery get` — Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas\n- `cf api-gateway discovery operations list` — Retrieve the most up to date view of discovered operations\n- `cf api-gateway labels list` — Retrieve all labels\n- `cf api-gateway labels managed get` — Retrieve managed label\n- `cf api-gateway labels user get` — Retrieve user label\n- `cf api-gateway operations get` — Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.\n- `cf api-gateway operations list` — Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.\n- `cf api-gateway operations schema-validation get` — Retrieves operation-level schema validation settings on the zone\n- `cf api-gateway schemas list` — Retrieves API operations and their features exported as OpenAPI schemas.\n- `cf api-gateway settings schema-validation get` — Retrieves zone level schema validation settings currently set on the zone\n- `cf api-gateway user-schemas get` — Gets detailed information about a specific uploaded OpenAPI schema, including its contents and validation configuration.\n- `cf api-gateway user-schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone. Useful for understanding which domains have schema coverage.\n- `cf api-gateway user-schemas list` — Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.\n- `cf api-gateway user-schemas operations list` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n\n### Create Operations\n\n- `cf api-gateway expression-template fallthrough create` — Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match. (supports --dry-run, --body)\n- `cf api-gateway operations create` — Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations labels create` — Attach label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf api-gateway configurations update` — Updates API Shield configuration settings for a zone. Can modify validation strictness, enforcement mode, and other global settings. (supports --dry-run, --body)\n- `cf api-gateway discovery operations edit` — Update the `state` on a discovered operation (supports --dry-run, --body)\n- `cf api-gateway labels managed resources operation update` — Replace all operations(s) attached to a managed label (supports --dry-run, --body)\n- `cf api-gateway labels user edit` — Update certain fields on a label (supports --dry-run, --body)\n- `cf api-gateway labels user resources operation update` — Replace all operations(s) attached to a user label (supports --dry-run, --body)\n- `cf api-gateway labels user update` — Update all fields on a label (supports --dry-run, --body)\n- `cf api-gateway operations labels update` — Replace label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation edit` — Updates multiple operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation update` — Updates operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation edit` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation update` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway user-schemas edit` — Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf api-gateway labels user delete` — Delete user label (supports --dry-run)\n- `cf api-gateway operations delete` — Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules. (supports --dry-run)\n- `cf api-gateway operations labels delete` — Remove label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas delete` — Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules. (supports --dry-run)\n\n### Other Operations\n\n- `cf api-gateway discovery operations bulk-edit` — Update the `state` on one or more discovered operations (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-create` — Create user labels (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-delete` — Delete user labels (supports --dry-run, --body)\n- `cf api-gateway operations bulk-create` — Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations bulk-delete` — Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints. (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-create` — Bulk attach label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-delete` — Bulk remove label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-update` — Bulk replace label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"api-gateway": "# api-gateway — Discover, monitor, and protect your API endpoints with schema validation, abuse detection, and routing\n\n## Commands\n\n### Read Operations\n\n- `cf api-gateway configurations get` — Gets the current API Shield configuration settings for a zone, including validation behavior and enforcement mode.\n- `cf api-gateway discovery get` — Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas\n- `cf api-gateway discovery operations list` — Retrieve the most up to date view of discovered operations\n- `cf api-gateway labels list` — Retrieve all labels\n- `cf api-gateway labels managed get <name>` — Retrieve managed label\n- `cf api-gateway labels user get <name>` — Retrieve user label\n- `cf api-gateway operations get <operationId>` — Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.\n- `cf api-gateway operations list` — Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.\n- `cf api-gateway operations schema-validation get <operationId>` — Retrieves operation-level schema validation settings on the zone\n- `cf api-gateway schemas list` — Retrieves API operations and their features exported as OpenAPI schemas.\n- `cf api-gateway settings schema-validation get` — Retrieves zone level schema validation settings currently set on the zone\n- `cf api-gateway user-schemas get <schemaId>` — Gets detailed information about a specific uploaded OpenAPI schema, including its contents and validation configuration.\n- `cf api-gateway user-schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone. Useful for understanding which domains have schema coverage.\n- `cf api-gateway user-schemas list` — Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.\n- `cf api-gateway user-schemas operations list` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n\n### Create Operations\n\n- `cf api-gateway expression-template fallthrough create` — Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match. (supports --dry-run, --body)\n- `cf api-gateway operations create` — Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations labels create <operationId>` — Attach label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf api-gateway configurations update` — Updates API Shield configuration settings for a zone. Can modify validation strictness, enforcement mode, and other global settings. (supports --dry-run, --body)\n- `cf api-gateway discovery operations edit <operationId>` — Update the `state` on a discovered operation (supports --dry-run, --body)\n- `cf api-gateway labels managed resources operation update <name>` — Replace all operations(s) attached to a managed label (supports --dry-run, --body)\n- `cf api-gateway labels user edit <name>` — Update certain fields on a label (supports --dry-run, --body)\n- `cf api-gateway labels user resources operation update <name>` — Replace all operations(s) attached to a user label (supports --dry-run, --body)\n- `cf api-gateway labels user update <name>` — Update all fields on a label (supports --dry-run, --body)\n- `cf api-gateway operations labels update <operationId>` — Replace label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation edit` — Updates multiple operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation update <operationId>` — Updates operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation edit` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation update` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway user-schemas edit <schemaId>` — Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf api-gateway labels user delete <name>` — Delete user label (supports --dry-run)\n- `cf api-gateway operations delete <operationId>` — Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules. (supports --dry-run)\n- `cf api-gateway operations labels delete <operationId>` — Remove label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas delete <schemaId>` — Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules. (supports --dry-run)\n\n### Other Operations\n\n- `cf api-gateway discovery operations bulk-edit` — Update the `state` on one or more discovered operations (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-create` — Create user labels (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-delete` — Delete user labels (supports --dry-run, --body)\n- `cf api-gateway operations bulk-create` — Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations bulk-delete` — Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints. (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-create` — Bulk attach label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-delete` — Bulk remove label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-update` — Bulk replace label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"argo": "# argo — Network optimization features that speed up and improve reliability of traffic to your origins\n\n## Commands\n\n### Read Operations\n\n- `cf argo smart-routing get` — Retrieves the value of Argo Smart Routing enablement setting.\n- `cf argo tiered-caching get` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.\n\n### Update Operations\n\n- `cf argo smart-routing edit` — Configures the value of the Argo Smart Routing enablement setting. (supports --dry-run, --body)\n- `cf argo tiered-caching edit` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"audit-logs": "# audit-logs — Immutable audit trail of actions taken by account members — who changed what and when\n\n## Commands\n\n### Read Operations\n\n- `cf audit-logs list` — Gets a list of audit logs for an account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"autorag": "# autorag — AutoRAG — AI search, file management, job tracking, and sync for retrieval-augmented generation\n\n## Commands\n\n### Read Operations\n\n- `cf autorag jobs get <jobId>` — Get a Job Details\n- `cf autorag jobs list` — List Jobs\n\n### Other Operations\n\n- `cf autorag ai-search <id>` — AI Search (supports --dry-run, --body)\n- `cf autorag files <id>` — Files (supports --dry-run)\n- `cf autorag jobs logs <jobId>` — List Job Logs (supports --dry-run)\n- `cf autorag search <id>` — Search (supports --dry-run, --body)\n- `cf autorag sync <id>` — Sync (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -58,7 +58,7 @@
 		"kv": "# kv — Global, low-latency key-value storage for Workers — namespaces, keys, values, and bulk operations\n\n## Commands\n\n### Read Operations\n\n- `cf kv bulk get <namespaceId>` — Retrieve up to 100 KV pairs from the namespace. Keys must contain text-based values. JSON values can optionally be parsed instead of being returned as a string value. Metadata can be included if `withMetadata` is true. (supports --body)\n- `cf kv keys get <keyName>` — Returns the value associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. If the KV-pair is set to expire at some point, the expiration time as measured in seconds since the UNIX epoch will be returned in the `expiration` response header.\n- `cf kv keys list` — Lists a namespace's keys.\n- `cf kv metadata get <keyName>` — Returns the metadata associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.\n- `cf kv namespaces get <namespaceId>` — Get the namespace corresponding to the given ID.\n- `cf kv namespaces list` — Returns the namespaces owned by an account.\n\n### Create Operations\n\n- `cf kv namespaces create` — Creates a namespace under the given title. A `400` is returned if the account already owns a namespace with this title. A namespace must be explicitly deleted to be replaced. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf kv bulk update <namespaceId>` — Write multiple keys and values at once. Body should be an array of up to 10,000 key-value pairs to be stored, along with optional expiration information. Existing values and expirations will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. The entire request size must be 100 megabytes or less. (supports --dry-run, --body)\n- `cf kv keys update <keyName>` — Write a value identified by a key. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. Body should be the value to be stored. If JSON metadata to be associated with the key/value pair is needed, use `multipart/form-data` content type for your PUT request (see dropdown below in `REQUEST BODY SCHEMA`). Existing values, expirations, and metadata will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. (supports --dry-run, --body)\n- `cf kv namespaces update <namespaceId>` — Modifies a namespace's title. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf kv bulk delete <namespaceId>` — Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed. (supports --dry-run, --body)\n- `cf kv keys delete <keyName>` — Remove a KV pair from the namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. (supports --dry-run, --body)\n- `cf kv namespaces delete <namespaceId>` — Deletes the namespace corresponding to the given ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"leaked-credential-checks": "# leaked-credential-checks — Detect compromised credentials in login requests by checking against known breach databases\n\n## Commands\n\n### Read Operations\n\n- `cf leaked-credential-checks detections get <detectionId>` — Get user-defined detection pattern for Leaked Credential Checks.\n- `cf leaked-credential-checks detections list` — List user-defined detection patterns for Leaked Credential Checks.\n- `cf leaked-credential-checks get` — Retrieves the current status of Leaked Credential Checks.\n\n### Create Operations\n\n- `cf leaked-credential-checks create` — Updates the current status of Leaked Credential Checks. (supports --dry-run, --body)\n- `cf leaked-credential-checks detections create` — Create user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf leaked-credential-checks detections update <detectionId>` — Update user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf leaked-credential-checks detections delete <detectionId>` — Remove user-defined detection pattern for Leaked Credential Checks. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"load-balancers": "# load-balancers — Distribute traffic across origin pools with health monitoring, geo-steering, and failover\n\n## Commands\n\n### Read Operations\n\n- `cf load-balancers get <loadBalancerId>` — Fetch a single configured load balancer.\n- `cf load-balancers list` — List configured load balancers.\n- `cf load-balancers monitor-groups get <monitorGroupId>` — Fetch a single configured monitor group.\n- `cf load-balancers monitor-groups list` — List configured monitor groups.\n- `cf load-balancers monitor-groups references list` — Get the list of resources that reference the provided monitor group.\n- `cf load-balancers monitors get <monitorId>` — List a single configured monitor for an account.\n- `cf load-balancers monitors list` — List configured monitors for an account.\n- `cf load-balancers monitors references get <monitorId>` — Get the list of resources that reference the provided monitor.\n- `cf load-balancers pools get <poolId>` — Fetch a single configured pool.\n- `cf load-balancers pools health get <poolId>` — Fetch the latest pool health status for a single pool.\n- `cf load-balancers pools list` — List configured pools.\n- `cf load-balancers pools references get <poolId>` — Get the list of resources that reference the provided pool.\n- `cf load-balancers previews get <previewId>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf load-balancers regions get <regionId>` — Get a single region mapping.\n- `cf load-balancers regions list` — List all region mappings.\n- `cf load-balancers searches list` — Search for Load Balancing resources.\n\n### Create Operations\n\n- `cf load-balancers create` — Create a new load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups create` — Create a new monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers monitors previews create <monitorId>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf load-balancers pools health create <poolId>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf load-balancers edit <loadBalancerId>` — Apply changes to an existing load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups edit <monitorGroupId>` — Apply changes to an existing monitor group, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups update <monitorGroupId>` — Modify a configured monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors edit <monitorId>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitors update <monitorId>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools edit <poolId>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers pools update <poolId>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf load-balancers update <loadBalancerId>` — Update a configured load balancer. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf load-balancers delete <loadBalancerId>` — Delete a configured load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups delete <monitorGroupId>` — Delete a configured monitor group. (supports --dry-run)\n- `cf load-balancers monitors delete <monitorId>` — Delete a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools delete <poolId>` — Delete a configured pool. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf load-balancers pools bulk-edit` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"logpush": "# logpush — Push Cloudflare logs to external storage destinations — R2, S3, Splunk, Datadog, and more\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <datasetId>` — Lists Logpush jobs for an account for a dataset.\n- `cf logpush account-jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account.\n- `cf logpush datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush datasets jobs get <datasetId>` — Lists Logpush jobs for a zone for a dataset.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush jobs list` — Lists Logpush jobs for a zone.\n- `cf logpush log-explorer-datasets accounts available list` — Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets accounts get` — Retrieve a single Log Explorer dataset by ID for the account.\n- `cf logpush log-explorer-datasets accounts list` — Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logpush log-explorer-datasets zones available list` — Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets zones get` — Retrieve a single Log Explorer dataset by ID for the zone.\n- `cf logpush log-explorer-datasets zones list` — Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush jobs create` — Creates a new Logpush job for a zone. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts create` — Create a new Log Explorer dataset for the account. Use the `/accounts/{account_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones create` — Create a new Log Explorer dataset for the zone. Use the `/zones/{zone_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts update` — Updates the enabled state and/or field configuration of an account dataset. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones update` — Updates the enabled state and/or field configuration of a zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush log-explorer-query accounts query` — Run a SQL query against account-level datasets. (supports --dry-run, --body)\n- `cf logpush log-explorer-query zones query` — Run a SQL query against zone-level datasets. (supports --dry-run, --body)\n- `cf logpush ownership validate` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush validate destination` — Validates destination. (supports --dry-run, --body)\n- `cf logpush validate destination-exists` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush validate origin` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"logpush": "# logpush — Push Cloudflare logs to external storage destinations — R2, S3, Splunk, Datadog, and more\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <datasetId>` — Lists Logpush jobs for an account for a dataset.\n- `cf logpush account-jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account.\n- `cf logpush datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush datasets jobs get <datasetId>` — Lists Logpush jobs for a zone for a dataset.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush jobs list` — Lists Logpush jobs for a zone.\n- `cf logpush log-explorer-datasets accounts available list` — Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets accounts get <datasetId>` — Retrieve a single Log Explorer dataset by ID for the account.