cf 0.1.0 → 0.3.0

package/dist/_meta/agent-context.json

@@ -2,119 +2,120 @@
 	"version": "1.0",
 	"generatedAt": "build-time",
 	"products": {
-		"abuse-reports": "# abuse-reports — Submit and track abuse reports for phishing, malware, and other policy violations on Cloudflare-proxied sites\n\n## Commands\n\n### Read Operations\n\n- `cf abuse-reports emails list` — List emails sent to the customer for an abuse report. Returns all successful customer emails sent for the specified abuse report. Does not include emails sent to hosts or submitters.\n- `cf abuse-reports get <reportParam>` — Retrieve the details of an abuse report.\n- `cf abuse-reports list` — List the abuse reports for a given account\n- `cf abuse-reports mitigations list` — List mitigations done to remediate the abuse report.\n\n### Create Operations\n\n- `cf abuse-reports create <reportParam>` — Submit the Abuse Report of a particular type (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf abuse-reports mitigations review <reportId>` — Request a review for mitigations on an account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"accounts": "# accounts — Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account\n\n## Commands\n\n### Read Operations\n\n- `cf accounts account-profile get` — Retrieves the profile information for a specific Cloudflare account, including organization details, settings, and metadata. This endpoint is commonly used to verify account access and retrieve account-level configuration.\n- `cf accounts get` — Get information about a specific account that you are a member of.\n- `cf accounts list` — List all accounts you have ownership or verified access to.\n- `cf accounts logs audit list` — Gets a list of audit logs for an account.\n- `cf accounts members get <memberId>` — Get information about a specific member of an account.\n- `cf accounts members list` — List all members of an account.\n- `cf accounts roles get <roleId>` — Get information about a specific role for an account.\n- `cf accounts roles list` — Get all available roles for an account.\n- `cf accounts subscriptions get` — Lists all of an account's subscriptions.\n- `cf accounts tokens get <tokenId>` — Get information about a specific Account Owned API token.\n- `cf accounts tokens list` — List all Account Owned API tokens created for this account.\n- `cf accounts tokens permission-groups get` — Find all available permission groups for Account Owned API Tokens\n- `cf accounts tokens permission-groups list` — Find all available permission groups for Account Owned API Tokens\n\n### Create Operations\n\n- `cf accounts account-organizations create` — Move an account within an organization hierarchy or an account outside an organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf accounts create` — Create an account (only available for tenant admins at this time) (supports --dry-run, --body)\n- `cf accounts members create` — Add a user to the list of members for this account. (supports --dry-run, --body)\n- `cf accounts subscriptions create` — Creates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens create` — Create a new Account Owned API token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf accounts account-profile update` — Updates the profile information for a Cloudflare account. Allows modification of account-level settings and organizational details. Requires Account Settings Write permission. (supports --dry-run, --body)\n- `cf accounts members update <memberId>` — Modify an account member. (supports --dry-run, --body)\n- `cf accounts subscriptions update <subscriptionIdentifier>` — Updates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens update <tokenId>` — Update an existing token. (supports --dry-run, --body)\n- `cf accounts tokens value update <tokenId>` — Roll the Account Owned API token secret. (supports --dry-run, --body)\n- `cf accounts update` — Update an existing account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf accounts delete` — Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account (supports --dry-run)\n- `cf accounts members delete <memberId>` — Remove a member from an account. (supports --dry-run, --body)\n- `cf accounts subscriptions delete <subscriptionIdentifier>` — Deletes an account's subscription. (supports --dry-run, --body)\n- `cf accounts tokens delete <tokenId>` — Destroy an Account Owned API token. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf accounts applications get applications` — List applications with different filters. (supports --dry-run)\n- `cf accounts applications get by id <id>` — Get application by ID. (supports --dry-run)\n- `cf accounts categories get by id <id>` — Get application category by ID. (supports --dry-run)\n- `cf accounts categories get categories` — List application categories. (supports --dry-run)\n- `cf accounts move` — Batch move a collection of accounts to a specific organization. ⚠️ Not implemented. (supports --dry-run, --body)\n- `cf accounts tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"acm": "# acm — Advanced Certificate Manager — Total TLS auto-issuance and custom origin trust store certificates\n\n## Commands\n\n### Read Operations\n\n- `cf acm custom-trust-store get <customOriginTrustStoreId>` — Retrieves details about a specific certificate in the custom origin trust store, including expiration and subject information.\n- `cf acm custom-trust-store list` — Get Custom Origin Trust Store for a Zone.\n- `cf acm total-tls get` — Get Total TLS Settings for a Zone.\n\n### Create Operations\n\n- `cf acm custom-trust-store create` — Add Custom Origin Trust Store for a Zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf acm total-tls edit` — Set Total TLS Settings or disable the feature for a Zone. (supports --dry-run, --body)\n- `cf acm total-tls update` — Set Total TLS Settings or disable the feature for a Zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf acm custom-trust-store delete <customOriginTrustStoreId>` — Removes a CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"addressing": "# addressing — IP address management — BYOIP prefixes, address maps, regional hostnames, and BGP advertisement control\n\n## Commands\n\n### Read Operations\n\n- `cf addressing address-maps get <addressMapId>` — Show a particular address map owned by the account.\n- `cf addressing address-maps list` — List all address maps owned by the account.\n- `cf addressing leases list` — List all leases owned by the account.\n- `cf addressing loa-documents get <loaDocumentId>` — Download specified LOA document under the account.\n- `cf addressing prefixes advertisement-status get <prefixId>` — View the current advertisement state for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.\n- `cf addressing prefixes bgp-prefixes get <bgpPrefixId>` — Retrieve a single BGP Prefix according to its identifier\n- `cf addressing prefixes bgp-prefixes list` — List all BGP Prefixes within the specified IP Prefix. BGP Prefixes are used to control which specific subnets are advertised to the Internet. It is possible to advertise subnets more specific than an IP Prefix by creating more specific BGP Prefixes.\n- `cf addressing prefixes delegations list` — List all delegations for a given account IP prefix.\n- `cf addressing prefixes get <prefixId>` — List a particular prefix owned by the account.\n- `cf addressing prefixes list` — List all prefixes owned by the account.\n- `cf addressing prefixes service-bindings get <bindingId>` — Fetch a single Service Binding\n- `cf addressing prefixes service-bindings list` — List the Cloudflare services this prefix is currently bound to. Traffic sent to an address within an IP prefix will be routed to the Cloudflare service of the most-specific Service Binding matching the address. **Example:** binding `192.0.2.0/24` to Cloudflare Magic Transit and `192.0.2.1/32` to the Cloudflare CDN would route traffic for `192.0.2.1` to the CDN, and traffic for all other IPs in the prefix to Cloudflare Magic Transit.\n- `cf addressing regional-hostnames get <hostname>` — Fetch the configuration for a specific Regional Hostname, within a zone.\n- `cf addressing regional-hostnames list` — List all Regional Hostnames within a zone.\n- `cf addressing regional-hostnames regions list` — List all Regional Services regions available for use by this account.\n- `cf addressing services list` — Bring-Your-Own IP (BYOIP) prefixes onboarded to Cloudflare must be bound to a service running on the Cloudflare network to enable a Cloudflare product on the IP addresses. This endpoint can be used as a reference of available services on the Cloudflare network, and their service IDs.\n\n### Create Operations\n\n- `cf addressing address-maps create` — Create a new address map under the account. (supports --dry-run, --body)\n- `cf addressing loa-documents create` — Submit LOA document (pdf format) under the account. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes create <prefixId>` — Create a BGP prefix, controlling the BGP advertisement status of a specific subnet. When created, BGP prefixes are initially withdrawn, and can be advertised with the Update BGP Prefix API. (supports --dry-run, --body)\n- `cf addressing prefixes create` — Add a new prefix under the account. (supports --dry-run, --body)\n- `cf addressing prefixes delegations create <prefixId>` — Create a new account delegation for a given IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes service-bindings create <prefixId>` — Creates a new Service Binding, routing traffic to IPs within the given CIDR to a service running on Cloudflare's network. **NOTE:** The first Service Binding created for an IP Prefix must exactly match the IP Prefix's CIDR. Subsequent Service Bindings may be created with a more-specific CIDR. Refer to the [Service Bindings Documentation](https://developers.cloudflare.com/byoip/service-bindings/) for compatibility details. (supports --dry-run, --body)\n- `cf addressing prefixes validate create <prefixId>` — Triggers a new prefix validation. The checks are run asynchronously and include IRR, RPKI, and prefix ownership. (supports --dry-run)\n- `cf addressing regional-hostnames create` — Create a new Regional Hostname entry. Cloudflare will only use data centers that are physically located within the chosen region to decrypt and service HTTPS traffic. Learn more about [Regional Services](https://developers.cloudflare.com/data-localization/regional-services/get-started/). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf addressing address-maps accounts update <addressMapId>` — Add an account as a member of a particular address map. (supports --dry-run, --body)\n- `cf addressing address-maps edit <addressMapId>` — Modify properties of an address map owned by the account. (supports --dry-run, --body)\n- `cf addressing address-maps ips update <ipAddress>` — Add an IP from a prefix owned by the account to a particular address map. (supports --dry-run, --body)\n- `cf addressing address-maps zones update` — Add a zone as a member of a particular address map. (supports --dry-run, --body)\n- `cf addressing prefixes advertisement-status edit <prefixId>` — Advertise or withdraw the BGP route for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes edit <bgpPrefixId>` — Update the properties of a BGP Prefix, such as the on demand advertisement status (advertised or withdrawn). (supports --dry-run, --body)\n- `cf addressing prefixes edit <prefixId>` — Modify the description for a prefix owned by the account. (supports --dry-run, --body)\n- `cf addressing regional-hostnames edit <hostname>` — Update the configuration for a specific Regional Hostname. Only the region_key of a hostname is mutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf addressing address-maps accounts delete <addressMapId>` — Remove an account as a member of a particular address map. (supports --dry-run, --body)\n- `cf addressing address-maps delete <addressMapId>` — Delete a particular address map owned by the account. An Address Map must be disabled before it can be deleted. (supports --dry-run, --body)\n- `cf addressing address-maps ips delete <ipAddress>` — Remove an IP from a particular address map. (supports --dry-run, --body)\n- `cf addressing address-maps zones delete` — Remove a zone as a member of a particular address map. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes delete <bgpPrefixId>` — Delete a BGP Prefix associated with the specified IP Prefix. A BGP Prefix must be withdrawn before it can be deleted. (supports --dry-run)\n- `cf addressing prefixes delegations delete <delegationId>` — Delete an account delegation for a given IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes delete <prefixId>` — Delete an unapproved prefix owned by the account. (supports --dry-run, --body)\n- `cf addressing prefixes service-bindings delete <bindingId>` — Delete a Service Binding (supports --dry-run)\n- `cf addressing regional-hostnames delete <hostname>` — Delete the region configuration for a specific Regional Hostname. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"ai": "# ai — Run inference on Workers AI models — text generation, image classification, embeddings, and more\n\n## Commands\n\n### Read Operations\n\n- `cf ai authors list` — Searches Workers AI models by author or organization name.\n- `cf ai finetunes list` — Lists all fine-tuning jobs created by the account, including status and metrics.\n- `cf ai finetunes public list` — Lists publicly available fine-tuned models that can be used with Workers AI.\n- `cf ai firewall-custom-topics get` — Get the Firewall for AI custom topic categories for a zone.\n- `cf ai models deepgram aura get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura model.\n- `cf ai models deepgram aura-1 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-1 model.\n- `cf ai models deepgram aura-1-internal get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-1-internal model.\n- `cf ai models deepgram aura-2 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2 model.\n- `cf ai models deepgram aura-2-en get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2-en model.\n- `cf ai models deepgram aura-2-es get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2-es model.\n- `cf ai models deepgram flux get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/flux model.\n- `cf ai models deepgram nova-3 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3 model.\n- `cf ai models deepgram nova-3-internal get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3-internal model.\n- `cf ai models deepgram nova-3-ws get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3-ws model.\n- `cf ai models list` — Searches Workers AI models by name or description.\n- `cf ai models pipecat-ai smart-turn-v2 get` — Opens a WebSocket connection to stream inference results from the @cf/pipecat-ai/smart-turn-v2 model.\n- `cf ai models pipecat-ai smart-turn-v3 get` — Opens a WebSocket connection to stream inference results from the @cf/pipecat-ai/smart-turn-v3 model.\n- `cf ai models schema get` — Retrieves the input and output JSON schema definition for a Workers AI model.\n- `cf ai models sven test-pipe-http get` — Opens a WebSocket connection to stream inference results from the @cf/sven/test-pipe-http model.\n- `cf ai models test hello-world-cog get` — Opens a WebSocket connection to stream inference results from the @cf/test/hello-world-cog model.\n- `cf ai settings get` — Get whether Firewall for AI is enabled or disabled for a zone.\n- `cf ai tasks list` — Searches Workers AI models by task type (e.g., text-generation, embeddings).\n\n### Create Operations\n\n- `cf ai finetunes assets create <finetuneId>` — Uploads training data assets for a Workers AI fine-tuning job. (supports --dry-run, --body)\n- `cf ai finetunes create` — Creates a new fine-tuning job for a Workers AI model using custom training data. (supports --dry-run, --body)\n- `cf ai models ai4bharat indictrans2-en-indic-1B create` — Runs inference on the @cf/ai4bharat/indictrans2-en-indic-1B model. (supports --dry-run, --body)\n- `cf ai models ai4bharat nonomni-indictrans2-en-indic-1b create` — Runs inference on the @cf/ai4bharat/nonomni-indictrans2-en-indic-1b model. (supports --dry-run, --body)\n- `cf ai models aisingapore gemma-sea-lion-v4-27b-it create` — Runs inference on the @cf/aisingapore/gemma-sea-lion-v4-27b-it model. (supports --dry-run, --body)\n- `cf ai models baai bge-base-en-v1-5 create` — Runs inference on the @cf/baai/bge-base-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai bge-large-en-v1-5 create` — Runs inference on the @cf/baai/bge-large-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai bge-m3 create` — Runs inference on the @cf/baai/bge-m3 model. (supports --dry-run, --body)\n- `cf ai models baai bge-reranker-base create` — Runs inference on the @cf/baai/bge-reranker-base model. (supports --dry-run, --body)\n- `cf ai models baai bge-small-en-v1-5 create` — Runs inference on the @cf/baai/bge-small-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-base-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-base-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-large-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-large-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-m3 create` — Runs inference on the @cf/baai/nonomni-bge-m3 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-small-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-small-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-1-schnell create` — Runs inference on the @cf/black-forest-labs/flux-1-schnell model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-dev create` — Runs inference on the @cf/black-forest-labs/flux-2-dev model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-klein-4b create` — Runs inference on the @cf/black-forest-labs/flux-2-klein-4b model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-klein-9b create` — Runs inference on the @cf/black-forest-labs/flux-2-klein-9b model. (supports --dry-run, --body)\n- `cf ai models bytedance stable-diffusion-xl-lightning create` — Runs inference on the @cf/bytedance/stable-diffusion-xl-lightning model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-1 create` — Runs inference on the @cf/deepgram/aura-1 model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-2-en create` — Runs inference on the @cf/deepgram/aura-2-en model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-2-es create` — Runs inference on the @cf/deepgram/aura-2-es model. (supports --dry-run, --body)\n- `cf ai models deepgram flux create` — Runs inference on the @cf/deepgram/flux model. (supports --dry-run, --body)\n- `cf ai models deepgram nova-3 create` — Runs inference on the @cf/deepgram/nova-3 model. (supports --dry-run, --body)\n- `cf ai models deepseek-ai deepseek-math-7b-instruct create` — Runs inference on the @cf/deepseek-ai/deepseek-math-7b-instruct model. (supports --dry-run, --body)\n- `cf ai models deepseek-ai deepseek-r1-distill-qwen-32b create` — Runs inference on the @cf/deepseek-ai/deepseek-r1-distill-qwen-32b model. (supports --dry-run, --body)\n- `cf ai models defog sqlcoder-7b-2 create` — Runs inference on the @cf/defog/sqlcoder-7b-2 model. (supports --dry-run, --body)\n- `cf ai models facebook bart-large-cnn create` — Runs inference on the @cf/facebook/bart-large-cnn model. (supports --dry-run, --body)\n- `cf ai models facebook nonomni-bart-large-cnn create` — Runs inference on the @cf/facebook/nonomni-bart-large-cnn model. (supports --dry-run, --body)\n- `cf ai models facebook nonomni-detr-resnet-50 create` — Runs inference on the @cf/facebook/nonomni-detr-resnet-50 model. (supports --dry-run, --body)\n- `cf ai models fblgit una-cybertron-7b-v2-bf16 create` — Runs inference on the @cf/fblgit/una-cybertron-7b-v2-bf16 model. (supports --dry-run, --body)\n- `cf ai models google embeddinggemma-300m create` — Runs inference on the @cf/google/embeddinggemma-300m model. (supports --dry-run, --body)\n- `cf ai models google gemma-2b-it-lora create` — Runs inference on the @cf/google/gemma-2b-it-lora model. (supports --dry-run, --body)\n- `cf ai models google gemma-3-12b-it create` — Runs inference on the @cf/google/gemma-3-12b-it model. (supports --dry-run, --body)\n- `cf ai models google gemma-7b-it create` — Runs inference on the @hf/google/gemma-7b-it model. (supports --dry-run, --body)\n- `cf ai models google gemma-7b-it-lora create` — Runs inference on the @cf/google/gemma-7b-it-lora model. (supports --dry-run, --body)\n- `cf ai models google nonomni-embeddinggemma-300m create` — Runs inference on the @cf/google/nonomni-embeddinggemma-300m model. (supports --dry-run, --body)\n- `cf ai models huggingface distilbert-sst-2-int8 create` — Runs inference on the @cf/huggingface/distilbert-sst-2-int8 model. (supports --dry-run, --body)\n- `cf ai models huggingface nonomni-distilbert-sst-2-int8 create` — Runs inference on the @cf/huggingface/nonomni-distilbert-sst-2-int8 model. (supports --dry-run, --body)\n- `cf ai models ibm granite-granite-4-0-h-micro create` — Runs inference on the @cf/ibm-granite/granite-4.0-h-micro model. (supports --dry-run, --body)\n- `cf ai models leonardo lucid-origin create` — Runs inference on the @cf/leonardo/lucid-origin model. (supports --dry-run, --body)\n- `cf ai models leonardo phoenix-1-0 create` — Runs inference on the @cf/leonardo/phoenix-1.0 model. (supports --dry-run, --body)\n- `cf ai models lykon dreamshaper-8-lcm create` — Runs inference on the @cf/lykon/dreamshaper-8-lcm model. (supports --dry-run, --body)\n- `cf ai models meta llama-2-7b-chat-fp16 create` — Runs inference on the @cf/meta/llama-2-7b-chat-fp16 model. (supports --dry-run, --body)\n- `cf ai models meta llama-2-7b-chat-int8 create` — Runs inference on the @cf/meta/llama-2-7b-chat-int8 model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-70b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.1-70b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-awq create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-fp8 create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-fp8 model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-11b-vision-instruct create` — Runs inference on the @cf/meta/llama-3.2-11b-vision-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-1b-instruct create` — Runs inference on the @cf/meta/llama-3.2-1b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-3b-instruct create` — Runs inference on the @cf/meta/llama-3.2-3b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-3-70b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.3-70b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-8b-instruct create` — Runs inference on the @cf/meta/llama-3-8b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-8b-instruct-awq create` — Runs inference on the @cf/meta/llama-3-8b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models meta llama-4-scout-17b-16e-instruct create` — Runs inference on the @cf/meta/llama-4-scout-17b-16e-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-guard-3-8b create` — Runs inference on the @cf/meta/llama-guard-3-8b model. (supports --dry-run, --body)\n- `cf ai models meta llama-llama-2-7b-chat-hf-lora create` — Runs inference on the @cf/meta-llama/llama-2-7b-chat-hf-lora model. (supports --dry-run, --body)\n- `cf ai models meta m2m100-1-2b create` — Runs inference on the @cf/meta/m2m100-1.2b model. (supports --dry-run, --body)\n- `cf ai models microsoft nonomni-resnet-50 create` — Runs inference on the @cf/microsoft/nonomni-resnet-50 model. (supports --dry-run, --body)\n- `cf ai models microsoft phi-2 create` — Runs inference on the @cf/microsoft/phi-2 model. (supports --dry-run, --body)\n- `cf ai models microsoft resnet-50 create` — Runs inference on the @cf/microsoft/resnet-50 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-1 create` — Runs inference on the @cf/mistral/mistral-7b-instruct-v0.1 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-2 create` — Runs inference on the @hf/mistral/mistral-7b-instruct-v0.2 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-2-lora create` — Runs inference on the @cf/mistral/mistral-7b-instruct-v0.2-lora model. (supports --dry-run, --body)\n- `cf ai models mistralai mistral-small-3-1-24b-instruct create` — Runs inference on the @cf/mistralai/mistral-small-3.1-24b-instruct model. (supports --dry-run, --body)\n- `cf ai models moonshotai kimi-k2-5 create` — Runs inference on the @cf/moonshotai/kimi-k2.5 model. (supports --dry-run, --body)\n- `cf ai models myshell-ai melotts create` — Runs inference on the @cf/myshell-ai/melotts model. (supports --dry-run, --body)\n- `cf ai models nexusflow starling-lm-7b-beta create` — Runs inference on the @hf/nexusflow/starling-lm-7b-beta model. (supports --dry-run, --body)\n- `cf ai models nousresearch hermes-2-pro-mistral-7b create` — Runs inference on the @hf/nousresearch/hermes-2-pro-mistral-7b model. (supports --dry-run, --body)\n- `cf ai models nvidia nemotron-3-120b-a12b