\n- `cf logpush log-explorer-datasets accounts list` — Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logpush log-explorer-datasets zones available list` — Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets zones get <datasetId>` — Retrieve a single Log Explorer dataset by ID for the zone.\n- `cf logpush log-explorer-datasets zones list` — Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush jobs create` — Creates a new Logpush job for a zone. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts create` — Create a new Log Explorer dataset for the account. Use the `/accounts/{account_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones create` — Create a new Log Explorer dataset for the zone. Use the `/zones/{zone_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts update <datasetId>` — Updates the enabled state and/or field configuration of an account dataset. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones update <datasetId>` — Updates the enabled state and/or field configuration of a zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush log-explorer-query accounts query` — Run a SQL query against account-level datasets. (supports --dry-run, --body)\n- `cf logpush log-explorer-query zones query` — Run a SQL query against zone-level datasets. (supports --dry-run, --body)\n- `cf logpush ownership validate` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush validate destination` — Validates destination. (supports --dry-run, --body)\n- `cf logpush validate destination-exists` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush validate origin` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"logs": "# logs — Log control, retention, and raw log access — CMB config, ray ID lookups, and received fields\n\n## Commands\n\n### Read Operations\n\n- `cf logs control cmb config get` — Gets CMB config.\n- `cf logs control retention get` — Gets log retention flag for Logpull API.\n- `cf logs rayid get <rayId>` — The `/rayids` api route allows lookups by specific rayid. The rayids route will return zero, one, or more records (ray ids are not unique).\n- `cf logs received fields get` — Lists all fields available. The response is json object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logs received get` — The `/received` api route allows customers to retrieve their edge HTTP logs. The basic access pattern is \"give me all the logs for zone Z for minute M\", where the minute M refers to the time records were received at Cloudflare's central data center. `start` is inclusive, and `end` is exclusive. Because of that, to get all data, at minutely cadence, starting at 10AM, the proper values are: `start=2018-05-20T10:00:00Z&end=2018-05-20T10:01:00Z`, then `start=2018-05-20T10:01:00Z&end=2018-05-20T10:02:00Z` and so on; the overlap will be handled properly.\n\n### Create Operations\n\n- `cf logs control cmb config create` — Updates CMB config. (supports --dry-run, --body)\n- `cf logs control retention create` — Updates log retention flag for Logpull API. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logs control cmb config delete` — Deletes CMB config. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"magic-cloud-networking": "# magic-cloud-networking — Multi-cloud networking — discover cloud resources, manage on-ramps, and automate cross-cloud connectivity\n\n## Commands\n\n### Read Operations\n\n- `cf magic-cloud-networking catalog-syncs get <syncId>` — Read a Catalog Sync (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs list` — List Catalog Syncs (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs prebuilt-policies list` — List prebuilt catalog sync policies (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations get <providerId>` — Read a Cloud Integration (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations list` — List Cloud Integrations (Closed Beta).\n- `cf magic-cloud-networking on-ramps address-spaces list` — Read the Magic WAN Address Space (Closed Beta).\n- `cf magic-cloud-networking on-ramps export <onrampId>` — Export an On-ramp to terraform ready file(s) (Closed Beta).\n- `cf magic-cloud-networking on-ramps get <onrampId>` — Read an On-ramp (Closed Beta).\n- `cf magic-cloud-networking on-ramps list` — List On-ramps (Closed Beta).\n- `cf magic-cloud-networking resources export` — Export resources in the Resource Catalog as a JSON file (Closed Beta).\n- `cf magic-cloud-networking resources get <resourceId>` — Read an resource from the Resource Catalog (Closed Beta).\n- `cf magic-cloud-networking resources list` — List resources in the Resource Catalog (Closed Beta).\n\n### Create Operations\n\n- `cf magic-cloud-networking catalog-syncs create` — Create a new Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations create` — Create a new Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps create` — Create a new On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-cloud-networking catalog-syncs edit <syncId>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking catalog-syncs update <syncId>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations edit <providerId>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations update <providerId>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces edit` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces update` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps edit <onrampId>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps update <onrampId>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-cloud-networking catalog-syncs delete <syncId>` — Delete a Catalog Sync (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations delete <providerId>` — Delete a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps delete <onrampId>` — Delete an On-ramp (Closed Beta). (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-cloud-networking catalog-syncs refresh <syncId>` — Refresh a Catalog Sync's destination by running the sync policy against latest resource catalog (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover <providerId>` — Run discovery for a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover-all` — Run discovery for all Cloud Integrations in an account (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations initial-setup <providerId>` — Get initial configuration to complete Cloud Integration setup (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps apply <onrampId>` — Apply an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps plan <onrampId>` — Plan an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking resources policy-preview` — Preview Rego query result against the latest resource catalog (Closed Beta). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"magic-network-monitoring": "# magic-network-monitoring — Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion\n\n## Commands\n\n### Read Operations\n\n- `cf magic-network-monitoring configs full get` — Lists default sampling, router IPs, warp devices, and rules for account.\n- `cf magic-network-monitoring configs get` — Lists default sampling, router IPs and warp devices for account.\n- `cf magic-network-monitoring rules get <ruleId>` — List a single network monitoring rule for account.\n- `cf magic-network-monitoring rules list` — Lists network monitoring rules for account.\n\n### Create Operations\n\n- `cf magic-network-monitoring configs create` — Create a new network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules create` — Create network monitoring rules for account. Currently only supports creating a single rule per API request. (supports --dry-run, --body)\n- `cf magic-network-monitoring vpc-flows tokens create` — Generate authentication token for VPC flow logs export. (supports --dry-run)\n\n### Update Operations\n\n- `cf magic-network-monitoring configs edit` — Update fields in an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring configs update` — Update an existing network monitoring configuration, requires the entire configuration to be updated at once. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules advertisements edit <ruleId>` — Update advertisement for rule. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules edit <ruleId>` — Update a network monitoring rule for account. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules update` — Update network monitoring rules for account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-network-monitoring configs delete` — Delete an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules delete <ruleId>` — Delete a network monitoring rule for account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -79,7 +79,7 @@
 		"r2-data-catalog": "# r2-data-catalog — Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines\n\n## Commands\n\n### Read Operations\n\n- `cf r2-data-catalog get <bucketName>` — Retrieve detailed information about a specific R2 catalog by bucket name. Returns catalog status, maintenance configuration, and credential status.\n- `cf r2-data-catalog list` — Returns a list of R2 buckets that have been enabled as Apache Iceberg catalogs for the specified account. Each catalog represents an R2 bucket configured to store Iceberg metadata and data files.\n- `cf r2-data-catalog maintenance-configs get <bucketName>` — Retrieve the maintenance configuration for a specific catalog, including compaction settings and credential status.\n- `cf r2-data-catalog namespaces list` — Returns a list of namespaces in the specified R2 catalog. Supports hierarchical filtering and pagination for efficient traversal of large namespace hierarchies.\n- `cf r2-data-catalog namespaces tables list` — Returns a list of tables in the specified namespace within an R2 catalog. Supports pagination for efficient traversal of large table collections.\n- `cf r2-data-catalog namespaces tables maintenance-configs get <tableName>` — Retrieve the maintenance configuration for a specific table, including compaction settings.\n\n### Create Operations\n\n- `cf r2-data-catalog credentials create <bucketName>` — Store authentication credentials for a catalog. These credentials are used to authenticate with R2 storage when performing catalog operations. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2-data-catalog maintenance-configs update <bucketName>` — Update the maintenance configuration for a catalog. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n- `cf r2-data-catalog namespaces tables maintenance-configs update <tableName>` — Update the maintenance configuration for a specific table. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf r2-data-catalog disable <bucketName>` — Disable an R2 bucket as a catalog. This operation deactivates the catalog but preserves existing metadata and data files. The catalog can be re-enabled later. (supports --dry-run)\n- `cf r2-data-catalog enable <bucketName>` — Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"radar": "# radar — Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights\n\n## Commands\n\n### Read Operations\n\n- `cf radar annotations list` — Retrieves the latest annotations.\n- `cf radar annotations outages get` — Retrieves the latest Internet outages and anomalies.\n- `cf radar bgp hijacks events list` — Retrieves the BGP hijack events.\n- `cf radar bgp leaks events list` — Retrieves the BGP route leak events.\n- `cf radar bgp top ases get` — Retrieves the top autonomous systems by BGP updates (announcements only).\n- `cf radar bots get <botSlug>` — Retrieves the requested bot information.\n- `cf radar bots list` — Retrieves a list of bots.\n- `cf radar ct authorities get <caSlug>` — Retrieves the requested CA information.\n- `cf radar ct authorities list` — Retrieves a list of certificate authorities.\n- `cf radar ct logs get <logSlug>` — Retrieves the requested certificate log information.\n- `cf radar ct logs list` — Retrieves a list of certificate logs.\n- `cf radar datasets get <alias>` — Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.\n- `cf radar datasets list` — Retrieves a list of datasets.\n- `cf radar email security top tlds get` — Retrieves the top TLDs by number of email messages.\n- `cf radar email security top tlds malicious get <malicious>` — Retrieves the top TLDs by emails classified as malicious or not.\n- `cf radar email security top tlds spam get <spam>` — Retrieves the top TLDs by emails classified as spam or not.\n- `cf radar email security top tlds spoof get <spoof>` — Retrieves the top TLDs by emails classified as spoof or not.\n- `cf radar entities asns get <asn>` — Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).\n- `cf radar entities asns list` — Retrieves a list of autonomous systems.\n- `cf radar entities get` — Retrieves IP address information.\n- `cf radar entities locations get <location>` — Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).\n- `cf radar entities locations list` — Retrieves a list of locations.\n- `cf radar geolocations get <geoId>` — Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar geolocations list` — Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar http ases bot-class get <botClass>` — Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.\n- `cf radar http ases browser-family get <browserFamily>` — Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.\n- `cf radar http ases device-type get <deviceType>` — Retrieves the top autonomous systems, by HTTP requests, of the requested device type.\n- `cf radar http ases get` — Retrieves the top autonomous systems by HTTP requests.\n- `cf radar http ases http-method get <httpVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.\n- `cf radar http ases http-protocol get <httpProtocol>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http ases ip-version get <ipVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.\n- `cf radar http ases os get <os>` — Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.\n- `cf radar http ases tls-version get <tlsVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.\n- `cf radar http locations bot-class get <botClass>` — Retrieves the top locations, by HTTP requests, of the requested bot class.\n- `cf radar http locations browser-family get <browserFamily>` — Retrieves the top locations, by HTTP requests, of the requested browser family.\n- `cf radar http locations device-type get <deviceType>` — Retrieves the top locations, by HTTP requests, of the requested device type.\n- `cf radar http locations get` — Retrieves the top locations by HTTP requests.\n- `cf radar http locations http-method get <httpVersion>` — Retrieves the top locations, by HTTP requests, of the requested HTTP version.\n- `cf radar http locations http-protocol get <httpProtocol>` — Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http locations ip-version get <ipVersion>` — Retrieves the top locations, by HTTP requests, of the requested IP version.\n- `cf radar http locations os get <os>` — Retrieves the top locations, by HTTP requests, of the requested operating system.\n- `cf radar http locations tls-version get <tlsVersion>` — Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.\n- `cf radar origins get <slug>` — Retrieves the requested origin information with its regions.\n- `cf radar origins list` — Retrieves a list of origins with their regions.\n- `cf radar ranking domain get <domain>` — Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.\n- `cf radar tlds get <tld>` — Retrieves the requested TLD information.\n- `cf radar tlds list` — Retrieves a list of TLDs.\n- `cf radar traffic-anomalies get` — Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.\n- `cf radar traffic-anomalies locations get` — Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.\n\n### Create Operations\n\n- `cf radar ai to-markdown create` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf radar agent-readiness summary <dimension>` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts. (supports --dry-run)\n- `cf radar ai bots summary user-agent` — Retrieves the distribution of traffic by AI user agent. (supports --dry-run)\n- `cf radar ai bots summary-v2 <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai bots timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai inference summary model` — Retrieves the distribution of unique accounts by model. (supports --dry-run)\n- `cf radar ai inference summary task` — Retrieves the distribution of unique accounts by task. (supports --dry-run)\n- `cf radar ai inference summary-v2 <dimension>` — Retrieves an aggregated summary of unique accounts using Workers AI inference grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary model` — Retrieves the distribution of unique accounts by model over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary task` — Retrieves the distribution of unique accounts by task over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups-v2 <dimension>` — Retrieves the distribution of unique accounts using Workers AI inference, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai markdown-for-agents summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. (supports --dry-run)\n- `cf radar ai markdown-for-agents timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. (supports --dry-run)\n- `cf radar ai timeseries-groups summary <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai timeseries-groups user-agent` — Retrieves the distribution of traffic by AI user agent over time. (supports --dry-run)\n- `cf radar annotations outages locations` — Retrieves the number of outages by location. (supports --dry-run)\n- `cf radar as112 summary dnssec` — Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 summary edns` — Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 summary ip-version` — Retrieves the distribution of DNS queries to AS112 by IP version. (supports --dry-run)\n- `cf radar as112 summary protocol` — Retrieves the distribution of DNS queries to AS112 by protocol. (supports --dry-run)\n- `cf radar as112 summary query-type` — Retrieves the distribution of DNS queries to AS112 by type. (supports --dry-run)\n- `cf radar as112 summary response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code. (supports --dry-run)\n- `cf radar as112 summary-v2 <dimension>` — Retrieves the distribution of AS112 queries by the specified dimension. (supports --dry-run)\n- `cf radar as112 timeseries` — Retrieves the AS112 DNS queries over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups dnssec` — Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups edns` — Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups ip-version` — Retrieves the distribution of AS112 DNS queries by IP version over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups protocol` — Retrieves the distribution of AS112 DNS requests classified by protocol over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups query-type` — Retrieves the distribution of AS112 DNS queries by type over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups-v2 <dimension>` — Retrieves the distribution of AS112 queries grouped by dimension over time. (supports --dry-run)\n- `cf radar as112 top dnssec <dnssec>` — Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 top edns <edns>` — Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 top ip-version <ipVersion>` — Retrieves the top locations of DNS queries to AS112 for an IP version. (supports --dry-run)\n- `cf radar as112 top locations` — Retrieves the top locations by AS112 DNS queries. (supports --dry-run)\n- `cf radar attacks layer3 summary bitrate` — Retrieves the distribution of layer 3 attacks by bitrate. (supports --dry-run)\n- `cf radar attacks layer3 summary duration` — Retrieves the distribution of layer 3 attacks by duration. (supports --dry-run)\n- `cf radar attacks layer3 summary industry` — Retrieves the distribution of layer 3 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer3 summary ip-version` — Retrieves the distribution of layer 3 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer3 summary protocol` — Retrieves the distribution of layer 3 attacks by protocol. (supports --dry-run)\n- `cf radar attacks layer3 summary vector` — Retrieves the distribution of layer 3 attacks by vector. (supports --dry-run)\n- `cf radar attacks layer3 summary vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer3 summary-v2 <dimension>` — Retrieves the distribution of layer 3 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer3 timeseries` — Retrieves layer 3 attacks over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups bitrate` — Retrieves the distribution of layer 3 attacks by bitrate over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups duration` — Retrieves the distribution of layer 3 attacks by duration over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups industry` — Retrieves the distribution of layer 3 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups ip-version` — Retrieves the distribution of layer 3 attacks by IP version over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups protocol` — Retrieves the distribution of layer 3 attacks by protocol over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vector` — Retrieves the distribution of layer 3 attacks by vector over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer3 top attacks` — Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer3 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer3 top locations origin` — Retrieves the origin locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top locations target` — Retrieves the target locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar attacks layer7 summary http-method` — Retrieves the distribution of layer 7 attacks by HTTP method. (supports --dry-run)\n- `cf radar attacks layer7 summary http-version` — Retrieves the distribution of layer 7 attacks by HTTP version. (supports --dry-run)\n- `cf radar attacks layer7 summary industry` — Retrieves the distribution of layer 7 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer7 summary ip-version` — Retrieves the distribution of layer 7 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer7 summary managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules. (supports --dry-run)\n- `cf radar attacks layer7 summary mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product. (supports --dry-run)\n- `cf radar attacks layer7 summary vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer7 summary-v2 <dimension>` — Retrieves the distribution of layer 7 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer7 timeseries` — Retrieves layer 7 attacks over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-method` — Retrieves the distribution of layer 7 attacks by HTTP method over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-version` — Retrieves the distribution of layer 7 attacks by HTTP version over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups industry` — Retrieves the distribution of layer 7 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups ip-version` — Retrieves the distribution of layer 7 attacks by IP version used over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer7 top ases origin` — Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top attacks` — Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer7 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer7 top locations origin` — Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top locations target` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. (supports --dry-run)\n- `cf radar attacks layer7 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar bgp ips timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. (supports --dry-run)\n- `cf radar bgp routes ases` — Retrieves all ASes in the current global routing tables with routing statistics. (supports --dry-run)\n- `cf radar bgp routes moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. (supports --dry-run)\n- `cf radar bgp routes pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. (supports --dry-run)\n- `cf radar bgp routes realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). (supports --dry-run)\n- `cf radar bgp routes stats` — Retrieves the BGP routing table stats. (supports --dry-run)\n- `cf radar bgp rpki aspa changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. (supports --dry-run)\n- `cf radar bgp rpki aspa snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. (supports --dry-run)\n- `cf radar bgp rpki aspa timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. (supports --dry-run)\n- `cf radar bgp timeseries` — Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. (supports --dry-run)\n- `cf radar bgp top ases prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. (supports --dry-run)\n- `cf radar bgp top prefixes` — Retrieves the top network prefixes by BGP updates. (supports --dry-run)\n- `cf radar bots summary <dimension>` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots timeseries` — Retrieves bots HTTP request volume over time. (supports --dry-run)\n- `cf radar bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar bots web-crawlers summary <dimension>` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots web-crawlers timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ct summary <dimension>` — Retrieves an aggregated summary of certificates grouped by the specified dimension. (supports --dry-run)\n- `cf radar ct timeseries` — Retrieves certificate volume over time. (supports --dry-run)\n- `cf radar ct timeseries-groups <dimension>` — Retrieves the distribution of certificates grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar datasets download` — Retrieves an URL to download a single dataset. (supports --dry-run, --body)\n- `cf radar dns summary cache-hit` — Retrieves the distribution of DNS queries by cache status. (supports --dry-run)\n- `cf radar dns summary dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar dns summary dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness. (supports --dry-run)\n- `cf radar dns summary dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status. (supports --dry-run)\n- `cf radar dns summary ip-version` — Retrieves the distribution of DNS queries by IP version. (supports --dry-run)\n- `cf radar dns summary matching-answer` — Retrieves the distribution of DNS queries by matching answers. (supports --dry-run)\n- `cf radar dns summary protocol` — Retrieves the distribution of DNS queries by DNS transport protocol. (supports --dry-run)\n- `cf radar dns summary query-type` — Retrieves the distribution of DNS queries by type. (supports --dry-run)\n- `cf radar dns summary response-code` — Retrieves the distribution of DNS queries by response code. (supports --dry-run)\n- `cf radar dns summary response-ttl` — Retrieves the distribution of DNS queries by minimum response TTL. (supports --dry-run)\n- `cf radar dns summary-v2 <dimension>` — Retrieves the distribution of DNS queries by the specified dimension. (supports --dry-run)\n- `cf radar dns timeseries` — Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. (supports --dry-run)\n- `cf radar dns timeseries-groups cache-hit` — Retrieves the distribution of DNS queries by cache status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups ip-version` — Retrieves the distribution of DNS queries by IP version over time. (supports --dry-run)\n- `cf radar dns timeseries-groups matching-answer` — Retrieves the distribution of DNS queries by matching answers over time. (supports --dry-run)\n- `cf radar dns timeseries-groups protocol` — Retrieves the distribution of DNS queries by DNS transport protocol over time. (supports --dry-run)\n- `cf radar dns timeseries-groups query-type` — Retrieves the distribution of DNS queries by type over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-code` — Retrieves the distribution of DNS queries by response code over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-ttl` — Retrieves the distribution of DNS queries by minimum answer TTL over time. (supports --dry-run)\n- `cf radar dns timeseries-groups-v2 <dimension>` — Retrieves the distribution of DNS queries grouped by dimension over time. (supports --dry-run)\n- `cf radar dns top ases` — Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar dns top locations` — Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar email routing summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email routing summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email routing summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email routing summary encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted). (supports --dry-run)\n- `cf radar email routing summary ip-version` — Retrieves the distribution of emails by IP version. (supports --dry-run)\n- `cf radar email routing summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email routing summary-v2 <dimension>` — Retrieves the distribution of email routing metrics by the specified dimension. (supports --dry-run)\n- `cf radar email routing timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted) over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups ip-version` — Retrieves the distribution of emails by IP version over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups-v2 <dimension>` — Retrieves the distribution of email routing metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar email security summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email security summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email security summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email security summary malicious` — Retrieves the distribution of emails by malicious classification. (supports --dry-run)\n- `cf radar email security summary spam` — Retrieves the proportion of emails by spam classification (spam vs. non-spam). (supports --dry-run)\n- `cf radar email security summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email security summary spoof` — Retrieves the proportion of emails by spoof classification (spoof vs. non-spoof). (supports --dry-run)\n- `cf radar email security summary threat-category` — Retrieves the distribution of emails by threat categories. (supports --dry-run)\n- `cf radar email security summary tls-version` — Retrieves the distribution of emails by TLS version. (supports --dry-run)\n- `cf radar email security summary-v2 <dimension>` — Retrieves the distribution of email security metrics by the specified dimension. (supports --dry-run)\n- `cf radar email security timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups malicious` — Retrieves the distribution of emails by malicious classification over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spam` — Retrieves the distribution of emails by spam classification (spam vs. non-spam) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spoof` — Retrieves the distribution of emails by spoof classification (spoof vs. non-spoof) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups threat-category` — Retrieves the distribution of emails by threat category over time. (supports --dry-run)\n- `cf radar email security timeseries-groups tls-version` — Retrieves the distribution of emails by TLS version over time. (supports --dry-run)\n- `cf radar email security timeseries-groups-v2 <dimension>` — Retrieves the distribution of email security metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar entities asns as-set <asn>` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. (supports --dry-run)\n- `cf radar entities asns botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. (supports --dry-run)\n- `cf radar entities asns ip` — Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). (supports --dry-run)\n- `cf radar entities asns rel <asn>` — Retrieves AS-level relationship for given networks. (supports --dry-run)\n- `cf radar http summary bot-class` — Retrieves the distribution of bot-generated HTTP requests to genuine human traffic, as classified by Cloudflare. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http summary device-type` — Retrieves the distribution of HTTP requests generated by mobile, desktop, and other types of devices. (supports --dry-run)\n- `cf radar http summary http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS). (supports --dry-run)\n- `cf radar http summary http-version` — Retrieves the distribution of HTTP requests by HTTP version. (supports --dry-run)\n- `cf radar http summary ip-version` — Retrieves the distribution of HTTP requests by IP version. (supports --dry-run)\n- `cf radar http summary os` — Retrieves the distribution of HTTP requests by operating system (Windows, macOS, Android, iOS, and others). (supports --dry-run)\n- `cf radar http summary post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support. (supports --dry-run)\n- `cf radar http summary tls-version` — Retrieves the distribution of HTTP requests by TLS version. (supports --dry-run)\n- `cf radar http summary-v2 <dimension>` — Retrieves the distribution of HTTP requests by the specified dimension. (supports --dry-run)\n- `cf radar http timeseries` — Retrieves the HTTP requests over time. (supports --dry-run)\n- `cf radar http timeseries-groups bot-class` — Retrieves the distribution of HTTP requests classified as automated or human over time. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http timeseries-groups browser` — Retrieves the distribution of HTTP requests by user agent over time. (supports --dry-run)\n- `cf radar http timeseries-groups browser-family` — Retrieves the distribution of HTTP requests by user agent family over time. (supports --dry-run)\n- `cf radar http timeseries-groups device-type` — Retrieves the distribution of HTTP requests by device type over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS) over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-version` — Retrieves the distribution of HTTP requests by HTTP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups ip-version` — Retrieves the distribution of HTTP requests by IP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups os` — Retrieves the distribution of HTTP requests by operating system over time. (supports --dry-run)\n- `cf radar http timeseries-groups post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support over time. (supports --dry-run)\n- `cf radar http timeseries-groups tls-version` — Retrieves the distribution of HTTP requests by TLS version over time. (supports --dry-run)\n- `cf radar http timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP requests grouped by dimension. (supports --dry-run)\n- `cf radar http top browser` — Retrieves the top user agents by HTTP requests. (supports --dry-run)\n- `cf radar http top browser-family` — Retrieves the top user agents, aggregated in families, by HTTP requests. (supports --dry-run)\n- `cf radar leaked-credentials summary bot-class` — Retrieves the distribution of HTTP authentication requests by bot class. (supports --dry-run)\n- `cf radar leaked-credentials summary compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status. (supports --dry-run)\n- `cf radar leaked-credentials summary-v2 <dimension>` — Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups bot-class` — Retrieves the distribution of HTTP authentication requests by bot class over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows summary` — Retrieves the distribution of network traffic (NetFlows) by HTTP vs other protocols. (supports --dry-run)\n- `cf radar netflows summary-v2 <dimension>` — Retrieves the distribution of network traffic (NetFlows) by the specified dimension. (supports --dry-run)\n- `cf radar netflows timeseries` — Retrieves network traffic (NetFlows) over time. (supports --dry-run)\n- `cf radar netflows timeseries-groups <dimension>` — Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows top ases` — Retrieves the top autonomous systems by network traffic (NetFlows). (supports --dry-run)\n- `cf radar netflows top locations` — Retrieves the top locations by network traffic (NetFlows). (supports --dry-run)\n- `cf radar origins summary <dimension>` — Retrieves an aggregated summary of origin metrics grouped by the specified dimension. (supports --dry-run)\n- `cf radar origins timeseries` — Retrieves the time series of origin metrics for the specified origin. (supports --dry-run)\n- `cf radar origins timeseries-groups <dimension>` — Retrieves the distribution of origin metrics grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar post-quantum origin summary <dimension>` — Returns a summary of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum origin timeseries-groups <dimension>` — Returns a timeseries of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum tls support` — Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm and whether it uses PQ cryptography. (supports --dry-run)\n- `cf radar quality iqi summary` — Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality iqi timeseries-groups` — Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality speed histogram` — Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. (supports --dry-run)\n- `cf radar quality speed summary` — Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top ases` — Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top locations` — Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar ranking internet-services categories` — Retrieves the list of Internet services categories. (supports --dry-run)\n- `cf radar ranking internet-services timeseries-groups` — Retrieves Internet Services rank update changes over time. (supports --dry-run)\n- `cf radar ranking internet-services top` — Retrieves top Internet services based on their rank. (supports --dry-run)\n- `cf radar ranking timeseries-groups` — Retrieves domains rank over time. (supports --dry-run)\n- `cf radar ranking top` — Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. (supports --dry-run)\n- `cf radar robots-txt top domain-categories` — Retrieves the top domain categories by the number of robots.txt files parsed. (supports --dry-run)\n- `cf radar robots-txt top user-agents directive` — Retrieves the top user agents on robots.txt files. (supports --dry-run)\n- `cf radar search global` — Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). (supports --dry-run)\n- `cf radar tcp-resets-timeouts summary` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. (supports --dry-run)\n- `cf radar tcp-resets-timeouts timeseries-groups` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. (supports --dry-run)\n- `cf radar verified-bots top bots` — Retrieves the top verified bots by HTTP requests, with owner and category. (supports --dry-run)\n- `cf radar verified-bots top categories` — Retrieves the top verified bot categories by HTTP requests, along with their corresponding percentage, over the total verified bot HTTP requests. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rate-limits": "# rate-limits — Legacy per-zone rate limiting rules — prefer Advanced Rate Limiting in Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf rate-limits get <rateLimitId>` — Fetches the details of a rate limit.\n- `cf rate-limits list` — Fetches the rate limits for a zone.\n\n### Create Operations\n\n- `cf rate-limits create` — Creates a new rate limit for a zone. Refer to the object definition for a list of required attributes. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rate-limits edit <rateLimitId>` — Updates an existing rate limit. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rate-limits delete <rateLimitId>` — Deletes an existing rate limit. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"realtime-kit": "# realtime-kit — Real-time video and audio — meetings, livestreams, recordings, and session management via Cloudflare Calls\n\n## Commands\n\n### Read Operations\n\n- `cf realtime-kit apps get` — Fetch all apps for your account\n- `cf realtime-kit kit meetings livestream get <meetingId>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtime-kit kit sessions livestream sessions get <sessionId>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtime-kit meetings get <appId>` — Returns all meetings for the given App ID.\n- `cf realtime-kit presets get <appId>` — Fetches all the presets belonging to an App.\n\n### Create Operations\n\n- `cf realtime-kit kit meetings active-session mute create <meetingId>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit kit meetings active-session mute-all create <meetingId>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings create <appId>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtime-kit presets create <appId>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtime-kit presets update <presetId>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtime-kit presets delete <presetId>` — Deletes a preset using the provided preset ID (supports --dry-run)\n\n### Other Operations\n\n- `cf realtime-kit active-session create-poll <meetingId>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit active-session get-active-session <meetingId>` — Returns details of an ongoing active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-all-participants <meetingId>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-participants <meetingId>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit analytics get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit apps post` — Create new app for your account (supports --dry-run, --body)\n- `cf realtime-kit livestreams get-active-livestreams-for-livestream-id <livestreamId>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-all-livestreams` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-analytics-complete <appId>` — Returns livestream analytics for the specified time range. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-details-for-session-id <livestreamSessionId>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-for-livestream-id <livestreamId>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-meeting-active-livestreams <meetingId>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit livestreams get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit livestreams start-livestreaming-a-meeting <meetingId>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit livestreams stop-livestreaming-a-meeting <meetingId>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit meetings add-participant <meetingId>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings delete-meeting-participant <participantId>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings edit-participant <participantId>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings get-meeting-by-id <meetingId>` — Returns a meeting details in an App for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participant <participantId>` — Returns a participant details for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participants <meetingId>` — Returns all participants detail for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings refresh-participant-token <participantId>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings replace-meeting-by-id <meetingId>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings update-meeting-by-id <meetingId>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit presets get-preset-by-id <presetId>` — Fetches details of a preset using the provided preset ID (supports --dry-run)\n- `cf realtime-kit recordings get-active-recordings <meetingId>` — Returns the active recording details for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings get-one-recording <recordingId>` — Returns details of a recording for the given recording ID. (supports --dry-run)\n- `cf realtime-kit recordings get-recordings <appId>` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings pause-resume-stop-recording <recordingId>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-recordings <appId>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-track-recording <appId>` — Starts a track recording in a meeting. Track recordings consist of \"layers\". Layers are used to map audio/video tracks in a meeting to output destinations. More information about track recordings is available in the [Track Recordings Guide Page](https://docs.realtime.cloudflare.com/guides/capabilities/recording/recording-overview). (supports --dry-run, --body)\n- `cf realtime-kit sessions generate-summary-of-transcripts <sessionId>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-participant-data-from-peer-id <peerId>` — Returns details of the given peer ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-chat <sessionId>` — Returns a URL to download all chat messages of the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-session-details <sessionId>` — Returns data of the given session ID including recording details. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participant-details <participantId>` — Returns details of the given participant ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participants <sessionId>` — Returns a list of participants for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-summary <sessionId>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text. (supports --dry-run)\n- `cf realtime-kit sessions get-session-transcripts <sessionId>` — Returns a URL to download the transcript for the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-sessions <appId>` — Returns details of all sessions of an App. (supports --dry-run)\n- `cf realtime-kit webhooks create-webhook <appId>` — Adds a new webhook to an App. (supports --dry-run, --body)\n- `cf realtime-kit webhooks delete-webhook <webhookId>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks edit-webhook <webhookId>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n- `cf realtime-kit webhooks get-webhook-by-id <webhookId>` — Returns webhook details for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks get-webhooks <appId>` — Returns details of all webhooks for an App. (supports --dry-run)\n- `cf realtime-kit webhooks replace-webhook <webhookId>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"realtime-kit": "# realtime-kit — Real-time video and audio — meetings, livestreams, recordings, and session management via Cloudflare Calls\n\n## Commands\n\n### Read Operations\n\n- `cf realtime-kit apps get` — Fetch all apps for your account\n- `cf realtime-kit kit meetings livestream get <meetingId>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtime-kit kit sessions livestream sessions get <sessionId>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtime-kit meetings get <appId>` — Returns all meetings for the given App ID.\n- `cf realtime-kit presets get <appId>` — Fetches all the presets belonging to an App.\n\n### Create Operations\n\n- `cf realtime-kit kit meetings active-session mute create <meetingId>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit kit meetings active-session mute-all create <meetingId>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings create <appId>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtime-kit presets create <appId>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtime-kit presets update <presetId>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtime-kit presets delete <presetId>` — Deletes a preset using the provided preset ID (supports --dry-run)\n\n### Other Operations\n\n- `cf realtime-kit active-session create-poll <meetingId>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit active-session get-active-session <meetingId>` — Returns details of an ongoing active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-all-participants <meetingId>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-participants <meetingId>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit analytics get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit apps post` — Create new app for your account (supports --dry-run, --body)\n- `cf realtime-kit livestreams get-active-livestreams-for-livestream-id <livestreamId>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-all-livestreams <appId>` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-analytics-complete <appId>` — Returns livestream analytics for the specified time range. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-details-for-session-id <livestreamSessionId>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-for-livestream-id <livestreamId>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-meeting-active-livestreams <meetingId>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit livestreams get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit livestreams start-livestreaming-a-meeting <meetingId>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit livestreams stop-livestreaming-a-meeting <meetingId>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit meetings add-participant <meetingId>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings delete-meeting-participant <participantId>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings edit-participant <participantId>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings get-meeting-by-id <meetingId>` — Returns a meeting details in an App for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participant <participantId>` — Returns a participant details for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participants <meetingId>` — Returns all participants detail for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings refresh-participant-token <participantId>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings replace-meeting-by-id <meetingId>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings update-meeting-by-id <meetingId>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit presets get-preset-by-id <presetId>` — Fetches details of a preset using the provided preset ID (supports --dry-run)\n- `cf realtime-kit recordings get-active-recordings <meetingId>` — Returns the active recording details for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings get-one-recording <recordingId>` — Returns details of a recording for the given recording ID. (supports --dry-run)\n- `cf realtime-kit recordings get-recordings <appId>` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings pause-resume-stop-recording <recordingId>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-recordings <appId>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-track-recording <appId>` — Starts a track recording in a meeting. Track recordings consist of \"layers\". Layers are used to map audio/video tracks in a meeting to output destinations. More information about track recordings is available in the [Track Recordings Guide Page](https://docs.realtime.cloudflare.com/guides/capabilities/recording/recording-overview). (supports --dry-run, --body)\n- `cf realtime-kit sessions generate-summary-of-transcripts <sessionId>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-participant-data-from-peer-id <peerId>` — Returns details of the given peer ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-chat <sessionId>` — Returns a URL to download all chat messages of the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-session-details <sessionId>` — Returns data of the given session ID including recording details. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participant-details <participantId>` — Returns details of the given participant ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participants <sessionId>` — Returns a list of participants for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-summary <sessionId>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text. (supports --dry-run)\n- `cf realtime-kit sessions get-session-transcripts <sessionId>` — Returns a URL to download the transcript for the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-sessions <appId>` — Returns details of all sessions of an App. (supports --dry-run)\n- `cf realtime-kit webhooks create-webhook <appId>` — Adds a new webhook to an App. (supports --dry-run, --body)\n- `cf realtime-kit webhooks delete-webhook <webhookId>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks edit-webhook <webhookId>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n- `cf realtime-kit webhooks get-webhook-by-id <webhookId>` — Returns webhook details for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks get-webhooks <appId>` — Returns details of all webhooks for an App. (supports --dry-run)\n- `cf realtime-kit webhooks replace-webhook <webhookId>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"registrar": "# registrar — Domain registration and transfer management through Cloudflare Registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar registrations get <domainName>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create` — Starts a domain registration workflow. This is a billable operation — successful registration charges the account's default payment method. All successful domain registrations are non-refundable — once the workflow completes with `state: succeeded`, the charge cannot be reversed. ### Prerequisites - The account must have a billing profile with a valid default payment method. Set this up at `https://dash.cloudflare.com/{account_id}/billing/payment-info`. - The account must not already be at the maximum supported domain limit. A single account may own up to 100 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Supported extensions In this API, \"extension\" means the full registrable suffix after the domain label. For example, in `example.co.uk`, the extension is `co.uk`. Programmatic registration is currently supported for: `com`, `org`, `net`, `app`, `dev`, `cc`, `xyz`, `info`, `cloud`, `studio`, `live`, `link`, `pro`, `tech`, `fyi`, `shop`, `online`, `tools`, `run`, `games`, `build`, `systems`, `world`, `news`, `site`, `network`, `chat`, `space`, `family`, `page`, `life`, `group`, `email`, `solutions`, `day`, `blog`, `ing`, `icu`, `academy`, `today` Cloudflare Registrar supports 400+ extensions in the dashboard. Extensions not listed above can still be registered at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Express mode The only required field is `domain_name`. If `contacts` is omitted, the system uses the account's default address book entry as the registrant. If no default exists and no contact is provided, the request fails. Set up a default address book entry and accept the required agreement at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domainName>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar domain-check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar domain-search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n- `cf registrar registrations get-status <domainName>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domainName>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"request-tracers": "# request-tracers — Trace how a request would be processed through Cloudflare's rules and configuration pipeline\n\n## Commands\n\n### Create Operations\n\n- `cf request-tracers traces create` — Traces a simulated HTTP request through Cloudflare's edge to analyze how rules, settings, and configurations would process the request. Useful for debugging firewall rules, page rules, and other request transformations without sending actual traffic. Supports custom headers, cookies, body content, and geolocation context. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"resource-sharing": "# resource-sharing — Share Cloudflare resources (zones, accounts) across organizations with granular access controls\n\n## Commands\n\n### Read Operations\n\n- `cf resource-sharing get <shareId>` — Fetches share by ID.\n- `cf resource-sharing list` — Lists all account shares.\n- `cf resource-sharing recipients get <recipientId>` — Get share recipient by ID.\n- `cf resource-sharing recipients list` — List share recipients by share ID.\n- `cf resource-sharing resources get <resourceId>` — Get share resource by ID.\n- `cf resource-sharing resources list` — List share resources by share ID.\n\n### Create Operations\n\n- `cf resource-sharing create` — Creates a new resource share for sharing Cloudflare resources with other accounts or organizations. (supports --dry-run, --body)\n- `cf resource-sharing recipients create <shareId>` — Adds a recipient to a resource share, granting them access to the shared resources. (supports --dry-run, --body)\n- `cf resource-sharing resources create <shareId>` — Adds a resource to an existing share, making it available to share recipients. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf resource-sharing recipients update <shareId>` — Changes a share's recipients to match the given list. Returns an error if the share targets an organization. (supports --dry-run, --body)\n- `cf resource-sharing resources update <resourceId>` — Update is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run, --body)\n- `cf resource-sharing update <shareId>` — Updating is not immediate, an updated share object with a new status will be returned. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf resource-sharing delete <shareId>` — Deletion is not immediate, an updated share object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing recipients delete <recipientId>` — Deletion is not immediate, an updated share recipient object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing resources delete <resourceId>` — Deletion is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -87,7 +87,7 @@
 		"rules": "# rules — Account-level IP lists, hostname lists, and other reusable lists referenced by firewall rules and rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rules lists bulk-operations get <operationId>` — Gets the current status of an asynchronous operation on a list. The `status` property can have one of the following values: `pending`, `running`, `completed`, or `failed`. If the status is `failed`, the `error` property will contain a message describing the error.\n- `cf rules lists get <listId>` — Fetches the details of a list.\n- `cf rules lists items get <itemId>` — Fetches a list item in the list.\n- `cf rules lists items list` — Fetches all the items in the list.\n- `cf rules lists list` — Fetches all lists in the account.\n\n### Create Operations\n\n- `cf rules lists create` — Creates a new list of the specified kind. (supports --dry-run, --body)\n- `cf rules lists items create <listId>` — Appends new items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rules lists items update <listId>` — Removes all existing items from the list and adds the provided items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n- `cf rules lists update <listId>` — Updates the description of a list. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rules lists delete <listId>` — Deletes a specific list and all its items. (supports --dry-run, --body)\n- `cf rules lists items delete <listId>` — Removes one or more items from a list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rulesets": "# rulesets — Versioned collections of rules that control how Cloudflare processes traffic — WAF, transform, redirect, and more\n\n## Commands\n\n### Read Operations\n\n- `cf rulesets account-rulesets get <rulesetId>` — Fetches the latest version of an account ruleset.\n- `cf rulesets account-rulesets list` — Fetches all rulesets at the account level.\n- `cf rulesets account-rulesets phases get <rulesetPhase>` — Fetches the latest version of the account entry point ruleset for a given phase.\n- `cf rulesets account-rulesets phases versions get <rulesetVersion>` — Fetches a specific version of an account entry point ruleset.\n- `cf rulesets account-rulesets phases versions list` — Fetches the versions of an account entry point ruleset.\n- `cf rulesets account-rulesets versions get <rulesetVersion>` — Fetches a specific version of an account ruleset.\n- `cf rulesets account-rulesets versions list` — Fetches the versions of an account ruleset.\n- `cf rulesets get <rulesetId>` — Fetches the latest version of a zone ruleset.\n- `cf rulesets list` — Fetches all rulesets at the zone level.\n- `cf rulesets phases get <rulesetPhase>` — Fetches the latest version of the zone entry point ruleset for a given phase.\n- `cf rulesets phases versions get <rulesetVersion>` — Fetches a specific version of a zone entry point ruleset.\n- `cf rulesets phases versions list` — Fetches the versions of a zone entry point ruleset.\n- `cf rulesets versions get <rulesetVersion>` — Fetches a specific version of a zone ruleset.\n- `cf rulesets versions list` — Fetches the versions of a zone ruleset.\n\n### Create Operations\n\n- `cf rulesets account-rulesets create` — Creates a ruleset at the account level. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules create <rulesetId>` — Adds a new rule to an account ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n- `cf rulesets create` — Creates a ruleset at the zone level. (supports --dry-run, --body)\n- `cf rulesets rules create <rulesetId>` — Adds a new rule to a zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rulesets account-rulesets phases update <rulesetPhase>` — Updates an account entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules update <ruleId>` — Updates an existing rule in an account ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets update <rulesetId>` — Updates an account ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets phases update <rulesetPhase>` — Updates a zone entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets rules edit <ruleId>` — Updates an existing rule in a zone ruleset. (supports --dry-run, --body)\n- `cf rulesets update <rulesetId>` — Updates a zone ruleset, creating a new version. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rulesets account-rulesets delete <rulesetId>` — Deletes all versions of an existing account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets rules delete <ruleId>` — Deletes an existing rule from an account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets versions delete <rulesetVersion>` — Deletes an existing version of an account ruleset. (supports --dry-run)\n- `cf rulesets delete <rulesetId>` — Deletes all versions of an existing zone ruleset. (supports --dry-run)\n- `cf rulesets rules delete <ruleId>` — Deletes an existing rule from a zone ruleset. (supports --dry-run)\n- `cf rulesets versions delete <rulesetVersion>` — Deletes an existing version of a zone ruleset. (supports --dry-run)\n\n### Other Operations\n\n- `cf rulesets account-rulesets versions by-tag tag <ruleTag>` — Fetches the rules of a managed account ruleset version for a given tag. (supports --dry-run)\n- `cf rulesets account-rulesets versions zone-by-tag tag <ruleTag>` — Fetches the rules of a managed zone ruleset version for a given tag. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rum": "# rum — Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics\n\n## Commands\n\n### Read Operations\n\n- `cf rum rules list` — Lists all the rules in a Web Analytics ruleset.\n- `cf rum site-info get <siteId>` — Retrieves a Web Analytics site.\n- `cf rum site-info list` — Lists all Web Analytics sites of an account.\n\n### Create Operations\n\n- `cf rum rules create <rulesetId>` — Creates a new rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info create` — Creates a new Web Analytics site. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rum rules update <ruleId>` — Updates a rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info update <siteId>` — Updates an existing Web Analytics site. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rum rules delete <ruleId>` — Deletes an existing rule from a Web Analytics ruleset. (supports --dry-run)\n- `cf rum site-info delete <siteId>` — Deletes an existing Web Analytics site. (supports --dry-run)\n\n### Other Operations\n\n- `cf rum rules bulk-create` — Modifies one or more rules in a Web Analytics ruleset with a single request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"schema-validation": "# schema-validation — API schema validation settings — enforce request/response schemas and configure validation behavior\n\n## Commands\n\n### Read Operations\n\n- `cf schema-validation schemas get` — Gets the contents and metadata of a specific OpenAPI schema uploaded to API Shield.\n- `cf schema-validation schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone.\n- `cf schema-validation schemas list` — Lists all OpenAPI schemas uploaded to API Shield with pagination support.\n- `cf schema-validation schemas operations get` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n- `cf schema-validation settings get` — Retrieves the current global schema validation settings for a zone.\n- `cf schema-validation settings operations get` — Retrieves the schema validation settings configured for a specific API operation.\n- `cf schema-validation settings operations list` — Lists all per-operation schema validation settings configured for the zone.\n\n### Create Operations\n\n- `cf schema-validation schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf schema-validation schemas edit` — Modifies an existing OpenAPI schema in API Shield, updating the validation rules for associated API operations. (supports --dry-run, --body)\n- `cf schema-validation settings edit` — Partially updates global schema validation settings for a zone using PATCH semantics. (supports --dry-run, --body)\n- `cf schema-validation settings operations update` — Fully updates schema validation settings for a specific API operation. (supports --dry-run, --body)\n- `cf schema-validation settings update` — Fully updates global schema validation settings for a zone, replacing existing configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf schema-validation schemas delete` — Permanently removes an uploaded OpenAPI schema from API Shield. Operations using this schema will lose their validation rules. (supports --dry-run)\n- `cf schema-validation settings operations delete` — Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults. (supports --dry-run)\n\n### Other Operations\n\n- `cf schema-validation settings operations bulk-edit` — Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"schema-validation": "# schema-validation — API schema validation settings — enforce request/response schemas and configure validation behavior\n\n## Commands\n\n### Read Operations\n\n- `cf schema-validation schemas get <schemaId>` — Gets the contents and metadata of a specific OpenAPI schema uploaded to API Shield.\n- `cf schema-validation schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone.\n- `cf schema-validation schemas list` — Lists all OpenAPI schemas uploaded to API Shield with pagination support.\n- `cf schema-validation schemas operations get <schemaId>` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n- `cf schema-validation settings get` — Retrieves the current global schema validation settings for a zone.\n- `cf schema-validation settings operations get <operationId>` — Retrieves the schema validation settings configured for a specific API operation.\n- `cf schema-validation settings operations list` — Lists all per-operation schema validation settings configured for the zone.\n\n### Create Operations\n\n- `cf schema-validation schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf schema-validation schemas edit <schemaId>` — Modifies an existing OpenAPI schema in API Shield, updating the validation rules for associated API operations. (supports --dry-run, --body)\n- `cf schema-validation settings edit` — Partially updates global schema validation settings for a zone using PATCH semantics. (supports --dry-run, --body)\n- `cf schema-validation settings operations update <operationId>` — Fully updates schema validation settings for a specific API operation. (supports --dry-run, --body)\n- `cf schema-validation settings update` — Fully updates global schema validation settings for a zone, replacing existing configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf schema-validation schemas delete <schemaId>` — Permanently removes an uploaded OpenAPI schema from API Shield. Operations using this schema will lose their validation rules. (supports --dry-run)\n- `cf schema-validation settings operations delete <operationId>` — Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults. (supports --dry-run)\n\n### Other Operations\n\n- `cf schema-validation settings operations bulk-edit` — Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scim": "# scim — SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account\n\n## Commands\n\n### Read Operations\n\n- `cf scim groups get <groupId>` — Retrieves a single SCIM Group resource by group ID.\n- `cf scim groups list` — Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.\n- `cf scim resource-types get <resourceTypeId>` — Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.\n- `cf scim resource-types list` — Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.\n- `cf scim schemas get <schemaId>` — Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.\n- `cf scim schemas list` — Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.\n- `cf scim service-provider-config get` — Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.\n- `cf scim users get <userId>` — Retrieves a single account member as a SCIM User resource by user tag.\n- `cf scim users list` — Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq \"user@example.com\"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.\n\n### Create Operations\n\n- `cf scim groups create` — Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups). (supports --dry-run, --body)\n- `cf scim users create` — Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf scim groups edit <groupId>` — Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported. (supports --dry-run, --body)\n- `cf scim users edit <userId>` — Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq \"work\"].value` is also accepted as an alias for `userName`. (supports --dry-run, --body)\n- `cf scim users update <userId>` — Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf scim groups delete <groupId>` — Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scm": "# scm — Source code management connections — link Git providers, browse repos, create pull requests, and manage grants\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"secrets-store": "# secrets-store — Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products\n\n## Commands\n\n### Read Operations\n\n- `cf secrets-store quota get` — Lists the number of secrets used in the account.\n- `cf secrets-store secrets get <secretId>` — Returns details of a single secret\n- `cf secrets-store secrets list` — Lists all store secrets\n- `cf secrets-store stores list` — Lists all the stores in an account\n- `cf secrets-store system-stores list` — Lists all stores in an account that are managed by the calling service. Only returns stores where managed_by matches the authenticated service.\n- `cf secrets-store system-stores secrets get <secretId>` — Returns details of a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n- `cf secrets-store system-stores secrets list` — Lists all secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n\n### Create Operations\n\n- `cf secrets-store secrets bulk create <storeId>` — Creates a secret in the account (supports --dry-run, --body)\n- `cf secrets-store stores create` — Creates a store in the account (supports --dry-run, --body)\n- `cf secrets-store system-stores create <accountTag>` — Creates a store in the account on behalf of the calling service. The store will be marked as managed by the authenticated service. Requires account_id in the request body. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets create <storeId>` — Creates one or more secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets duplicate create <secretId>` — Duplicates a secret in a store managed by the calling service, keeping the value. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf secrets-store secrets edit <secretId>` — Updates a single secret (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets edit <secretId>` — Updates a single secret in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf secrets-store secrets bulk delete <storeId>` — Deletes one or more secrets (supports --dry-run, --body)\n- `cf secrets-store secrets delete <secretId>` — Deletes a single secret (supports --dry-run)\n- `cf secrets-store stores delete <storeId>` — Deletes a single store (supports --dry-run)\n- `cf secrets-store system-stores delete <storeId>` — Deletes a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n\n### Other Operations\n\n- `cf secrets-store secrets duplicate <secretId>` — Duplicates the secret, keeping the value (supports --dry-run, --body)\n- `cf secrets-store system-stores get by id <storeId>` — Returns details of a single store (supports --dry-run)\n- `cf secrets-store system-stores get v2 <storeId>` — Returns details of a single store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete by id <secretId>` — Deletes a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete system bulk` — Deletes one or more secrets from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -100,8 +100,8 @@
 		"ssl": "# ssl — SSL/TLS certificate management — certificate packs, Universal SSL, verification, and TLS mode recommendations\n\n## Commands\n\n### Read Operations\n\n- `cf ssl automatic-upgrader get` — If the system is enabled, the response will include next_scheduled_scan, representing the next time this zone will be scanned and the zone's ssl/tls encryption mode is potentially upgraded by the system. If the system is disabled, next_scheduled_scan will not be present in the response body.\n- `cf ssl certificate-packs get <certificatePackId>` — For a given zone, get a certificate pack.\n- `cf ssl certificate-packs list` — For a given zone, list all active certificate packs.\n- `cf ssl certificate-packs quota get` — For a given zone, list certificate pack quotas.\n- `cf ssl recommendations get` — Retrieve the SSL/TLS Recommender's recommendation for a zone.\n- `cf ssl universal settings get` — Get Universal SSL Settings for a Zone.\n- `cf ssl verification get` — Get SSL Verification Info for a Zone.\n\n### Create Operations\n\n- `cf ssl analyze create` — Returns the set of hostnames, the signature algorithm, and the expiration date of the certificate. (supports --dry-run, --body)\n- `cf ssl certificate-packs create` — For a given zone, order an advanced certificate pack. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ssl automatic-upgrader patch` — The automatic system is enabled when this endpoint is hit with value in the request body is set to \"auto\", and disabled when the request body value is set to \"custom\". (supports --dry-run, --body)\n- `cf ssl certificate-packs edit <certificatePackId>` — For a given zone, restart validation or add cloudflare branding for an advanced certificate pack. The former is only a validation operation for a Certificate Pack in a validation_timed_out status. (supports --dry-run, --body)\n- `cf ssl universal settings edit` — Patch Universal SSL Settings for a Zone. (supports --dry-run, --body)\n- `cf ssl verification edit <certificatePackId>` — Edit SSL validation method for a certificate pack. A PATCH request will request an immediate validation check on any certificate, and return the updated status. If a validation method is provided, the validation will be immediately attempted using that method. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ssl certificate-packs delete <certificatePackId>` — For a given zone, delete an advanced certificate pack. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"stream": "# stream — Video encoding, storage, and delivery — upload, live-stream, clip, caption, and embed video at scale\n\n## Commands\n\n### Read Operations\n\n- `cf stream audio-tracks get <identifier>` — Lists additional audio tracks on a video. Note this API will not return information for audio attached to the video upload.\n- `cf stream captions get <identifier>` — Lists the available captions or subtitles for a specific video.\n- `cf stream captions language get <language>` — Lists the captions or subtitles for provided language.\n- `cf stream captions language vtt get <language>` — Return WebVTT captions for a provided language.\n- `cf stream downloads get <identifier>` — Lists the downloads created for a video.\n- `cf stream embed get <identifier>` — Fetches an HTML code snippet to embed a video in a web page delivered through Cloudflare. On success, returns an HTML fragment for use on web pages to display a video. On failure, returns a JSON response body.\n- `cf stream get <identifier>` — Fetches details for a single video.\n- `cf stream keys get` — Lists the video ID and creation date and time when a signing key was created.\n- `cf stream list` — Lists up to 1000 videos from a single request. For a specific range, refer to the optional parameters.\n- `cf stream live-inputs get <liveInputIdentifier>` — Retrieves details of an existing live input.\n- `cf stream live-inputs list` — Lists the live inputs created for an account. To get the credentials needed to stream to a specific live input, request a single live input.\n- `cf stream live-inputs outputs list` — Retrieves all outputs associated with a specified live input.\n- `cf stream watermarks get <identifier>` — Retrieves details for a single watermark profile.\n- `cf stream watermarks list` — Lists all watermark profiles for an account.\n- `cf stream webhooks get` — Retrieves a list of webhooks.\n\n### Create Operations\n\n- `cf stream captions language create <language>` — Generate captions or subtitles for provided language via AI. (supports --dry-run)\n- `cf stream clip create` — Clips a video based on the specified start and end times provided in seconds. (supports --dry-run, --body)\n- `cf stream copy create` — Uploads a video to Stream from a provided URL. (supports --dry-run, --body)\n- `cf stream create` — Initiates a video upload using the TUS protocol. On success, the server responds with a status code 201 (created) and includes a `location` header to indicate where the content should be uploaded. Refer to https://tus.io for protocol details. (supports --dry-run)\n- `cf stream direct-upload create` — Creates a direct upload that allows video uploads without an API key. (supports --dry-run, --body)\n- `cf stream downloads create <identifier>` — Creates a download for a video when a video is ready to view. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys create` — Creates an RSA private key in PEM and JWK formats. Key files are only displayed once after creation. Keys are created, used, and deleted independently of videos, and every key can sign any video. (supports --dry-run, --body)\n- `cf stream live-inputs create` — Creates a live input, and returns credentials that you or your users can use to stream live video to Cloudflare Stream. (supports --dry-run, --body)\n- `cf stream live-inputs disable create <liveInputIdentifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls until enabled. (supports --dry-run)\n- `cf stream live-inputs enable create <liveInputIdentifier>` — Allows a live input to be streamed to and makes the live input accessible to any future API calls. (supports --dry-run)\n- `cf stream live-inputs outputs create <liveInputIdentifier>` — Creates a new output that can be used to simulcast or restream live video to other RTMP or SRT destinations. Outputs are always linked to a specific live input — one live input can have many outputs. (supports --dry-run, --body)\n- `cf stream token create <identifier>` — Creates a signed URL token for a video. If a body is not provided in the request, a token is created with default values. (supports --dry-run, --body)\n- `cf stream typed-downloads create <downloadType>` — Creates a download for a video of specified type. For backwards-compatibility, POST requests to /downloads will enable the default download. (supports --dry-run)\n- `cf stream watermarks create` — Creates watermark profiles using a single `HTTP POST multipart/form-data` request. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf stream audio-tracks edit <audioIdentifier>` — Edits additional audio tracks on a video. Editing the default status of an audio track to `true` will mark all other audio tracks on the video default status to `false`. (supports --dry-run, --body)\n- `cf stream captions language update <language>` — Uploads the caption or subtitle file to the endpoint for a specific BCP47 language. One caption or subtitle file per language is allowed. (supports --dry-run, --body)\n- `cf stream edit <identifier>` — Edit details for a single video. (supports --dry-run, --body)\n- `cf stream live-inputs outputs update <outputIdentifier>` — Updates the state of an output. (supports --dry-run, --body)\n- `cf stream live-inputs update <liveInputIdentifier>` — Updates a specified live input. (supports --dry-run, --body)\n- `cf stream webhooks update` — Creates a webhook notification. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf stream audio-tracks delete <audioIdentifier>` — Deletes additional audio tracks on a video. Deleting a default audio track is not allowed. You must assign another audio track as default prior to deletion. (supports --dry-run)\n- `cf stream captions language delete <language>` — Removes the captions or subtitles from a video. (supports --dry-run)\n- `cf stream delete <identifier>` — Deletes a video and its copies from Cloudflare Stream. (supports --dry-run)\n- `cf stream downloads delete <identifier>` — Delete the downloads for a video. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys delete <identifier>` — Deletes signing keys and revokes all signed URLs generated with the key. (supports --dry-run, --body)\n- `cf stream live-inputs delete <liveInputIdentifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls. (supports --dry-run, --body)\n- `cf stream live-inputs outputs delete <outputIdentifier>` — Deletes an output and removes it from the associated live input. (supports --dry-run, --body)\n- `cf stream typed-downloads delete <downloadType>` — Delete specific type of download. For backwards-compatibility, DELETE requests to /downloads will delete the default download. (supports --dry-run)\n- `cf stream watermarks delete <identifier>` — Deletes a watermark profile. (supports --dry-run)\n- `cf stream webhooks delete` — Deletes a webhook. (supports --dry-run)\n\n### Other Operations\n\n- `cf stream audio-tracks copy <identifier>` — Adds an additional audio track to a video using the provided audio track URL. (supports --dry-run, --body)\n- `cf stream videos storage-usage` — Returns information about an account's storage use. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tenants": "# tenants — Multi-tenant account management — manage tenant accounts, entitlements, and memberships\n\n## Commands\n\n### Read Operations\n\n- `cf tenants account-types get <tenantId>` — List of account types available for the Tenant to provision accounts.