create` — Runs inference on the @cf/nvidia/nemotron-3-120b-a12b model. (supports --dry-run, --body)\n- `cf ai models openai gpt-oss-120b create` — Runs inference on the @cf/openai/gpt-oss-120b model. (supports --dry-run, --body)\n- `cf ai models openai gpt-oss-20b create` — Runs inference on the @cf/openai/gpt-oss-20b model. (supports --dry-run, --body)\n- `cf ai models openai whisper create` — Runs inference on the @cf/openai/whisper model. (supports --dry-run, --body)\n- `cf ai models openai whisper-large-v3-turbo create` — Runs inference on the @cf/openai/whisper-large-v3-turbo model. (supports --dry-run, --body)\n- `cf ai models openai whisper-tiny-en create` — Runs inference on the @cf/openai/whisper-tiny-en model. (supports --dry-run, --body)\n- `cf ai models openchat openchat-3-5-0106 create` — Runs inference on the @cf/openchat/openchat-3.5-0106 model. (supports --dry-run, --body)\n- `cf ai models pfnet plamo-embedding-1b create` — Runs inference on the @cf/pfnet/plamo-embedding-1b model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-0-5b-chat create` — Runs inference on the @cf/qwen/qwen1.5-0.5b-chat model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-1-8b-chat create` — Runs inference on the @cf/qwen/qwen1.5-1.8b-chat model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-14b-chat-awq create` — Runs inference on the @cf/qwen/qwen1.5-14b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-7b-chat-awq create` — Runs inference on the @cf/qwen/qwen1.5-7b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models qwen qwen2-5-coder-32b-instruct create` — Runs inference on the @cf/qwen/qwen2.5-coder-32b-instruct model. (supports --dry-run, --body)\n- `cf ai models qwen qwen3-30b-a3b-fp8 create` — Runs inference on the @cf/qwen/qwen3-30b-a3b-fp8 model. (supports --dry-run, --body)\n- `cf ai models qwen qwen3-embedding-0-6b create` — Runs inference on the @cf/qwen/qwen3-embedding-0.6b model. (supports --dry-run, --body)\n- `cf ai models qwen qwq-32b create` — Runs inference on the @cf/qwen/qwq-32b model. (supports --dry-run, --body)\n- `cf ai models runwayml stable-diffusion-v1-5-img2img create` — Runs inference on the @cf/runwayml/stable-diffusion-v1-5-img2img model. (supports --dry-run, --body)\n- `cf ai models runwayml stable-diffusion-v1-5-inpainting create` — Runs inference on the @cf/runwayml/stable-diffusion-v1-5-inpainting model. (supports --dry-run, --body)\n- `cf ai models stabilityai stable-diffusion-xl-base-1-0 create` — Runs inference on the @cf/stabilityai/stable-diffusion-xl-base-1.0 model. (supports --dry-run, --body)\n- `cf ai models thebloke deepseek-coder-6-7b-base-awq create` — Runs inference on the @hf/thebloke/deepseek-coder-6.7b-base-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke deepseek-coder-6-7b-instruct-awq create` — Runs inference on the @hf/thebloke/deepseek-coder-6.7b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke discolm-german-7b-v1-awq create` — Runs inference on the @cf/thebloke/discolm-german-7b-v1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke llama-2-13b-chat-awq create` — Runs inference on the @hf/thebloke/llama-2-13b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke mistral-7b-instruct-v0-1-awq create` — Runs inference on the @hf/thebloke/mistral-7b-instruct-v0.1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke neural-chat-7b-v3-1-awq create` — Runs inference on the @hf/thebloke/neural-chat-7b-v3-1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke openhermes-2-5-mistral-7b-awq create` — Runs inference on the @hf/thebloke/openhermes-2.5-mistral-7b-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke zephyr-7b-beta-awq create` — Runs inference on the @hf/thebloke/zephyr-7b-beta-awq model. (supports --dry-run, --body)\n- `cf ai models tiiuae falcon-7b-instruct create` — Runs inference on the @cf/tiiuae/falcon-7b-instruct model. (supports --dry-run, --body)\n- `cf ai models tinyllama tinyllama-1-1b-chat-v1-0 create` — Runs inference on the @cf/tinyllama/tinyllama-1.1b-chat-v1.0 model. (supports --dry-run, --body)\n- `cf ai models zai-org glm-4-7-flash create` — Runs inference on the @cf/zai-org/glm-4.7-flash model. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai firewall-custom-topics update` — Set the Firewall for AI custom topic categories for a zone. A maximum of 20 custom topics can be configured per zone. Each topic label must be 2–20 characters using only lowercase letters (a–z), digits (0–9), and hyphens. Each topic description must be 2–50 printable ASCII characters. Changes can take up to a minute to propagate to the zone. (supports --dry-run, --body)\n- `cf ai settings update` — Enable or disable Firewall for AI for a zone. Changes can take up to a minute to propagate to the zone. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf ai run <modelName>` — This endpoint provides users with the capability to run specific AI models on-demand. By submitting the required input data, users can receive real-time predictions or results generated by the chosen AI model. The endpoint supports various AI model types, ensuring flexibility and adaptability for diverse use cases. Model specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/). (supports --dry-run, --body)\n- `cf ai to-markdown supported` — Lists all file formats supported for conversion to Markdown. (supports --dry-run)\n- `cf ai to-markdown transform` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"ai-gateway": "# ai-gateway — Proxy, cache, rate-limit, and observe requests to AI providers — OpenAI, Anthropic, Workers AI, and more\n\n## Commands\n\n### Read Operations\n\n- `cf ai-gateway datasets get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway datasets list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway dynamic-routing get <id>` — Get an AI Gateway Dynamic Route.\n- `cf ai-gateway dynamic-routing list` — List all AI Gateway Dynamic Routes.\n- `cf ai-gateway evaluation-types list` — Lists all available evaluator types for scoring AI gateway responses.\n- `cf ai-gateway evaluations get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway evaluations list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway logs get <id>` — Retrieves detailed information for a specific AI Gateway log entry.\n- `cf ai-gateway logs list` — Lists request/response log entries for the AI gateway with filtering and pagination.\n- `cf ai-gateway provider-configs list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway urls get <provider>` — Retrieves the endpoint URL for an AI Gateway.\n\n### Create Operations\n\n- `cf ai-gateway create` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway datasets create <gatewayId>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create <gatewayId>` — Create a new AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway evaluations create <gatewayId>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway provider-configs create <gatewayId>` — Creates a new AI Gateway. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-gateway datasets update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing update <id>` — Update an AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway logs edit <id>` — Updates metadata for an AI Gateway log entry. (supports --dry-run, --body)\n- `cf ai-gateway provider-configs update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-gateway datasets delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway dynamic-routing delete <id>` — Delete an AI Gateway Dynamic Route. (supports --dry-run)\n- `cf ai-gateway evaluations delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway logs delete <gatewayId>` — Deletes gateway log entries matching the specified criteria. (supports --dry-run)\n- `cf ai-gateway provider-configs delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-gateway dynamic-routing create-deployment <id>` — Create a new AI Gateway Dynamic Route Deployment. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create-version <id>` — Create a new AI Gateway Dynamic Route Version. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing get-version <versionId>` — Get an AI Gateway Dynamic Route Version. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-deployments <id>` — List all AI Gateway Dynamic Route Deployments. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-versions <id>` — List all AI Gateway Dynamic Route Versions. (supports --dry-run)\n- `cf ai-gateway logs request <id>` — Retrieves the original request payload for an AI Gateway log entry. (supports --dry-run)\n- `cf ai-gateway logs response <id>` — Retrieves the response payload for an AI Gateway log entry. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"ai-search": "# ai-search — Managed search-as-a-service — crawl, index, and query content with AI-powered relevance and chat completions\n\n## Commands\n\n### Read Operations\n\n- `cf ai-search jobs get <jobId>` — Retrieves details for a specific AI Search indexing job.\n- `cf ai-search jobs list` — Lists indexing jobs for an AI Search instance.\n- `cf ai-search list` — List instances.\n- `cf ai-search namespaces get <name>` — Read namespace.\n- `cf ai-search namespaces instances get <id>` — Read instances.\n- `cf ai-search namespaces instances items chunks list` — Lists chunks for a specific item in an AI Search instance, including their text content.\n- `cf ai-search namespaces instances items content get <itemId>` — Downloads the raw file content for a specific item from the managed AI Search instance storage.\n- `cf ai-search namespaces instances items get <itemId>` — Retrieves a specific indexed item from an AI Search instance.\n- `cf ai-search namespaces instances items list` — Lists indexed items in an AI Search instance.\n- `cf ai-search namespaces instances jobs get <jobId>` — Retrieves details for a specific AI Search indexing job.\n- `cf ai-search namespaces instances jobs list` — Lists indexing jobs for an AI Search instance.\n- `cf ai-search namespaces instances list` — List instances.\n- `cf ai-search namespaces list` — List namespaces.\n- `cf ai-search tokens list` — List tokens.\n\n### Create Operations\n\n- `cf ai-search create` — Create a new instances. (supports --dry-run, --body)\n- `cf ai-search jobs create <id>` — Creates a new indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search namespaces create` — Create a new namespace. (supports --dry-run, --body)\n- `cf ai-search namespaces instances create <name>` — Create a new instances. (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs create <id>` — Creates a new indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search tokens create` — Create a new token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-search jobs edit <jobId>` — Updates the status of an AI Search indexing job. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items create or update <id>` — Creates or updates an indexed item in an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs edit <jobId>` — Updates the status of an AI Search indexing job. (supports --dry-run, --body)\n- `cf ai-search namespaces instances update <id>` — Update instances. (supports --dry-run, --body)\n- `cf ai-search namespaces update <name>` — Update namespace. (supports --dry-run, --body)\n- `cf ai-search tokens update <id>` — Update token. (supports --dry-run, --body)\n- `cf ai-search update <id>` — Update instances. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-search delete <id>` — Delete instances. (supports --dry-run)\n- `cf ai-search namespaces delete <name>` — Delete namespace. (supports --dry-run)\n- `cf ai-search namespaces instances delete <id>` — Delete instances. (supports --dry-run)\n- `cf ai-search namespaces instances items delete <itemId>` — Deletes a file from a managed AI Search instance and triggers a reindex. (supports --dry-run)\n- `cf ai-search tokens delete <id>` — Delete token. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-search chat-completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search jobs logs <jobId>` — Lists log entries for an AI Search indexing job. (supports --dry-run)\n- `cf ai-search namespaces instances chat completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items logs <itemId>` — Lists processing logs for a specific item in an AI Search instance. (supports --dry-run)\n- `cf ai-search namespaces instances items sync <itemId>` — Syncs an item to an AI Search instance index. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items upload <id>` — Uploads a file to a managed AI Search instance via multipart/form-data (max 4MB). (supports --dry-run, --body)\n- `cf ai-search namespaces instances jobs logs <jobId>` — Lists log entries for an AI Search indexing job. (supports --dry-run)\n- `cf ai-search namespaces instances search <id>` — Executes a semantic search query against an AI Search instance to find relevant indexed content. (supports --dry-run, --body)\n- `cf ai-search namespaces move instance <id>` — Moves an instance from its current namespace to the specified target namespace. Use 'default' as new_namespace to move the instance back to the default namespace. Fails with 400 if the target namespace already has an instance with the same id (ids must be unique within a namespace — the same id can exist in different namespaces). (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance chat completions <name>` — Performs a chat completion request against multiple AI Search instances in parallel, merging retrieved content as context for generating a response. (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance search <name>` — Search across multiple instances in a namespace (supports --dry-run, --body)\n- `cf ai-search namespaces stats <id>` — Retrieves usage statistics for AI Search instances. (supports --dry-run)\n- `cf ai-search read <id>` — Read instances. (supports --dry-run)\n- `cf ai-search search <id>` — Executes a semantic search query against an AI Search instance to find relevant indexed content. (supports --dry-run, --body)\n- `cf ai-search stats <id>` — Retrieves usage statistics for AI Search instances. (supports --dry-run)\n- `cf ai-search tokens read <id>` — Read token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"alerting": "# alerting — Notification policies, delivery destinations, silence windows, and alert history\n\n## Commands\n\n### Read Operations\n\n- `cf alerting available-alerts list` — Gets a list of all alert types for which an account is eligible.\n- `cf alerting destinations eligible get` — Get a list of all delivery mechanism types for which an account is eligible.\n- `cf alerting destinations pagerduty get` — Get a list of all configured PagerDuty services.\n- `cf alerting destinations webhooks get <webhookId>` — Get details for a single webhooks destination.\n- `cf alerting destinations webhooks list` — Gets a list of all configured webhook destinations.\n- `cf alerting history list` — Gets a list of history records for notifications sent to an account. The records are displayed for last `x` number of days based on the zone plan (free = 30, pro = 30, biz = 30, ent = 90).\n- `cf alerting policies get <policyId>` — Get details for a single policy.\n- `cf alerting policies list` — Get a list of all Notification policies.\n- `cf alerting silences get <silenceId>` — Gets a specific silence for an account.\n- `cf alerting silences list` — Gets a list of silences for an account.\n\n### Create Operations\n\n- `cf alerting destinations pagerduty create` — Creates a new token for integrating with PagerDuty. (supports --dry-run)\n- `cf alerting destinations webhooks create` — Creates a new webhook destination. (supports --dry-run, --body)\n- `cf alerting policies create` — Creates a new Notification policy. (supports --dry-run, --body)\n- `cf alerting silences create` — Creates a new silence for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf alerting destinations webhooks update <webhookId>` — Update a webhook destination. (supports --dry-run, --body)\n- `cf alerting policies update <policyId>` — Update a Notification policy. (supports --dry-run, --body)\n- `cf alerting silences update` — Updates existing silences for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf alerting destinations pagerduty delete` — Deletes all the PagerDuty Services connected to the account. (supports --dry-run)\n- `cf alerting destinations webhooks delete <webhookId>` — Delete a configured webhook destination. (supports --dry-run)\n- `cf alerting policies delete <policyId>` — Delete a Notification policy. (supports --dry-run)\n- `cf alerting silences delete <silenceId>` — Deletes an existing silence for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf alerting destinations pagerduty link <tokenId>` — Links PagerDuty with the account using the integration token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"analytics": "# analytics — Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics\n\n## Commands\n\n### Read Operations\n\n- `cf analytics colo get <zoneIdentifier>` — This view provides a breakdown of analytics data by datacenter. Note: This is available to Enterprise customers only.\n- `cf analytics dashboard get <zoneIdentifier>` — The dashboard view provides both totals and timeseries data for the given zone and time period across the entire Cloudflare network.\n- `cf analytics latency colos get` — Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.\n- `cf analytics latency get` — Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"api-gateway": "# api-gateway — Discover, monitor, and protect your API endpoints with schema validation, abuse detection, and routing\n\n## Commands\n\n### Read Operations\n\n- `cf api-gateway configurations get` — Gets the current API Shield configuration settings for a zone, including validation behavior and enforcement mode.\n- `cf api-gateway discovery get` — Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas\n- `cf api-gateway discovery operations list` — Retrieve the most up to date view of discovered operations\n- `cf api-gateway labels list` — Retrieve all labels\n- `cf api-gateway labels managed get <name>` — Retrieve managed label\n- `cf api-gateway labels user get <name>` — Retrieve user label\n- `cf api-gateway operations get <operationId>` — Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.\n- `cf api-gateway operations list` — Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.\n- `cf api-gateway operations schema-validation get <operationId>` — Retrieves operation-level schema validation settings on the zone\n- `cf api-gateway schemas list` — Retrieves API operations and their features exported as OpenAPI schemas.\n- `cf api-gateway settings schema-validation get` — Retrieves zone level schema validation settings currently set on the zone\n- `cf api-gateway user-schemas get <schemaId>` — Gets detailed information about a specific uploaded OpenAPI schema, including its contents and validation configuration.\n- `cf api-gateway user-schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone. Useful for understanding which domains have schema coverage.\n- `cf api-gateway user-schemas list` — Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.\n- `cf api-gateway user-schemas operations list` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n\n### Create Operations\n\n- `cf api-gateway expression-template fallthrough create` — Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match. (supports --dry-run, --body)\n- `cf api-gateway operations create` — Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations labels create <operationId>` — Attach label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf api-gateway configurations update` — Updates API Shield configuration settings for a zone. Can modify validation strictness, enforcement mode, and other global settings. (supports --dry-run, --body)\n- `cf api-gateway discovery operations edit <operationId>` — Update the `state` on a discovered operation (supports --dry-run, --body)\n- `cf api-gateway labels managed resources operation update <name>` — Replace all operations(s) attached to a managed label (supports --dry-run, --body)\n- `cf api-gateway labels user edit <name>` — Update certain fields on a label (supports --dry-run, --body)\n- `cf api-gateway labels user resources operation update <name>` — Replace all operations(s) attached to a user label (supports --dry-run, --body)\n- `cf api-gateway labels user update <name>` — Update all fields on a label (supports --dry-run, --body)\n- `cf api-gateway operations labels update <operationId>` — Replace label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation edit` — Updates multiple operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation update <operationId>` — Updates operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation edit` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation update` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway user-schemas edit <schemaId>` — Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf api-gateway labels user delete <name>` — Delete user label (supports --dry-run)\n- `cf api-gateway operations delete <operationId>` — Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules. (supports --dry-run)\n- `cf api-gateway operations labels delete <operationId>` — Remove label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas delete <schemaId>` — Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules. (supports --dry-run)\n\n### Other Operations\n\n- `cf api-gateway discovery operations bulk-edit` — Update the `state` on one or more discovered operations (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-create` — Create user labels (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-delete` — Delete user labels (supports --dry-run, --body)\n- `cf api-gateway operations bulk-create` — Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations bulk-delete` — Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints. (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-create` — Bulk attach label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-delete` — Bulk remove label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-update` — Bulk replace label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"abuse-reports": "# abuse-reports — Submit and track abuse reports for phishing, malware, and other policy violations on Cloudflare-proxied sites\n\n## Commands\n\n### Read Operations\n\n- `cf abuse-reports emails list` — List emails sent to the customer for an abuse report. Returns all successful customer emails sent for the specified abuse report. Does not include emails sent to hosts or submitters.\n- `cf abuse-reports get <report-param>` — Retrieve the details of an abuse report.\n- `cf abuse-reports list` — List the abuse reports for a given account\n- `cf abuse-reports mitigations list` — List mitigations done to remediate the abuse report.\n\n### Create Operations\n\n- `cf abuse-reports create <report-param>` — Submit an abuse report of a particular type. Requires the abuse-reports entitlement on the account (Enterprise accounts have it by default; other accounts must request access) and an API token with the `Account > Abuse Reports > Edit` permission. If the account is not entitled, the request is rejected with an HTTP `401` response (see below). (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf abuse-reports mitigations review <report-id>` — Request a review for mitigations on an account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"accounts": "# accounts — Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account\n\n## Commands\n\n### Read Operations\n\n- `cf accounts account-profile get` — Retrieves the profile information for a specific Cloudflare account, including organization details, settings, and metadata. This endpoint is commonly used to verify account access and retrieve account-level configuration.\n- `cf accounts get` — Get information about a specific account that you are a member of.\n- `cf accounts list` — List all accounts you have ownership or verified access to.\n- `cf accounts logs audit list` — Gets a list of audit logs for an account.\n- `cf accounts members get <member-id>` — Get information about a specific member of an account.\n- `cf accounts members list` — List all members of an account.\n- `cf accounts roles get <role-id>` — Get information about a specific role for an account.\n- `cf accounts roles list` — Get all available roles for an account.\n- `cf accounts subscriptions get` — Lists all of an account's subscriptions.\n- `cf accounts tokens get <token-id>` — Get information about a specific Account Owned API token.\n- `cf accounts tokens list` — List all Account Owned API tokens created for this account.