\n- `cf tenants accounts list` — List of accounts for the Tenant.\n- `cf tenants entitlements list` — List of innate entitlements available for the Tenant.\n- `cf tenants get <tenantId>` — Retrieves a Tenant by Tenant ID.\n- `cf tenants memberships list` — List of active members (Cloudflare users) for the Tenant.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"token-validation": "# token-validation — Validate JWT tokens at the edge — configure token sources, signing keys, and validation rules\n\n## Commands\n\n### Read Operations\n\n- `cf token-validation configuration get` — Get a single Token Configuration\n- `cf token-validation configuration list` — Lists all token validation configurations for this zone\n- `cf token-validation rules get` — Get a zone token validation rule.\n- `cf token-validation rules list` — List token validation rules\n\n### Create Operations\n\n- `cf token-validation configuration create` — Create a new Token Validation configuration (supports --dry-run, --body)\n- `cf token-validation rules create` — Create a token validation rule. (supports --dry-run, --body)\n- `cf token-validation rules preview create` — Preview operations covered by a Token Validation rule. The API will return all operations on a zone annotated with an additional `state` field. Operations with an `included` `state` will be covered by a Token Validation Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf token-validation configuration credentials update` — Update Token Configuration credentials (supports --dry-run, --body)\n- `cf token-validation configuration edit` — Edit fields of an existing Token Configuration (supports --dry-run, --body)\n- `cf token-validation rules edit` — Edit a zone token validation rule. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf token-validation configuration delete` — Delete Token Configuration (supports --dry-run)\n- `cf token-validation rules delete` — Delete a zone token validation rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf token-validation rules bulk-create` — Create zone token validation rules. A request can create multiple Token Validation Rules. (supports --dry-run, --body)\n- `cf token-validation rules bulk-edit` — Edit token validation rules. A request can update multiple Token Validation Rules. Rules can be re-ordered using the `position` field. Returns all updated rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"turnstile": "# turnstile — CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience\n\n## Commands\n\n### Read Operations\n\n- `cf turnstile widgets get` — Show a single challenge widget configuration.\n- `cf turnstile widgets list` — Lists all turnstile widgets of an account.\n\n### Create Operations\n\n- `cf turnstile widgets create` — Lists challenge widgets. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf turnstile widgets update` — Update the configuration of a widget. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf turnstile widgets delete` — Destroy a Turnstile Widget. (supports --dry-run)\n\n### Other Operations\n\n- `cf turnstile widgets rotate-secret` — Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"token-validation": "# token-validation — Validate JWT tokens at the edge — configure token sources, signing keys, and validation rules\n\n## Commands\n\n### Read Operations\n\n- `cf token-validation configuration get <configId>` — Get a single Token Configuration\n- `cf token-validation configuration list` — Lists all token validation configurations for this zone\n- `cf token-validation rules get <ruleId>` — Get a zone token validation rule.\n- `cf token-validation rules list` — List token validation rules\n\n### Create Operations\n\n- `cf token-validation configuration create` — Create a new Token Validation configuration (supports --dry-run, --body)\n- `cf token-validation rules create` — Create a token validation rule. (supports --dry-run, --body)\n- `cf token-validation rules preview create` — Preview operations covered by a Token Validation rule. The API will return all operations on a zone annotated with an additional `state` field. Operations with an `included` `state` will be covered by a Token Validation Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf token-validation configuration credentials update <configId>` — Update Token Configuration credentials (supports --dry-run, --body)\n- `cf token-validation configuration edit <configId>` — Edit fields of an existing Token Configuration (supports --dry-run, --body)\n- `cf token-validation rules edit <ruleId>` — Edit a zone token validation rule. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf token-validation configuration delete <configId>` — Delete Token Configuration (supports --dry-run)\n- `cf token-validation rules delete <ruleId>` — Delete a zone token validation rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf token-validation rules bulk-create` — Create zone token validation rules. A request can create multiple Token Validation Rules. (supports --dry-run, --body)\n- `cf token-validation rules bulk-edit` — Edit token validation rules. A request can update multiple Token Validation Rules. Rules can be re-ordered using the `position` field. Returns all updated rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"turnstile": "# turnstile — CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience\n\n## Commands\n\n### Read Operations\n\n- `cf turnstile widgets get <sitekey>` — Show a single challenge widget configuration.\n- `cf turnstile widgets list` — Lists all turnstile widgets of an account.\n\n### Create Operations\n\n- `cf turnstile widgets create` — Lists challenge widgets. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf turnstile widgets update <sitekey>` — Update the configuration of a widget. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf turnstile widgets delete <sitekey>` — Destroy a Turnstile Widget. (supports --dry-run)\n\n### Other Operations\n\n- `cf turnstile widgets rotate-secret <sitekey>` — Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-normalization": "# url-normalization — Normalize incoming request URLs to a consistent format before rule evaluation and caching\n\n## Commands\n\n### Read Operations\n\n- `cf url-normalization get` — Fetches the current URL Normalization settings.\n\n### Update Operations\n\n- `cf url-normalization update` — Updates the URL Normalization settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf url-normalization delete` — Deletes the URL Normalization settings. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-scanner": "# url-scanner — Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results\n\n## Commands\n\n### Read Operations\n\n- `cf url-scanner responses get <responseId>` — Returns the raw response of the network request. Find the `response_id` in the `data.requests.response.hash`.\n- `cf url-scanner scans get <scanId>` — Get URL scan by uuid\n- `cf url-scanner scans list` — Use a subset of ElasticSearch Query syntax to filter scans. Some example queries:<br/> <br/>- 'path:\"/bundles/jquery.js\"': Searches for scans who requested resources with the given path.<br/>- 'page.asn:AS24940 AND hash:xxx': Websites hosted in AS24940 where a resource with the given hash was downloaded.<br/>- 'page.domain:microsoft* AND verdicts.malicious:true AND NOT page.domain:microsoft.com': malicious scans whose hostname starts with \"microsoft\".<br/>- 'apikey:me AND date:[2025-01 TO 2025-02]': my scans from 2025 January to 2025 February.\n\n### Create Operations\n\n- `cf url-scanner scans create` — Submit a URL to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf url-scanner scans bulk-create` — Submit URLs to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/ and take into account scans submitted in bulk have lower priority and may take longer to finish. (supports --dry-run, --body)\n- `cf url-scanner scans dom <scanId>` — Returns a plain text response, with the scan's DOM content as rendered by Chrome. (supports --dry-run)\n- `cf url-scanner scans har <scanId>` — Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/. (supports --dry-run)\n- `cf url-scanner scans screenshot <scanId>` — Get scan's screenshot by resolution (desktop/mobile/tablet). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"user": "# user — Your Cloudflare user profile, invitations, organizations, billing, and personal API tokens\n\n## Commands\n\n### Read Operations\n\n- `cf user audit-logs list` — Gets a list of audit logs for a user account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n- `cf user billing history list` — Accesses your billing history object.\n- `cf user billing profile get` — Accesses your billing profile object.\n- `cf user firewall access-rules list` — Fetches IP Access rules of the user. You can filter the results using several optional parameters.\n- `cf user get` — Get current user details\n- `cf user load-balancers monitors get <monitorId>` — List a single configured monitor for a user.\n- `cf user load-balancers monitors list` — List configured monitors for a user.\n- `cf user load-balancers monitors references list` — Get the list of resources that reference the provided monitor.\n- `cf user load-balancers pools get <poolId>` — Fetch a single configured pool.\n- `cf user load-balancers pools health get <poolId>` — Fetch the latest pool health status for a single pool.\n- `cf user load-balancers pools list` — List configured pools.\n- `cf user load-balancers pools references list` — Get the list of resources that reference the provided pool.\n- `cf user load-balancers preview get <previewId>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf user load-balancing-analytics events list` — List origin health changes.\n- `cf user subscriptions get` — Lists all of a user's subscriptions.\n- `cf user tenants list` — Retrieves list of tenants the authenticated user / method has access to.\n- `cf user tokens get <tokenId>` — Get information about a specific token.\n- `cf user tokens list` — List all access tokens you created.\n- `cf user tokens permission-groups list` — Find all available permission groups for API Tokens.\n\n### Create Operations\n\n- `cf user firewall access-rules create` — Creates a new IP Access rule for all zones owned by the current user. Note: To create an IP Access rule that applies to a specific zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf user load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers monitors preview create <monitorId>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf user load-balancers pools preview create <poolId>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user tokens create` — Create a new access token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf user edit` — Edit part of your user details. (supports --dry-run, --body)\n- `cf user firewall access-rules edit <ruleId>` — Updates an IP Access rule defined at the user level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n- `cf user load-balancers monitors edit <monitorId>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers monitors update <monitorId>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers pools update <poolId>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf user subscriptions update <identifier>` — Updates a user's subscriptions. (supports --dry-run, --body)\n- `cf user tokens update <tokenId>` — Update an existing token. (supports --dry-run, --body)\n- `cf user tokens value update <tokenId>` — Roll the token secret. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf user firewall access-rules delete <ruleId>` — Deletes an IP Access rule at the user level. Note: Deleting a user-level rule will affect all zones owned by the user. (supports --dry-run, --body)\n- `cf user load-balancers monitors delete <monitorId>` — Delete a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers pools delete <poolId>` — Delete a configured pool. (supports --dry-run, --body)\n- `cf user subscriptions delete <identifier>` — Deletes a user's subscription. (supports --dry-run, --body)\n- `cf user tokens delete <tokenId>` — Destroy a token. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf user load-balancers pools edit pools pool <poolId>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers pools edit pools pools` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n- `cf user tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -114,7 +114,7 @@
 		"workflows": "# workflows — Durable, multi-step workflows that run on Workers with automatic retries and state persistence\n\n## Commands\n\n### Read Operations\n\n- `cf workflows get <workflowName>` — Retrieves configuration and metadata for a specific workflow.\n- `cf workflows instances get <instanceId>` — Retrieves logs and execution status for a specific workflow instance.\n- `cf workflows instances list` — Lists all instances of a workflow with their execution status.\n- `cf workflows list` — Lists all workflows configured for the account.\n- `cf workflows versions get <versionId>` — Retrieves details for a specific deployed workflow version.\n- `cf workflows versions list` — Lists all deployed versions of a workflow.\n\n### Create Operations\n\n- `cf workflows instances create <workflowName>` — Creates a new instance of a workflow, starting its execution. (supports --dry-run, --body)\n- `cf workflows instances events create <eventType>` — Sends an event to a running workflow instance to trigger state transitions. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workflows instances status edit <instanceId>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows update <workflowName>` — Creates a new workflow or updates an existing workflow definition. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workflows delete <workflowName>` — Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it. (supports --dry-run)\n\n### Other Operations\n\n- `cf workflows instances batch-terminate <workflowName>` — Terminates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances bulk` — Creates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances status-terminate <workflowName>` — Gets the status of a bulk workflow instance termination job. (supports --dry-run)\n- `cf workflows versions dag <versionId>` — Retrieves the directed acyclic graph (DAG) representation of a workflow version. (supports --dry-run)\n- `cf workflows versions graph <versionId>` — Retrieves the graph visualization of a workflow version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zaraz": "# zaraz — Server-side tag manager — load third-party tools (analytics, pixels, etc.) from Cloudflare's edge without client-side JS\n\n## Commands\n\n### Read Operations\n\n- `cf zaraz config get` — Gets latest Zaraz configuration for a zone. It can be preview or published configuration, whichever was the last updated. Secret variables values will not be included.\n- `cf zaraz default get` — Gets default Zaraz configuration for a zone.\n- `cf zaraz export get` — Exports full current published Zaraz configuration for a zone, secret variables included.\n- `cf zaraz history configs get` — Gets a history of published Zaraz configurations by ID(s) for a zone.\n- `cf zaraz history list` — Lists a history of published Zaraz configuration records for a zone.\n- `cf zaraz workflow get` — Gets Zaraz workflow for a zone.\n\n### Create Operations\n\n- `cf zaraz publish create` — Publish current Zaraz preview configuration for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zaraz config update` — Updates Zaraz configuration for a zone. (supports --dry-run, --body)\n- `cf zaraz history update` — Restores a historical published Zaraz configuration by ID for a zone. (supports --dry-run, --body)\n- `cf zaraz update` — Updates Zaraz workflow for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zero-trust": "# zero-trust — Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation\n\n## Commands\n\n### Read Operations\n\n- `cf zero-trust access ai-controls mcp portals list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access ai-controls mcp servers list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access applications cas get <appId>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust access applications cas list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust access applications get <appId>` — Fetches information about an Access application.\n- `cf zero-trust access applications list` — Lists all Access applications in an account.\n- `cf zero-trust access applications policies get <policyId>` — Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.\n- `cf zero-trust access applications policies list` — Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.\n- `cf zero-trust access applications policy-tests get <policyTestId>` — Fetches the current status of a given Access policy test.\n- `cf zero-trust access applications policy-tests users list` — Fetches a single page of user results from an Access policy test.\n- `cf zero-trust access applications user-policy-checks list` — Tests if a specific user has permission to access an application.\n- `cf zero-trust access bookmarks get <bookmarkId>` — Fetches a single Bookmark application.\n- `cf zero-trust access bookmarks list` — Lists Bookmark applications.\n- `cf zero-trust access certificates get <certificateId>` — Fetches a single mTLS certificate.\n- `cf zero-trust access certificates list` — Lists all mTLS root certificates.\n- `cf zero-trust access certificates settings get` — List all mTLS hostname settings for this account.\n- `cf zero-trust access custom-pages get <customPageId>` — Fetches a custom page and also returns its HTML.\n- `cf zero-trust access custom-pages list` — List custom pages\n- `cf zero-trust access gateway-ca list` — Lists SSH Certificate Authorities (CA).\n- `cf zero-trust access groups get <groupId>` — Fetches a single Access group.\n- `cf zero-trust access groups list` — Lists all Access groups.\n- `cf zero-trust access infrastructure targets get <targetId>` — Retrieves details for a specific infrastructure access target, including its hostname, IP, and access configuration.\n- `cf zero-trust access infrastructure targets list` — Lists and sorts an account’s targets. Filters are optional and are ANDed together.\n- `cf zero-trust access keys get` — Gets the Access key rotation settings for an account.\n- `cf zero-trust access logs access-requests list` — Gets a list of Access authentication audit logs for an account.\n- `cf zero-trust access logs scim updates list` — Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust access policies get <policyId>` — Fetches a single Access reusable policy.\n- `cf zero-trust access policies list` — Lists Access reusable policies.\n- `cf zero-trust access service-tokens get <serviceTokenId>` — Fetches a single service token.\n- `cf zero-trust access service-tokens list` — Lists all service tokens.\n- `cf zero-trust access tags get <tagName>` — Get a tag\n- `cf zero-trust access tags list` — List tags\n- `cf zero-trust access users active-sessions get <nonce>` — Get an active session for a single user.\n- `cf zero-trust access users active-sessions list` — Get active sessions for a single user.\n- `cf zero-trust access users failed-logins list` — Get all failed login attempts for a single user.\n- `cf zero-trust access users get <userId>` — Gets a specific user for an account.\n- `cf zero-trust access users last-seen-identity get <userId>` — Get last seen identity for a single user.\n- `cf zero-trust access users list` — Gets a list of users for an account.\n- `cf zero-trust apps ca get <appId>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust apps ca list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust apps get <appId>` — Fetches information about an Access application.\n- `cf zero-trust apps list` — List all Access Applications in a zone.\n- `cf zero-trust apps policies get <policyId>` — Fetches a single Access policy.\n- `cf zero-trust apps policies list` — Lists Access policies configured for an application.\n- `cf zero-trust apps review status list` — Retrieve the statuses of your applications.\n- `cf zero-trust apps user policy checks get <appId>` — Tests if a specific user has permission to access an application.\n- `cf zero-trust certificates get <certificateId>` — Fetches a single mTLS certificate.\n- `cf zero-trust certificates list` — Lists all mTLS certificates.\n- `cf zero-trust certificates settings list` — List all mTLS hostname settings for this zone.\n- `cf zero-trust connectivity-settings get` — Gets the Zero Trust Connectivity Settings for the given account.\n- `cf zero-trust devices client target environments list` — Retrieves a list of all available target environments with their display names. This endpoint is in Beta.