\n- `cf accounts tokens permission-groups list` — Find all available permission groups for Account Owned API Tokens\n\n### Create Operations\n\n- `cf accounts account-organizations create` — Move an account within an organization hierarchy or an account outside an organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf accounts create` — Create an account (only available for tenant admins at this time) (supports --dry-run, --body)\n- `cf accounts members create` — Add a user to the list of members for this account. (supports --dry-run, --body)\n- `cf accounts subscriptions create` — Creates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens create` — Create a new Account Owned API token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf accounts account-profile update` — Updates the profile information for a Cloudflare account. Allows modification of account-level settings and organizational details. Requires Account Settings Write permission. (supports --dry-run, --body)\n- `cf accounts members update <member-id>` — Modify an account member. (supports --dry-run, --body)\n- `cf accounts subscriptions update <subscription-identifier>` — Updates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens update <token-id>` — Update an existing token. (supports --dry-run, --body)\n- `cf accounts tokens value update <token-id>` — Roll the Account Owned API token secret. (supports --dry-run)\n- `cf accounts update` — Update an existing account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf accounts delete` — Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account (supports --dry-run)\n- `cf accounts members delete <member-id>` — Remove a member from an account. (supports --dry-run)\n- `cf accounts subscriptions delete <subscription-identifier>` — Deletes an account's subscription. (supports --dry-run)\n- `cf accounts tokens delete <token-id>` — Destroy an Account Owned API token. (supports --dry-run)\n\n### Other Operations\n\n- `cf accounts applications get applications` — List applications with different filters. (supports --dry-run)\n- `cf accounts applications get by id <id>` — Get application by ID. (supports --dry-run)\n- `cf accounts categories get by id <id>` — Get application category by ID. (supports --dry-run)\n- `cf accounts categories get categories` — List application categories. (supports --dry-run)\n- `cf accounts move` — Batch move a collection of accounts to a specific organization. ⚠️ Not implemented. (supports --dry-run, --body)\n- `cf accounts tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"acm": "# acm — Advanced Certificate Manager — Total TLS auto-issuance and custom origin trust store certificates\n\n## Commands\n\n### Read Operations\n\n- `cf acm custom-trust-store get <custom-origin-trust-store-id>` — Retrieves details about a specific root CA certificate in the custom origin trust store, including expiration and subject information.\n- `cf acm custom-trust-store list` — Get Custom Origin Trust Store for a Zone.\n- `cf acm total-tls get` — Get Total TLS Settings for a Zone.\n\n### Create Operations\n\n- `cf acm custom-trust-store create` — Upload a root CA certificate to the Custom Origin Trust Store for a Zone. Only root CA certificates are accepted. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf acm total-tls edit` — Set Total TLS Settings or disable the feature for a Zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf acm custom-trust-store delete <custom-origin-trust-store-id>` — Removes a root CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"addressing": "# addressing — IP address management — BYOIP prefixes, address maps, regional hostnames, and BGP advertisement control\n\n## Commands\n\n### Read Operations\n\n- `cf addressing address-maps get <address-map-id>` — Show a particular address map owned by the account.\n- `cf addressing address-maps list` — List all address maps owned by the account.\n- `cf addressing leases list` — List all leases owned by the account.\n- `cf addressing loa-documents get <loa-document-id>` — Download specified LOA document under the account.\n- `cf addressing prefixes advertisement-status get <prefix-id>` — View the current advertisement state for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.\n- `cf addressing prefixes bgp-prefixes get <bgp-prefix-id>` — Retrieve a single BGP Prefix according to its identifier\n- `cf addressing prefixes bgp-prefixes list` — List all BGP Prefixes within the specified IP Prefix. BGP Prefixes are used to control which specific subnets are advertised to the Internet. It is possible to advertise subnets more specific than an IP Prefix by creating more specific BGP Prefixes.\n- `cf addressing prefixes delegations list` — List all delegations for a given account IP prefix.\n- `cf addressing prefixes get <prefix-id>` — List a particular prefix owned by the account.\n- `cf addressing prefixes list` — List all prefixes owned by the account.\n- `cf addressing prefixes service-bindings get <binding-id>` — Fetch a single Service Binding\n- `cf addressing prefixes service-bindings list` — List the Cloudflare services this prefix is currently bound to. Traffic sent to an address within an IP prefix will be routed to the Cloudflare service of the most-specific Service Binding matching the address. **Example:** binding `192.0.2.0/24` to Cloudflare Magic Transit and `192.0.2.1/32` to the Cloudflare CDN would route traffic for `192.0.2.1` to the CDN, and traffic for all other IPs in the prefix to Cloudflare Magic Transit.\n- `cf addressing services list` — Bring-Your-Own IP (BYOIP) prefixes onboarded to Cloudflare must be bound to a service running on the Cloudflare network to enable a Cloudflare product on the IP addresses. This endpoint can be used as a reference of available services on the Cloudflare network, and their service IDs.\n\n### Create Operations\n\n- `cf addressing address-maps create` — Create a new address map under the account. (supports --dry-run, --body)\n- `cf addressing loa-documents create` — Submit LOA document (pdf format) under the account. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes create <prefix-id>` — Create a BGP prefix, controlling the BGP advertisement status of a specific subnet. When created, BGP prefixes are initially withdrawn, and can be advertised with the Update BGP Prefix API. (supports --dry-run, --body)\n- `cf addressing prefixes create` — Add a new prefix under the account. (supports --dry-run, --body)\n- `cf addressing prefixes delegations create <prefix-id>` — Create a new account delegation for a given IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes service-bindings create <prefix-id>` — Creates a new Service Binding, routing traffic to IPs within the given CIDR to a service running on Cloudflare's network. **NOTE:** The first Service Binding created for an IP Prefix must exactly match the IP Prefix's CIDR. Subsequent Service Bindings may be created with a more-specific CIDR. Refer to the [Service Bindings Documentation](https://developers.cloudflare.com/byoip/service-bindings/) for compatibility details. (supports --dry-run, --body)\n- `cf addressing prefixes validate create <prefix-id>` — Triggers a new prefix validation. The checks are run asynchronously and include IRR, RPKI, and prefix ownership. (supports --dry-run)\n\n### Update Operations\n\n- `cf addressing address-maps accounts update <address-map-id>` — Add an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps edit <address-map-id>` — Modify properties of an address map owned by the account. (supports --dry-run, --body)\n- `cf addressing address-maps ips update <ip-address>` — Add an IP from a prefix owned by the account to a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones update` — Add a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes advertisement-status edit <prefix-id>` — Advertise or withdraw the BGP route for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes edit <bgp-prefix-id>` — Update the properties of a BGP Prefix, such as the on demand advertisement status (advertised or withdrawn). (supports --dry-run, --body)\n- `cf addressing prefixes edit <prefix-id>` — Modify the description for a prefix owned by the account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf addressing address-maps accounts delete <address-map-id>` — Remove an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps delete <address-map-id>` — Delete a particular address map owned by the account. An Address Map must be disabled before it can be deleted. (supports --dry-run)\n- `cf addressing address-maps ips delete <ip-address>` — Remove an IP from a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones delete` — Remove a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes bgp-prefixes delete <bgp-prefix-id>` — Delete a BGP Prefix associated with the specified IP Prefix. A BGP Prefix must be withdrawn before it can be deleted. (supports --dry-run)\n- `cf addressing prefixes delegations delete <delegation-id>` — Delete an account delegation for a given IP prefix. (supports --dry-run)\n- `cf addressing prefixes delete <prefix-id>` — Delete an unapproved prefix owned by the account. (supports --dry-run)\n- `cf addressing prefixes service-bindings delete <binding-id>` — Delete a Service Binding (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"ai": "# ai — Run inference on Workers AI models — text generation, image classification, embeddings, and more\n\n## Commands\n\n### Read Operations\n\n- `cf ai authors list` — Searches Workers AI models by author or organization name.\n- `cf ai finetunes list` — Lists all fine-tuning jobs created by the account, including status and metrics.\n- `cf ai finetunes public list` — Lists publicly available fine-tuned models that can be used with Workers AI.\n- `cf ai models deepgram aura get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura model.\n- `cf ai models deepgram aura-1 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-1 model.\n- `cf ai models deepgram aura-1-internal get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-1-internal model.\n- `cf ai models deepgram aura-2 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2 model.\n- `cf ai models deepgram aura-2-en get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2-en model.\n- `cf ai models deepgram aura-2-es get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/aura-2-es model.\n- `cf ai models deepgram flux get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/flux model.\n- `cf ai models deepgram nova-3 get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3 model.\n- `cf ai models deepgram nova-3-internal get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3-internal model.\n- `cf ai models deepgram nova-3-ws get` — Opens a WebSocket connection to stream inference results from the @cf/deepgram/nova-3-ws model.\n- `cf ai models list` — Searches Workers AI models by name or description.\n- `cf ai models pipecat-ai smart-turn-v2 get` — Opens a WebSocket connection to stream inference results from the @cf/pipecat-ai/smart-turn-v2 model.\n- `cf ai models pipecat-ai smart-turn-v3 get` — Opens a WebSocket connection to stream inference results from the @cf/pipecat-ai/smart-turn-v3 model.\n- `cf ai models schema get` — Retrieves the input and output JSON schema definition for a Workers AI model.\n- `cf ai models sven test-pipe-http get` — Opens a WebSocket connection to stream inference results from the @cf/sven/test-pipe-http model.\n- `cf ai models test hello-world-cog get` — Opens a WebSocket connection to stream inference results from the @cf/test/hello-world-cog model.\n- `cf ai tasks list` — Searches Workers AI models by task type (e.g., text-generation, embeddings).\n\n### Create Operations\n\n- `cf ai finetunes assets create <finetune-id>` — Uploads training data assets for a Workers AI fine-tuning job. (supports --dry-run, --body)\n- `cf ai finetunes create` — Creates a new fine-tuning job for a Workers AI model using custom training data. (supports --dry-run, --body)\n- `cf ai models ai4bharat indictrans2-en-indic-1B create` — Runs inference on the @cf/ai4bharat/indictrans2-en-indic-1B model. (supports --dry-run, --body)\n- `cf ai models ai4bharat nonomni-indictrans2-en-indic-1b create` — Runs inference on the @cf/ai4bharat/nonomni-indictrans2-en-indic-1b model. (supports --dry-run, --body)\n- `cf ai models aisingapore gemma-sea-lion-v4-27b-it create` — Runs inference on the @cf/aisingapore/gemma-sea-lion-v4-27b-it model. (supports --dry-run, --body)\n- `cf ai models baai bge-base-en-v1-5 create` — Runs inference on the @cf/baai/bge-base-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai bge-large-en-v1-5 create` — Runs inference on the @cf/baai/bge-large-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai bge-m3 create` — Runs inference on the @cf/baai/bge-m3 model. (supports --dry-run, --body)\n- `cf ai models baai bge-reranker-base create` — Runs inference on the @cf/baai/bge-reranker-base model. (supports --dry-run, --body)\n- `cf ai models baai bge-small-en-v1-5 create` — Runs inference on the @cf/baai/bge-small-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-base-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-base-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-large-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-large-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-m3 create` — Runs inference on the @cf/baai/nonomni-bge-m3 model. (supports --dry-run, --body)\n- `cf ai models baai nonomni-bge-small-en-v1-5 create` — Runs inference on the @cf/baai/nonomni-bge-small-en-v1.5 model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-1-schnell create` — Runs inference on the @cf/black-forest-labs/flux-1-schnell model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-dev create` — Runs inference on the @cf/black-forest-labs/flux-2-dev model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-klein-4b create` — Runs inference on the @cf/black-forest-labs/flux-2-klein-4b model. (supports --dry-run, --body)\n- `cf ai models black-forest-labs flux-2-klein-9b create` — Runs inference on the @cf/black-forest-labs/flux-2-klein-9b model. (supports --dry-run, --body)\n- `cf ai models bytedance stable-diffusion-xl-lightning create` — Runs inference on the @cf/bytedance/stable-diffusion-xl-lightning model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-1 create` — Runs inference on the @cf/deepgram/aura-1 model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-2-en create` — Runs inference on the @cf/deepgram/aura-2-en model. (supports --dry-run, --body)\n- `cf ai models deepgram aura-2-es create` — Runs inference on the @cf/deepgram/aura-2-es model. (supports --dry-run, --body)\n- `cf ai models deepgram flux create` — Runs inference on the @cf/deepgram/flux model. (supports --dry-run, --body)\n- `cf ai models deepgram nova-3 create` — Runs inference on the @cf/deepgram/nova-3 model. (supports --dry-run, --body)\n- `cf ai models deepseek-ai deepseek-math-7b-instruct create` — Runs inference on the @cf/deepseek-ai/deepseek-math-7b-instruct model. (supports --dry-run, --body)\n- `cf ai models deepseek-ai deepseek-r1-distill-qwen-32b create` — Runs inference on the @cf/deepseek-ai/deepseek-r1-distill-qwen-32b model. (supports --dry-run, --body)\n- `cf ai models defog sqlcoder-7b-2 create` — Runs inference on the @cf/defog/sqlcoder-7b-2 model. (supports --dry-run, --body)\n- `cf ai models facebook bart-large-cnn create` — Runs inference on the @cf/facebook/bart-large-cnn model. (supports --dry-run, --body)\n- `cf ai models facebook nonomni-bart-large-cnn create` — Runs inference on the @cf/facebook/nonomni-bart-large-cnn model. (supports --dry-run, --body)\n- `cf ai models facebook nonomni-detr-resnet-50 create` — Runs inference on the @cf/facebook/nonomni-detr-resnet-50 model. (supports --dry-run, --body)\n- `cf ai models fblgit una-cybertron-7b-v2-bf16 create` — Runs inference on the @cf/fblgit/una-cybertron-7b-v2-bf16 model. (supports --dry-run, --body)\n- `cf ai models google embeddinggemma-300m create` — Runs inference on the @cf/google/embeddinggemma-300m model. (supports --dry-run, --body)\n- `cf ai models google gemma-2b-it-lora create` — Runs inference on the @cf/google/gemma-2b-it-lora model. (supports --dry-run, --body)\n- `cf ai models google gemma-3-12b-it create` — Runs inference on the @cf/google/gemma-3-12b-it model. (supports --dry-run, --body)\n- `cf ai models google gemma-7b-it create` — Runs inference on the @hf/google/gemma-7b-it model. (supports --dry-run, --body)\n- `cf ai models google gemma-7b-it-lora create` — Runs inference on the @cf/google/gemma-7b-it-lora model. (supports --dry-run, --body)\n- `cf ai models google nonomni-embeddinggemma-300m create` — Runs inference on the @cf/google/nonomni-embeddinggemma-300m model. (supports --dry-run, --body)\n- `cf ai models huggingface distilbert-sst-2-int8 create` — Runs inference on the @cf/huggingface/distilbert-sst-2-int8 model. (supports --dry-run, --body)\n- `cf ai models huggingface nonomni-distilbert-sst-2-int8 create` — Runs inference on the @cf/huggingface/nonomni-distilbert-sst-2-int8 model. (supports --dry-run, --body)\n- `cf ai models ibm granite-granite-4-0-h-micro create` — Runs inference on the @cf/ibm-granite/granite-4.0-h-micro model. (supports --dry-run, --body)\n- `cf ai models leonardo lucid-origin create` — Runs inference on the @cf/leonardo/lucid-origin model. (supports --dry-run, --body)\n- `cf ai models leonardo phoenix-1-0 create` — Runs inference on the @cf/leonardo/phoenix-1.0 model. (supports --dry-run, --body)\n- `cf ai models lykon dreamshaper-8-lcm create` — Runs inference on the @cf/lykon/dreamshaper-8-lcm model. (supports --dry-run, --body)\n- `cf ai models meta llama-2-7b-chat-fp16 create` — Runs inference on the @cf/meta/llama-2-7b-chat-fp16 model. (supports --dry-run, --body)\n- `cf ai models meta llama-2-7b-chat-int8 create` — Runs inference on the @cf/meta/llama-2-7b-chat-int8 model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-70b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.1-70b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-awq create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-fp8 create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-fp8 model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-1-8b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.1-8b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-11b-vision-instruct create` — Runs inference on the @cf/meta/llama-3.2-11b-vision-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-1b-instruct create` — Runs inference on the @cf/meta/llama-3.2-1b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-2-3b-instruct create` — Runs inference on the @cf/meta/llama-3.2-3b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-3-70b-instruct-fp8-fast create` — Runs inference on the @cf/meta/llama-3.3-70b-instruct-fp8-fast model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-8b-instruct create` — Runs inference on the @cf/meta/llama-3-8b-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-3-8b-instruct-awq create` — Runs inference on the @cf/meta/llama-3-8b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models meta llama-4-scout-17b-16e-instruct create` — Runs inference on the @cf/meta/llama-4-scout-17b-16e-instruct model. (supports --dry-run, --body)\n- `cf ai models meta llama-guard-3-8b create` — Runs inference on the @cf/meta/llama-guard-3-8b model. (supports --dry-run, --body)\n- `cf ai models meta llama-llama-2-7b-chat-hf-lora create` — Runs inference on the @cf/meta-llama/llama-2-7b-chat-hf-lora model. (supports --dry-run, --body)\n- `cf ai models meta m2m100-1-2b create` — Runs inference on the @cf/meta/m2m100-1.2b model. (supports --dry-run, --body)\n- `cf ai models microsoft nonomni-resnet-50 create` — Runs inference on the @cf/microsoft/nonomni-resnet-50 model. (supports --dry-run, --body)\n- `cf ai models microsoft phi-2 create` — Runs inference on the @cf/microsoft/phi-2 model. (supports --dry-run, --body)\n- `cf ai models microsoft resnet-50 create` — Runs inference on the @cf/microsoft/resnet-50 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-1 create` — Runs inference on the @cf/mistral/mistral-7b-instruct-v0.1 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-2 create` — Runs inference on the @hf/mistral/mistral-7b-instruct-v0.2 model. (supports --dry-run, --body)\n- `cf ai models mistral mistral-7b-instruct-v0-2-lora create` — Runs inference on the @cf/mistral/mistral-7b-instruct-v0.2-lora model. (supports --dry-run, --body)\n- `cf ai models mistralai mistral-small-3-1-24b-instruct create` — Runs inference on the @cf/mistralai/mistral-small-3.1-24b-instruct model. (supports --dry-run, --body)\n- `cf ai models moonshotai kimi-k2-5 create` — Runs inference on the @cf/moonshotai/kimi-k2.5 model. (supports --dry-run, --body)\n- `cf ai models myshell-ai melotts create` — Runs inference on the @cf/myshell-ai/melotts model. (supports --dry-run, --body)\n- `cf ai models nexusflow starling-lm-7b-beta create` — Runs inference on the @hf/nexusflow/starling-lm-7b-beta model. (supports --dry-run, --body)\n- `cf ai models nousresearch hermes-2-pro-mistral-7b create` — Runs inference on the @hf/nousresearch/hermes-2-pro-mistral-7b model. (supports --dry-run, --body)\n- `cf ai models nvidia nemotron-3-120b-a12b create` — Runs inference on the @cf/nvidia/nemotron-3-120b-a12b model. (supports --dry-run, --body)\n- `cf ai models openai gpt-oss-120b create` — Runs inference on the @cf/openai/gpt-oss-120b model. (supports --dry-run, --body)\n- `cf ai models openai gpt-oss-20b create` — Runs inference on the @cf/openai/gpt-oss-20b model. (supports --dry-run, --body)\n- `cf ai models openai whisper create` — Runs inference on the @cf/openai/whisper model. (supports --dry-run, --body)\n- `cf ai models openai whisper-large-v3-turbo create` — Runs inference on the @cf/openai/whisper-large-v3-turbo model. (supports --dry-run, --body)\n- `cf ai models openai whisper-tiny-en create` — Runs inference on the @cf/openai/whisper-tiny-en model. (supports --dry-run, --body)\n- `cf ai models openchat openchat-3-5-0106 create` — Runs inference on the @cf/openchat/openchat-3.5-0106 model. (supports --dry-run, --body)\n- `cf ai models pfnet plamo-embedding-1b create` — Runs inference on the @cf/pfnet/plamo-embedding-1b model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-0-5b-chat create` — Runs inference on the @cf/qwen/qwen1.5-0.5b-chat model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-1-8b-chat create` — Runs inference on the @cf/qwen/qwen1.5-1.8b-chat model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-14b-chat-awq create` — Runs inference on the @cf/qwen/qwen1.5-14b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models qwen qwen1-5-7b-chat-awq create` — Runs inference on the @cf/qwen/qwen1.5-7b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models qwen qwen2-5-coder-32b-instruct create` — Runs inference on the @cf/qwen/qwen2.5-coder-32b-instruct model. (supports --dry-run, --body)\n- `cf ai models qwen qwen3-30b-a3b-fp8 create` — Runs inference on the @cf/qwen/qwen3-30b-a3b-fp8 model. (supports --dry-run, --body)\n- `cf ai models qwen qwen3-embedding-0-6b create` — Runs inference on the @cf/qwen/qwen3-embedding-0.6b model. (supports --dry-run, --body)\n- `cf ai models qwen qwq-32b create` — Runs inference on the @cf/qwen/qwq-32b model. (supports --dry-run, --body)\n- `cf ai models runwayml stable-diffusion-v1-5-img2img create` — Runs inference on the @cf/runwayml/stable-diffusion-v1-5-img2img model. (supports --dry-run, --body)\n- `cf ai models runwayml stable-diffusion-v1-5-inpainting create` — Runs inference on the @cf/runwayml/stable-diffusion-v1-5-inpainting model. (supports --dry-run, --body)\n- `cf ai models stabilityai stable-diffusion-xl-base-1-0 create` — Runs inference on the @cf/stabilityai/stable-diffusion-xl-base-1.0 model. (supports --dry-run, --body)\n- `cf ai models thebloke deepseek-coder-6-7b-base-awq create` — Runs inference on the @hf/thebloke/deepseek-coder-6.7b-base-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke deepseek-coder-6-7b-instruct-awq create` — Runs inference on the @hf/thebloke/deepseek-coder-6.7b-instruct-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke discolm-german-7b-v1-awq create` — Runs inference on the @cf/thebloke/discolm-german-7b-v1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke llama-2-13b-chat-awq create` — Runs inference on the @hf/thebloke/llama-2-13b-chat-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke mistral-7b-instruct-v0-1-awq create` — Runs inference on the @hf/thebloke/mistral-7b-instruct-v0.1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke neural-chat-7b-v3-1-awq create` — Runs inference on the @hf/thebloke/neural-chat-7b-v3-1-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke openhermes-2-5-mistral-7b-awq create` — Runs inference on the @hf/thebloke/openhermes-2.5-mistral-7b-awq model. (supports --dry-run, --body)\n- `cf ai models thebloke zephyr-7b-beta-awq create` — Runs inference on the @hf/thebloke/zephyr-7b-beta-awq model. (supports --dry-run, --body)\n- `cf ai models tiiuae falcon-7b-instruct create` — Runs inference on the @cf/tiiuae/falcon-7b-instruct model. (supports --dry-run, --body)\n- `cf ai models tinyllama tinyllama-1-1b-chat-v1-0 create` — Runs inference on the @cf/tinyllama/tinyllama-1.1b-chat-v1.0 model. (supports --dry-run, --body)\n- `cf ai models zai-org glm-4-7-flash create` — Runs inference on the @cf/zai-org/glm-4.7-flash model. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf ai run <model-name>` — This endpoint provides users with the capability to run specific AI models on-demand. By submitting the required input data, users can receive real-time predictions or results generated by the chosen AI model. The endpoint supports various AI model types, ensuring flexibility and adaptability for diverse use cases. Model specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/). (supports --dry-run, --body)\n- `cf ai to-markdown supported` — Lists all file formats supported for conversion to Markdown. (supports --dry-run)\n- `cf ai to-markdown transform` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"ai_gateway": "# ai_gateway — ai_gateway\n\n## Commands\n\n### Read Operations\n\n- `cf ai_gateway billing spending_limit get` — Retrieve the current spending limit configuration for the account.\n- `cf ai_gateway billing topup config get` — Retrieve the current auto top-up threshold, amount, and any error state.\n- `cf ai_gateway billing topup status` — Get the payment processing status of a top-up by its invoice ID. (supports --body)\n\n### Create Operations\n\n- `cf ai_gateway billing spending_limit create` — Deprecated: spending limits can no longer be created, enabled, or modified and this endpoint always responds 403. Use the new AI Gateway spend limits instead: https://developers.cloudflare.com/ai-gateway/features/spend-limits/. Existing limits can be removed via DELETE /spending-limit. (supports --dry-run, --body)\n- `cf ai_gateway billing topup config create` — Configure auto top-up with a balance threshold and top-up amount. (supports --dry-run, --body)\n- `cf ai_gateway billing topup create` — Create a credit top-up via Stripe PaymentIntent for the given account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai_gateway billing spending_limit delete` — Remove the spending limit for the account. (supports --dry-run)\n- `cf ai_gateway billing topup config delete` — Remove the auto top-up configuration for the account. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai_gateway billing credit_balance` — Retrieve the current credit balance, payment method info, and top-up configuration. (supports --dry-run)\n- `cf ai_gateway billing invoice_history` — Retrieve a list of past invoices with pagination, optionally filtered by type. (supports --dry-run)\n- `cf ai_gateway billing invoice_preview` — Retrieve a preview of the upcoming invoice including line items and tax. (supports --dry-run)\n- `cf ai_gateway billing usage_history` — Retrieve aggregated usage meter event summaries for the given time range. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"ai-gateway": "# ai-gateway — Proxy, cache, rate-limit, and observe requests to AI providers — OpenAI, Anthropic, Workers AI, and more\n\n## Commands\n\n### Read Operations\n\n- `cf ai-gateway datasets get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway datasets list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway dynamic-routing get <id>` — Get an AI Gateway Dynamic Route.\n- `cf ai-gateway dynamic-routing list` — List all AI Gateway Dynamic Routes.\n- `cf ai-gateway evaluation-types list` — Lists all available evaluator types for scoring AI gateway responses.\n- `cf ai-gateway evaluations get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway evaluations list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway logs get <id>` — Retrieves detailed information for a specific AI Gateway log entry.\n- `cf ai-gateway logs list` — Lists request/response log entries for the AI gateway with filtering and pagination.\n- `cf ai-gateway provider-configs list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway urls get <provider>` — Retrieves the endpoint URL for an AI Gateway.\n\n### Create Operations\n\n- `cf ai-gateway create` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway datasets create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create <gateway-id>` — Create a new AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway evaluations create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway provider-configs create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-gateway datasets update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing update <id>` — Update an AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway logs edit <id>` — Updates metadata for an AI Gateway log entry. (supports --dry-run, --body)\n- `cf ai-gateway provider-configs update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-gateway datasets delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway dynamic-routing delete <id>` — Delete an AI Gateway Dynamic Route. (supports --dry-run)\n- `cf ai-gateway evaluations delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway logs delete <gateway-id>` — Deletes gateway log entries matching the specified criteria. (supports --dry-run)\n- `cf ai-gateway provider-configs delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-gateway dynamic-routing create-deployment <id>` — Create a new AI Gateway Dynamic Route Deployment. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create-version <id>` — Create a new AI Gateway Dynamic Route Version. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing get-version <version-id>` — Get an AI Gateway Dynamic Route Version. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-deployments <id>` — List all AI Gateway Dynamic Route Deployments. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-versions <id>` — List all AI Gateway Dynamic Route Versions. (supports --dry-run)\n- `cf ai-gateway logs request <id>` — Retrieves the original request payload for an AI Gateway log entry. (supports --dry-run)\n- `cf ai-gateway logs response <id>` — Retrieves the response payload for an AI Gateway log entry. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"ai-search": "# ai-search — Managed search-as-a-service — crawl, index, and query content with AI-powered relevance and chat completions\n\n## Commands\n\n### Read Operations\n\n- `cf ai-search get <id>` — Retrieve the configuration and status of an AI Search instance.\n- `cf ai-search jobs get <job-id>` — Retrieves details for a specific AI Search indexing job.\n- `cf ai-search jobs list` — Lists indexing jobs for an AI Search instance.\n- `cf ai-search list` — List all AI Search instances in the account.\n- `cf ai-search namespace get <name>` — Read namespace.\n- `cf ai-search namespace list` — List namespaces.\n- `cf ai-search namespaces instances items chunks list` — Lists chunks for a specific item in an AI Search instance, including their text content.\n- `cf ai-search namespaces instances items content get <item-id>` — Downloads the raw file content for a specific item from the managed AI Search instance storage.\n- `cf ai-search namespaces instances items get <item-id>` — Retrieves a specific indexed item from an AI Search instance.\n- `cf ai-search namespaces instances items list` — Lists indexed items in an AI Search instance.\n- `cf ai-search tokens list` — List tokens.\n\n### Create Operations\n\n- `cf ai-search create` — Create a new AI Search instance with the given configuration. (supports --dry-run, --body)\n- `cf ai-search jobs create <id>` — Creates a new indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search namespace create` — Create a new namespace. (supports --dry-run, --body)\n- `cf ai-search tokens create` — Create a new token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-search namespace update <name>` — Update namespace. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items create or update <id>` — Creates or updates an indexed item in an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search tokens update <id>` — Update token. (supports --dry-run, --body)\n- `cf ai-search update <id>` — Update the configuration of an AI Search instance. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-search delete <id>` — Permanently delete an AI Search instance and all its indexed data. (supports --dry-run)\n- `cf ai-search namespace delete <name>` — Permanently delete a namespace. The namespace must be empty (no instances). (supports --dry-run)\n- `cf ai-search namespaces instances items delete <item-id>` — Deletes a file from a managed AI Search instance and triggers a reindex. (supports --dry-run)\n- `cf ai-search tokens delete <id>` — Delete token. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-search chat-completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search jobs cancel <job-id>` — Cancel an in-progress indexing job for an AI Search instance. (supports --dry-run, --body)\n- `cf ai-search jobs logs <job-id>` — Lists log entries for an AI Search indexing job. (supports --dry-run)\n- `cf ai-search namespaces instances chat completions <id>` — Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items logs <item-id>` — Lists processing logs for a specific item in an AI Search instance. (supports --dry-run)\n- `cf ai-search namespaces instances items sync <item-id>` — Syncs an item to an AI Search instance index. (supports --dry-run, --body)\n- `cf ai-search namespaces instances items upload <id>` — Uploads a file to a managed AI Search instance via multipart/form-data. (supports --dry-run, --body)\n- `cf ai-search namespaces move instance <id>` — Moves an instance from its current namespace to the specified target namespace. Use 'default' as new_namespace to move the instance back to the default namespace. Fails with 400 if the target namespace already has an instance with the same id (ids must be unique within a namespace — the same id can exist in different namespaces). (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance chat completions <name>` — Performs a chat completion request against multiple AI Search instances in parallel, merging retrieved content as context for generating a response. (supports --dry-run, --body)\n- `cf ai-search namespaces multi instance search <name>` — Performs a semantic search query against multiple AI Search instances in parallel, merging the retrieved results into a single ranked response. (supports --dry-run, --body)\n- `cf ai-search search <id>` — Executes a semantic search query against an AI Search instance to find relevant indexed content. (supports --dry-run, --body)\n- `cf ai-search stats <id>` — Retrieve usage and indexing statistics for an AI Search instance. (supports --dry-run)\n- `cf ai-search tokens read <id>` — Read token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"alerting": "# alerting — Notification policies, delivery destinations, silence windows, and alert history\n\n## Commands\n\n### Read Operations\n\n- `cf alerting available-alerts list` — Gets a list of all alert types for which an account is eligible.\n- `cf alerting destinations eligible get` — Get a list of all delivery mechanism types for which an account is eligible.\n- `cf alerting destinations pagerduty get` — Get a list of all configured PagerDuty services.\n- `cf alerting destinations webhooks get <webhook-id>` — Get details for a single webhooks destination.\n- `cf alerting destinations webhooks list` — Gets a list of all configured webhook destinations.\n- `cf alerting history list` — Gets a list of history records for notifications sent to an account. The records are displayed for last `x` number of days based on the zone plan (free = 30, pro = 30, biz = 30, ent = 90).\n- `cf alerting policies get <policy-id>` — Get details for a single policy.\n- `cf alerting policies list` — Get a list of all Notification policies.\n- `cf alerting silences get <silence-id>` — Gets a specific silence for an account.\n- `cf alerting silences list` — Gets a list of silences for an account.