\n- `cf zero-trust devices client versions list` — Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups get <groupId>` — Fetches a single deployment group by its ID. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups list` — Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.\n- `cf zero-trust devices devices get <deviceId>` — Fetches a single WARP device.\n- `cf zero-trust devices devices list` — Lists WARP devices.\n- `cf zero-trust devices dex-tests get <dexTestId>` — Fetch a single DEX test.\n- `cf zero-trust devices dex-tests list` — Fetch all DEX tests\n- `cf zero-trust devices fleet-status get <deviceId>` — Get the live status of a latest device given device_id from the device_state table\n- `cf zero-trust devices get <deviceId>` — Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}\n- `cf zero-trust devices ip-profiles get <profileId>` — Fetches a single WARP Device IP profile.\n- `cf zero-trust devices ip-profiles list` — Lists WARP Device IP profiles.\n- `cf zero-trust devices list` — List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations\n- `cf zero-trust devices networks get <networkId>` — Fetches details for a single managed network.\n- `cf zero-trust devices networks list` — Fetches a list of managed networks for an account.\n- `cf zero-trust devices override-codes get <registrationId>` — Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.\n- `cf zero-trust devices override-codes list` — Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.\n- `cf zero-trust devices policies custom excludes get <policyId>` — Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom fallback-domains get <policyId>` — Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies custom get <policyId>` — Fetches a device settings profile by ID.\n- `cf zero-trust devices policies custom includes get <policyId>` — Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom list` — Fetches a list of the device settings profiles for an account.\n- `cf zero-trust devices policies default certificates get` — Fetches device certificate provisioning.\n- `cf zero-trust devices policies default excludes get` — Fetches the list of routes excluded from the WARP client's tunnel.\n- `cf zero-trust devices policies default fallback-domains get` — Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies default get` — Fetches the default device settings profile for an account.\n- `cf zero-trust devices policies default includes get` — Fetches the list of routes included in the WARP client's tunnel.\n- `cf zero-trust devices posture get <ruleId>` — Fetches a single device posture rule.\n- `cf zero-trust devices posture integrations get <integrationId>` — Fetches details for a single device posture integration.\n- `cf zero-trust devices posture integrations list` — Fetches the list of device posture integrations for an account.\n- `cf zero-trust devices posture list` — Fetches device posture rules for a Zero Trust account.\n- `cf zero-trust devices registrations get <registrationId>` — Fetches a single WARP registration.\n- `cf zero-trust devices registrations list` — Lists WARP registrations.\n- `cf zero-trust devices resilience global-warp-override get` — Fetch the Global WARP override state.\n- `cf zero-trust devices settings get` — Describes the current device settings for a Zero Trust account.\n- `cf zero-trust dex colos list` — List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.\n- `cf zero-trust dex commands devices list` — List devices with WARP client support for remote captures which have been connected in the last 1 hour.\n- `cf zero-trust dex commands downloads get <filename>` — Downloads artifacts for an executed command. Bulk downloads are not supported\n- `cf zero-trust dex commands list` — Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters\n- `cf zero-trust dex commands quota get` — Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset\n- `cf zero-trust dex fleet-status devices list` — List details for devices using WARP\n- `cf zero-trust dex http-tests get <testId>` — Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex http-tests percentiles get <testId>` — Get percentiles for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex rules get <ruleId>` — Get details for a DEX Rule\n- `cf zero-trust dex rules list` — List DEX Rules\n- `cf zero-trust dex tests list` — List DEX tests with overview metrics\n- `cf zero-trust dex tests unique-devices list` — Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.\n- `cf zero-trust dex traceroute-test-results network-path get <testResultId>` — Get a breakdown of hops and performance metrics for a specific traceroute test run\n- `cf zero-trust dex traceroute-tests get <testId>` — Get test details and aggregate performance metrics for an traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex warp-change-events get` — List WARP configuration and enablement toggle change events by device.\n- `cf zero-trust dlp datasets get <datasetId>` — Retrieves detailed information about a specific DLP dataset, including its type, status, and entry count.\n- `cf zero-trust dlp datasets list` — Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.\n- `cf zero-trust dlp email account-mapping get` — Retrieves the email provider mapping configuration for DLP email scanning.\n- `cf zero-trust dlp email rules get <ruleId>` — Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.\n- `cf zero-trust dlp email rules list` — Lists all email scanner rules for an account.\n- `cf zero-trust dlp entries custom get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries custom list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries integration get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries integration list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries predefined get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries predefined list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp limits list` — Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.\n- `cf zero-trust dlp payload-logs get` — Gets the current payload logging configuration for DLP, showing whether matched content is being logged.\n- `cf zero-trust dlp profiles custom get <profileId>` — Fetches a custom DLP profile by id.\n- `cf zero-trust dlp profiles get <profileId>` — Fetches a DLP profile by ID.\n- `cf zero-trust dlp profiles list` — Lists all DLP profiles in an account.\n- `cf zero-trust dlp profiles predefined get <profileId>` — This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.\n- `cf zero-trust gateway app-types list` — List all application and application type mappings.\n- `cf zero-trust gateway audit-ssh-settings get` — Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.\n- `cf zero-trust gateway categories list` — List all categories.\n- `cf zero-trust gateway certificates get <certificateId>` — Get a single Zero Trust certificate.\n- `cf zero-trust gateway certificates list` — List all Zero Trust certificates for an account.\n- `cf zero-trust gateway configurations custom-certificate get` — Retrieve the current Zero Trust certificate configuration.\n- `cf zero-trust gateway configurations get` — Retrieve the current Zero Trust account configuration.\n- `cf zero-trust gateway list` — Retrieve information about the current Zero Trust account.\n- `cf zero-trust gateway lists get <listId>` — Fetch a single Zero Trust list.\n- `cf zero-trust gateway lists items list` — Fetch all items in a single Zero Trust list.\n- `cf zero-trust gateway lists list` — Fetch all Zero Trust lists for an account.\n- `cf zero-trust gateway locations get <locationId>` — Get a single Zero Trust Gateway location.\n- `cf zero-trust gateway locations list` — List Zero Trust Gateway locations for an account.\n- `cf zero-trust gateway logging get` — Retrieve the current logging settings for the Zero Trust account.\n- `cf zero-trust gateway pacfiles get <pacfileId>` — Get a single Zero Trust Gateway PAC file.\n- `cf zero-trust gateway pacfiles list` — List all Zero Trust Gateway PAC files for an account.\n- `cf zero-trust gateway proxy-endpoints get <proxyEndpointId>` — Get a single Zero Trust Gateway proxy endpoint.\n- `cf zero-trust gateway proxy-endpoints list` — List all Zero Trust Gateway proxy endpoints for an account.\n- `cf zero-trust gateway rules get <ruleId>` — Get a single Zero Trust Gateway rule.\n- `cf zero-trust gateway rules list` — List Zero Trust Gateway rules for an account.\n- `cf zero-trust groups get <groupId>` — Fetches a single Access group.\n- `cf zero-trust groups list` — Lists all Access groups.\n- `cf zero-trust identity-providers get <identityProviderId>` — Fetches a configured identity provider.\n- `cf zero-trust identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust identity-providers scim groups list` — Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust identity-providers scim users list` — Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust networks hostname-routes get <hostnameRouteId>` — Get a hostname route.\n- `cf zero-trust networks hostname-routes list` — Lists and filters hostname routes in an account.\n- `cf zero-trust networks routes get <routeId>` — Get a private network route in an account.\n- `cf zero-trust networks routes ips get <ip>` — Fetches routes that contain the given IP address.\n- `cf zero-trust networks routes list` — Lists and filters private network routes in an account.\n- `cf zero-trust networks subnets list` — Lists and filters subnets in an account.\n- `cf zero-trust networks subnets warp get <subnetId>` — Get a WARP IP assignment subnet.\n- `cf zero-trust networks virtual-networks get <virtualNetworkId>` — Get a virtual network. (supports --body)\n- `cf zero-trust networks virtual-networks list` — Lists and filters virtual networks in an account.\n- `cf zero-trust organizations doh get` — Returns the DoH settings for your Zero Trust organization.\n- `cf zero-trust organizations list` — Returns the configuration for your Zero Trust organization.\n- `cf zero-trust profiles custom list` — Lists all DLP custom profiles in an account.\n- `cf zero-trust profiles predefined get <profileId>` — Fetches a predefined DLP profile by id.\n- `cf zero-trust risk-scoring behaviours get` — Retrieves configured risk score behaviors that define how user actions affect their overall risk score.\n- `cf zero-trust risk-scoring get <userId>` — Retrieves the detailed risk score breakdown for a specific user, including contributing factors.\n- `cf zero-trust risk-scoring integrations get <integrationId>` — Gets configuration details for a specific Zero Trust risk score integration.\n- `cf zero-trust risk-scoring integrations list` — Lists all configured Zero Trust risk score integrations for the account.\n- `cf zero-trust risk-scoring integrations references get <referenceId>` — Retrieves a Zero Trust risk score integration using its external reference ID.\n- `cf zero-trust risk-scoring summary get` — Gets an aggregate summary of risk scores across the account, including distribution and trends.\n- `cf zero-trust service-tokens get <serviceTokenId>` — Fetches a single service token.\n- `cf zero-trust service-tokens list` — Lists all service tokens.\n- `cf zero-trust settings get` — Get DLP account-level settings.\n- `cf zero-trust tunnels cloudflared configurations get <tunnelId>` — Gets the configuration for a remotely-managed tunnel\n- `cf zero-trust tunnels cloudflared connections get <tunnelId>` — Fetches connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared connectors get <connectorId>` — Fetches connector and connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared get <tunnelId>` — Fetches a single Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared list` — Lists and filters Cloudflare Tunnels in an account.\n- `cf zero-trust tunnels cloudflared token get <tunnelId>` — Gets the token used to associate cloudflared with a specific tunnel.\n- `cf zero-trust tunnels list` — Lists and filters all types of Tunnels in an account.\n- `cf zero-trust tunnels warp-connector connections get <tunnelId>` — Fetches connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector connectors get <connectorId>` — Fetches connector and connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector get <tunnelId>` — Fetches a single Warp Connector Tunnel.\n- `cf zero-trust tunnels warp-connector list` — Lists and filters Warp Connector Tunnels in an account.\n- `cf zero-trust tunnels warp-connector token get <tunnelId>` — Gets the token used to associate warp device with a specific Warp Connector tunnel.\n- `cf zero-trust zone-identity-providers get <identityProviderId>` — Fetches a configured identity provider.\n- `cf zero-trust zone-identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust zone-organizations get` — Returns the configuration for your Zero Trust organization.\n\n### Create Operations\n\n- `cf zero-trust access ai-controls mcp portals create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access applications cas create <appId>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust access applications create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust access applications policies create <appId>` — Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array. (supports --dry-run, --body)\n- `cf zero-trust access applications policy-tests create` — Starts an Access policy test. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks create <bookmarkId>` — Create a new Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages create` — Create a custom page (supports --dry-run, --body)\n- `cf zero-trust access gateway-ca create` — Adds a new SSH Certificate Authority (CA). (supports --dry-run)\n- `cf zero-trust access groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets create` — Creates a new infrastructure access target for secure access through Cloudflare Access. Targets can be servers, databases, or other infrastructure. (supports --dry-run, --body)\n- `cf zero-trust access policies create` — Creates a new Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token. (supports --dry-run, --body)\n- `cf zero-trust access tags create` — Create a tag (supports --dry-run, --body)\n- `cf zero-trust access users create` — Creates a new user. (supports --dry-run, --body)\n- `cf zero-trust apps ca create <appId>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust apps create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust apps policies create <appId>` — Create a new Access policy for an application. (supports --dry-run, --body)\n- `cf zero-trust apps revoke tokens create <appId>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups create` — Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices dex-tests create` — Create a DEX test. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles create` — Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks create` — Creates a new device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom create` — Creates a device settings profile to be applied to certain devices matching the criteria. (supports --dry-run, --body)\n- `cf zero-trust devices posture create` — Creates a new device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations create` — Create a new device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices resilience global-warp-override create` — Sets the Global WARP override state. (supports --dry-run, --body)\n- `cf zero-trust devices revoke create` — Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead. (supports --dry-run, --body)\n- `cf zero-trust devices unrevoke create` — Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead. (supports --dry-run, --body)\n- `cf zero-trust dex commands create` — Initiate commands for up to 10 devices per account (supports --dry-run, --body)\n- `cf zero-trust dex rules create` — Create a DEX Rule (supports --dry-run, --body)\n- `cf zero-trust dlp datasets create` — Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload create <datasetId>` — Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists. (supports --dry-run)\n- `cf zero-trust dlp datasets versions create <version>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets versions entries create <entryId>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. (supports --dry-run, --body)\n- `cf zero-trust dlp email account-mapping create` — Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules create` — Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take. (supports --dry-run, --body)\n- `cf zero-trust dlp entries create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration create` — Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined create` — Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom create` — Creates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined create <profileId>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates create` — Create a new Zero Trust certificate. (supports --dry-run, --body)\n- `cf zero-trust gateway create` — Create a Zero Trust account for an existing Cloudflare account. (supports --dry-run)\n- `cf zero-trust gateway lists create` — Creates a new Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations create` — Create a new Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles create` — Create a new Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints create` — Create a new Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules create` — Create a new Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes create` — Create a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes create` — Routes a private network through a Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks create <ipNetworkEncoded>` — Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp create` — Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not) (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks create` — Adds a new virtual network to an account. (supports --dry-run, --body)\n- `cf zero-trust organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined create` — Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations create` — Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system. (supports --dry-run, --body)\n- `cf zero-trust service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared create` — Creates a new Cloudflare Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared management create <tunnelId>` — Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector create` — Creates a new Warp Connector Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zero-trust access ai-controls mcp portals update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access applications policies update <policyId>` — Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run, --body)\n- `cf zero-trust access applications settings edit <appId>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications settings update <appId>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications update <appId>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks update <bookmarkId>` — Updates a configured Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust access certificates update <certificateId>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages update <customPageId>` — Update a custom page (supports --dry-run, --body)\n- `cf zero-trust access groups update <groupId>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets update <targetId>` — Updates an existing infrastructure access target's configuration, including connection parameters and access policies. (supports --dry-run, --body)\n- `cf zero-trust access keys update` — Updates the Access key rotation settings for an account. (supports --dry-run, --body)\n- `cf zero-trust access policies update <policyId>` — Updates a Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens update <serviceTokenId>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust access tags update <tagName>` — Update a tag (supports --dry-run, --body)\n- `cf zero-trust access users update <userId>` — Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed). (supports --dry-run, --body)\n- `cf zero-trust apps policies make reusable update <policyId>` — Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust apps policies update <policyId>` — Update a configured Access policy. (supports --dry-run, --body)\n- `cf zero-trust apps review status update` — Update the statuses of your applications. (supports --dry-run, --body)\n- `cf zero-trust apps settings edit <appId>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps settings update <appId>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps update <appId>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust certificates update <certificateId>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust connectivity-settings edit` — Updates the Zero Trust Connectivity Settings for the given account. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups update <groupId>` — Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices dex-tests update <dexTestId>` — Update a DEX test. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles update <profileId>` — Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks update <networkId>` — Updates a configured device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom edit <policyId>` — Updates a configured device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom excludes update <policyId>` — Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom fallback-domains update <policyId>` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom includes update <policyId>` — Sets the list of routes included in the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies default certificates edit` — Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session. (supports --dry-run, --body)\n- `cf zero-trust devices policies default edit` — Updates the default device settings profile for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies default excludes update` — Sets the list of routes excluded from the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices policies default fallback-domains update` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. (supports --dry-run, --body)\n- `cf zero-trust devices policies default includes update` — Sets the list of routes included in the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations edit <integrationId>` — Updates a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices posture update <ruleId>` — Updates a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices settings edit` — Patches the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust devices settings update` — Updates the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust dex rules update <ruleId>` — Update a DEX Rule (supports --dry-run, --body)\n- `cf zero-trust dlp datasets update <datasetId>` — Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload edit <version>` — This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules update <ruleId>` — Modifies an existing DLP email scanning rule, updating detection patterns, conditions, or actions. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom update <entryId>` — Updates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp payload-logs update` — Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom update <profileId>` — Updates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined update <profileId>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints update <documentFingerprintId>` — Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents. (supports --dry-run, --body)\n- `cf zero-trust gateway audit-ssh-settings update` — Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations edit` — Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, or `certificate` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations update` — Update the current Zero Trust account configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway lists edit <listId>` — Appends or removes an item from a configured Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway lists update <listId>` — Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations update <locationId>` — Update a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway logging update` — Update logging settings for the current Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles update <pacfileId>` — Update a configured Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints edit <proxyEndpointId>` — Update a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules update <ruleId>` — Update a configured Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups update <groupId>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers update <identityProviderId>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes edit <hostnameRouteId>` — Updates a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes edit <routeId>` — Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks edit <ipNetworkEncoded>` — Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run)\n- `cf zero-trust networks subnets cloudflare-source update <addressFamily>` — Updates the Cloudflare Source subnet of the given address family (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp edit <subnetId>` — Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks edit <virtualNetworkId>` — Updates an existing virtual network. (supports --dry-run, --body)\n- `cf zero-trust organizations doh update` — Updates the DoH settings for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined update <profileId>` — Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring behaviours update` — Updates risk score behavior configurations, defining weights and thresholds for risk calculation. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations update <integrationId>` — Overwrite the reference_id, tenant_url, and active values with the ones provided. (supports --dry-run, --body)\n- `cf zero-trust seats edit` — Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false. (supports --dry-run, --body)\n- `cf zero-trust service-tokens update <serviceTokenId>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust settings edit` — Missing fields keep their existing values. (supports --dry-run, --body)\n- `cf zero-trust settings update` — Missing fields are reset to initial (unconfigured) values. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared configurations update <tunnelId>` — Adds or updates the configuration for a remotely-managed tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared edit <tunnelId>` — Updates an existing Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector edit <tunnelId>` — Updates an existing Warp Connector Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector failover update <tunnelId>` — Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers update <identityProviderId>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zero-trust access ai-controls mcp portals delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access applications cas delete <appId>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust access applications delete <appId>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust access applications policies delete <policyId>` — Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust access bookmarks delete <bookmarkId>` — Deletes a Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates delete <certificateId>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust access custom-pages delete <customPageId>` — Delete a custom page (supports --dry-run)\n- `cf zero-trust access gateway-ca delete <certificateId>` — Deletes an SSH Certificate Authority. (supports --dry-run)\n- `cf zero-trust access groups delete <groupId>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust access infrastructure targets delete <targetId>` — Removes an infrastructure access target. The target will no longer be accessible through Cloudflare Access. (supports --dry-run)\n- `cf zero-trust access policies delete <policyId>` — Deletes an Access reusable policy. (supports --dry-run)\n- `cf zero-trust access service-tokens delete <serviceTokenId>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust access tags delete <tagName>` — Delete a tag (supports --dry-run)\n- `cf zero-trust access users delete <userId>` — Deletes a specific user for an account. This will also revoke any active seats and tokens for the user. (supports --dry-run)\n- `cf zero-trust apps ca delete <appId>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust apps delete <appId>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust apps policies delete <policyId>` — Delete an Access policy. (supports --dry-run)\n- `cf zero-trust certificates delete <certificateId>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust devices deployment groups delete <groupId>` — Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta. (supports --dry-run)\n- `cf zero-trust devices devices delete <deviceId>` — Deletes a WARP device. (supports --dry-run)\n- `cf zero-trust devices dex-tests delete <dexTestId>` — Delete a Device DEX test. Returns the remaining device dex tests for the account. (supports --dry-run)\n- `cf zero-trust devices ip-profiles delete <profileId>` — Delete a WARP Device IP profile. (supports --dry-run)\n- `cf zero-trust devices networks delete <networkId>` — Deletes a device managed network and fetches a list of the remaining device managed networks for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom delete <policyId>` — Deletes a device settings profile and fetches a list of the remaining profiles for an account. (supports --dry-run, --body)\n- `cf zero-trust devices posture delete <ruleId>` — Deletes a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations delete <integrationId>` — Delete a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices registrations delete <registrationId>` — Deletes a WARP registration. (supports --dry-run)\n- `cf zero-trust devices settings delete` — Resets the current device settings for a Zero Trust account. (supports --dry-run)\n- `cf zero-trust dex rules delete <ruleId>` — Delete a DEX Rule (supports --dry-run)\n- `cf zero-trust dlp datasets delete <datasetId>` — This deletes all versions of the dataset. (supports --dry-run)\n- `cf zero-trust dlp email rules delete <ruleId>` — Removes a DLP email scanning rule. The rule will no longer be applied to email messages. (supports --dry-run)\n- `cf zero-trust dlp entries custom delete <entryId>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries delete <entryId>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries integration delete <entryId>` — This is a no-op as integration entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp entries predefined delete <entryId>` — This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp profiles custom delete <profileId>` — Deletes a DLP custom profile. (supports --dry-run)\n- `cf zero-trust dlp profiles predefined delete <profileId>` — This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust document-fingerprints delete <documentFingerprintId>` — Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected. (supports --dry-run)\n- `cf zero-trust gateway certificates delete <certificateId>` — Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it. (supports --dry-run, --body)\n- `cf zero-trust gateway lists delete <listId>` — Deletes a Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations delete <locationId>` — Delete a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles delete <pacfileId>` — Delete a configured Zero Trust Gateway PAC file. (supports --dry-run)\n- `cf zero-trust gateway proxy-endpoints delete <proxyEndpointId>` — Delete a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules delete <ruleId>` — Delete a Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups delete <groupId>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust identity-providers delete <identityProviderId>` — Deletes an identity provider from Access. (supports --dry-run)\n- `cf zero-trust networks hostname-routes delete <hostnameRouteId>` — Delete a hostname route. (supports --dry-run)\n- `cf zero-trust networks routes delete <routeId>` — Deletes a private network route from an account. (supports --dry-run)\n- `cf zero-trust networks routes networks delete <ipNetworkEncoded>` — Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type. (supports --dry-run)\n- `cf zero-trust networks subnets warp delete <subnetId>` — Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result. (supports --dry-run)\n- `cf zero-trust networks virtual-networks delete <virtualNetworkId>` — Deletes an existing virtual network. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations delete <integrationId>` — Removes a Zero Trust risk score integration, disconnecting the external risk signal source. (supports --dry-run)\n- `cf zero-trust service-tokens delete <serviceTokenId>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust settings delete` — Delete (reset) DLP account-level settings to initial values. (supports --dry-run)\n- `cf zero-trust tunnels cloudflared connections delete <tunnelId>` — Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared delete <tunnelId>` — Deletes a Cloudflare Tunnel from an account. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector delete <tunnelId>` — Deletes a Warp Connector Tunnel from an account. (supports --dry-run, --body)\n- `cf zero-trust users mfa authenticators delete <authenticatorId>` — Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization. (supports --dry-run)\n- `cf zero-trust zone-identity-providers delete <identityProviderId>` — Deletes an identity provider from Access. (supports --dry-run)\n\n### Other Operations\n\n- `cf zero-trust access ai-controls mcp portals read <id>` — Retrieves gateway configuration for MCP portals. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers read <id>` — Retrieves gateway configuration for MCP portals. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers sync <id>` — Syncs an MCP server's tool catalog with the portal. (supports --dry-run)\n- `cf zero-trust access applications revoke-tokens <appId>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust access infrastructure targets bulk-delete` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-delete-v2` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-update` — Adds one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access keys rotate` — Perfoms a key rotation for an account. (supports --dry-run)\n- `cf zero-trust access service-tokens refresh <serviceTokenId>` — Refreshes the expiration of a service token. (supports --dry-run)\n- `cf zero-trust access service-tokens rotate <serviceTokenId>` — Generates a new Client Secret for a service token and revokes the old one. (supports --dry-run, --body)\n- `cf zero-trust devices devices revoke <deviceId>` — Revokes all WARP registrations associated with the specified device. (supports --dry-run)\n- `cf zero-trust devices registrations bulk-delete` — Deletes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations revoke` — Revokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations unrevoke` — Unrevokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust dex fleet-status live` — List details for live (up to 60 minutes) devices using WARP (supports --dry-run)\n- `cf zero-trust dex fleet-status over-time` — List details for devices using WARP, up to 7 days (supports --dry-run)\n- `cf zero-trust dex traceroute-tests network-path <testId>` — Get a breakdown of metrics by hop for individual traceroute test runs (supports --dry-run)\n- `cf zero-trust dex traceroute-tests percentiles <testId>` — Get percentiles for a traceroute test for a given time period between 1 hour and 7 days. (supports --dry-run)\n- `cf zero-trust dlp email rules bulk-edit` — Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first. (supports --dry-run, --body)\n- `cf zero-trust dlp patterns validate` — Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create document fingerprints` — Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create v2 <documentFingerprintId>` — Updates metadata for an existing document fingerprint, such as its name or description. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints get document fingerprints <documentFingerprintId>` — Retrieve data about a specific document fingerprint. (supports --dry-run)\n- `cf zero-trust document-fingerprints get fingerprints all` — Lists all document fingerprints configured for DLP scanning in the account. (supports --dry-run)\n- `cf zero-trust gateway audit-ssh-settings rotate-seed` — Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy. (supports --dry-run)\n- `cf zero-trust gateway certificates activate <certificateId>` — Bind a single Zero Trust certificate to the edge. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates deactivate <certificateId>` — Unbind a single Zero Trust certificate from the edge. (supports --dry-run, --body)\n- `cf zero-trust gateway rules list-tenant` — List Zero Trust Gateway rules for the parent account of an account in the MSP configuration. (supports --dry-run)\n- `cf zero-trust gateway rules reset-expiration <ruleId>` — Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`. (supports --dry-run)\n- `cf zero-trust organizations revoke-users` — Revokes a user's access across all applications. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring reset <userId>` — Resets risk scores for specified users, clearing their accumulated risk history. (supports --dry-run)\n- `cf zero-trust zone-organizations revoke-user-create` — Revokes a user's access across all applications. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones environments list` — List zone environments\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Zone Details\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <planIdentifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <settingId>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Create Zone (supports --dry-run, --body)\n- `cf zones environments create` — Create zone environments (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones environments edit` — Partially update zone environments (supports --dry-run, --body)\n- `cf zones environments update` — Upsert zone environments (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <settingId>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run, --body)\n- `cf zones environments delete` — Delete zone environment (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. (supports --dry-run)\n\n### Other Operations\n\n- `cf zones activation-check trigger` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n- `cf zones environments rollback` — Roll back zone environment (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
+		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones environments list` — List zone environments\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Zone Details\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <planIdentifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <settingId>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Create Zone (supports --dry-run, --body)\n- `cf zones environments create` — Create zone environments (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones environments edit` — Partially update zone environments (supports --dry-run, --body)\n- `cf zones environments update` — Upsert zone environments (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <settingId>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run, --body)\n- `cf zones environments delete <environmentId>` — Delete zone environment (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. (supports --dry-run)\n\n### Other Operations\n\n- `cf zones activation-check trigger` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n- `cf zones environments rollback <environmentId>` — Roll back zone environment (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
 	},
 	"universal": "# cf CLI Agent Guide\n\n## Authentication\n- Preferred: Set CLOUDFLARE_API_TOKEN environment variable\n- Alternative: `cf auth login` for OAuth flow\n- Verify: `cf auth whoami`\n\n## Output\n- All output is JSON; pipe through `jq` for transforms\n\n## Safety\n- Always use `--dry-run` before create/update/delete operations\n- Use `--body '{...}'` for complex request payloads\n- Verify zone resolution with `--quiet` disabled\n\n## Context Resolution\n\nAccount ID priority (highest to lowest):\n1. `CLOUDFLARE_ACCOUNT_ID` environment variable\n2. Project config (`.cfrc` walked up from cwd)\n3. User config (`~/.config/cf/config.json`)\n4. Interactive account picker / single-account auto-select\n\nZone priority (highest to lowest):\n1. `--zone` / `-z` flag\n2. `CLOUDFLARE_ZONE_ID` environment variable\n3. Project config (`.cfrc` walked up from cwd)\n4. User config (`~/.config/cf/config.json`)\n\nSet defaults to avoid repeating IDs:\n```bash\ncf context set account-id <id>\ncf context set zone example.com --project\n```\n\n## Introspection\n- `cf schema --list` — list all available API schemas\n- `cf schema dns records create` — get full request/response schema for a command\n- `cf agent-context [product]` — load agent skill files\n- `cf tools` — get MCP tool definitions\n\n## Error Handling\n- Non-zero exit codes indicate errors\n- Error details are in stderr\n- Check `cf auth whoami` if you get 401 errors\n"
 }