\n\n### Create Operations\n\n- `cf alerting destinations pagerduty create` — Creates a new token for integrating with PagerDuty. (supports --dry-run)\n- `cf alerting destinations webhooks create` — Creates a new webhook destination. (supports --dry-run, --body)\n- `cf alerting policies create` — Creates a new Notification policy. (supports --dry-run, --body)\n- `cf alerting silences create` — Creates a new silence for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf alerting destinations webhooks update <webhook-id>` — Update a webhook destination. (supports --dry-run, --body)\n- `cf alerting policies update <policy-id>` — Update a Notification policy. (supports --dry-run, --body)\n- `cf alerting silences update` — Updates existing silences for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf alerting destinations pagerduty delete` — Deletes all the PagerDuty Services connected to the account. (supports --dry-run)\n- `cf alerting destinations webhooks delete <webhook-id>` — Delete a configured webhook destination. (supports --dry-run)\n- `cf alerting policies delete <policy-id>` — Delete a Notification policy. (supports --dry-run)\n- `cf alerting silences delete <silence-id>` — Deletes an existing silence for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf alerting destinations pagerduty link <token-id>` — Links PagerDuty with the account using the integration token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"analytics": "# analytics — Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics\n\n## Commands\n\n### Read Operations\n\n- `cf analytics colo get <zone-identifier>` — This view provides a breakdown of analytics data by datacenter. Note: This is available to Enterprise customers only.\n- `cf analytics dashboard get <zone-identifier>` — The dashboard view provides both totals and timeseries data for the given zone and time period across the entire Cloudflare network.\n- `cf analytics latency colos get` — Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.\n- `cf analytics latency get` — Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"analytics_engine": "# analytics_engine — analytics_engine\n\n## Commands\n\n### Other Operations\n\n- `cf analytics_engine sql query` — Executes a SQL query against Workers Analytics Engine data. Pass the SQL query in the request body as plain text. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Prefer this method for longer queries that may exceed URL length limits. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"api-gateway": "# api-gateway — Discover, monitor, and protect your API endpoints with schema validation, abuse detection, and routing\n\n## Commands\n\n### Read Operations\n\n- `cf api-gateway configurations get` — Gets the current API Shield configuration settings for a zone, including validation behavior and enforcement mode.\n- `cf api-gateway discovery get` — Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas\n- `cf api-gateway discovery operations list` — Retrieve the most up to date view of discovered operations\n- `cf api-gateway labels list` — Retrieve all labels\n- `cf api-gateway labels managed get <name>` — Retrieve managed label\n- `cf api-gateway labels user get <name>` — Retrieve user label\n- `cf api-gateway operations get <operation-id>` — Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.\n- `cf api-gateway operations list` — Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.\n- `cf api-gateway operations schema-validation get <operation-id>` — Retrieves operation-level schema validation settings on the zone\n- `cf api-gateway schemas list` — Retrieves API operations and their features exported as OpenAPI schemas.\n- `cf api-gateway settings schema-validation get` — Retrieves zone level schema validation settings currently set on the zone\n- `cf api-gateway user-schemas get <schema-id>` — Gets detailed information about a specific uploaded OpenAPI schema, including its contents and validation configuration.\n- `cf api-gateway user-schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone. Useful for understanding which domains have schema coverage.\n- `cf api-gateway user-schemas list` — Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.\n- `cf api-gateway user-schemas operations list` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n\n### Create Operations\n\n- `cf api-gateway expression-template fallthrough create` — Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match. (supports --dry-run, --body)\n- `cf api-gateway operations create` — Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations labels create <operation-id>` — Attach label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf api-gateway configurations update` — Updates API Shield configuration settings for a zone. Can modify validation strictness, enforcement mode, and other global settings. (supports --dry-run, --body)\n- `cf api-gateway discovery operations edit <discovery-id>` — Update the `state` on a discovered operation (supports --dry-run, --body)\n- `cf api-gateway labels managed resources operation update <name>` — Replace all operations(s) attached to a managed label (supports --dry-run, --body)\n- `cf api-gateway labels user edit <name>` — Update certain fields on a label (supports --dry-run, --body)\n- `cf api-gateway labels user resources operation update <name>` — Replace all operations(s) attached to a user label (supports --dry-run, --body)\n- `cf api-gateway labels user update <name>` — Update all fields on a label (supports --dry-run, --body)\n- `cf api-gateway operations labels update <operation-id>` — Replace label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation edit` — Updates multiple operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway operations schema-validation update <operation-id>` — Updates operation-level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation edit` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway settings schema-validation update` — Updates zone level schema validation settings on the zone (supports --dry-run, --body)\n- `cf api-gateway user-schemas edit <schema-id>` — Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf api-gateway labels user delete <name>` — Delete user label (supports --dry-run)\n- `cf api-gateway operations delete <operation-id>` — Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules. (supports --dry-run)\n- `cf api-gateway operations labels delete <operation-id>` — Remove label(s) on an operation in endpoint management (supports --dry-run, --body)\n- `cf api-gateway user-schemas delete <schema-id>` — Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules. (supports --dry-run)\n\n### Other Operations\n\n- `cf api-gateway discovery operations bulk-edit` — Update the `state` on one or more discovered operations (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-create` — Create user labels (supports --dry-run, --body)\n- `cf api-gateway labels user bulk-delete` — Delete user labels (supports --dry-run, --body)\n- `cf api-gateway operations bulk-create` — Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date. (supports --dry-run, --body)\n- `cf api-gateway operations bulk-delete` — Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints. (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-create` — Bulk attach label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-delete` — Bulk remove label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n- `cf api-gateway operations labels bulk-update` — Bulk replace label(s) on operation(s) in endpoint management (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"argo": "# argo — Network optimization features that speed up and improve reliability of traffic to your origins\n\n## Commands\n\n### Read Operations\n\n- `cf argo smart-routing get` — Retrieves the value of Argo Smart Routing enablement setting.\n- `cf argo tiered-caching get` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.\n\n### Update Operations\n\n- `cf argo smart-routing edit` — Configures the value of the Argo Smart Routing enablement setting. (supports --dry-run, --body)\n- `cf argo tiered-caching edit` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"audit-logs": "# audit-logs — Immutable audit trail of actions taken by account members — who changed what and when\n\n## Commands\n\n### Read Operations\n\n- `cf audit-logs list` — Gets a list of audit logs for an account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"autorag": "# autorag — AutoRAG — AI search, file management, job tracking, and sync for retrieval-augmented generation\n\n## Commands\n\n### Read Operations\n\n- `cf autorag jobs get <jobId>` — Get a Job Details\n- `cf autorag jobs list` — List Jobs\n\n### Other Operations\n\n- `cf autorag ai-search <id>` — AI Search (supports --dry-run, --body)\n- `cf autorag files <id>` — Files (supports --dry-run)\n- `cf autorag jobs logs <jobId>` — List Job Logs (supports --dry-run)\n- `cf autorag search <id>` — Search (supports --dry-run, --body)\n- `cf autorag sync <id>` — Sync (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"billing": "# billing — Account billing profiles and usage data for Cloudflare subscriptions and add-on services\n\n## Commands\n\n### Read Operations\n\n- `cf billing profiles get` — Gets the current billing profile for the account.\n\n### Other Operations\n\n- `cf billing usage paygo` — Returns billable usage data for PayGo (self-serve) accounts. When no query parameters are provided, returns usage for the current billing period. This endpoint is currently in beta and access is restricted to select accounts. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"autorag": "# autorag — AutoRAG — AI search, file management, job tracking, and sync for retrieval-augmented generation\n\n## Commands\n\n### Read Operations\n\n- `cf autorag jobs get <job-id>` — Get a Job Details\n- `cf autorag jobs list` — List Jobs\n\n### Other Operations\n\n- `cf autorag ai-search <id>` — AI Search (supports --dry-run, --body)\n- `cf autorag files <id>` — Files (supports --dry-run)\n- `cf autorag jobs logs <job-id>` — List Job Logs (supports --dry-run)\n- `cf autorag search <id>` — Search (supports --dry-run, --body)\n- `cf autorag sync <id>` — Sync (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"billing": "# billing — Account billing profiles and usage data for Cloudflare subscriptions and add-on services\n\n## Commands\n\n### Read Operations\n\n- `cf billing profiles get` — Gets the current billing profile for the account.\n\n### Other Operations\n\n- `cf billing usage paygo` — Returns billable usage data for PayGo (self-serve) accounts. When no query parameters are provided, returns usage for the current billing period. (supports --dry-run)\n- `cf billing usage paygo_info` — Returns high-level usage information for the account, including coverage, and subscription metadata. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"bot-management": "# bot-management — Bot detection and mitigation settings — configure bot scores, JavaScript detections, and challenge behavior\n\n## Commands\n\n### Read Operations\n\n- `cf bot-management feedback list` — Returns all feedback reports previously submitted for the specified zone. Feedback reports help improve detection by sharing samples of traffic that were misclassified as bots or humans.\n- `cf bot-management get` — Retrieve a zone's Bot Management Config\n\n### Create Operations\n\n- `cf bot-management feedback create` — Submit a feedback report for the specified zone. Use `type` to indicate whether the report is a false positive (good traffic flagged as bot) or a false negative (bot traffic missed). Furthermore, you can also use `expression` as a wirefilter to identify the affected traffic sample. See more accepted API fields and expression types at https://developers.cloudflare.com/bots/concepts/feedback-loop/#api-fields and https://developers.cloudflare.com/bots/concepts/feedback-loop/#expression-fields, respectively. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf bot-management update` — Updates the Bot Management configuration for a zone. This API is used to update: - **Bot Fight Mode** - **Super Bot Fight Mode** - **Bot Management for Enterprise** See [Bot Plans](https://developers.cloudflare.com/bots/plans/) for more information on the different plans \\ If you recently upgraded or downgraded your plan, refer to the following examples to clean up old configurations. Copy and paste the example body to remove old zone configurations based on your current plan. #### Clean up configuration for Bot Fight Mode plan ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"suppress_session_score\": false } ``` #### Clean up configuration for SBFM Pro plan ```json { \"sbfm_likely_automated\": \"allow\", \"fight_mode\": false } ``` #### Clean up configuration for SBFM Biz plan ```json { \"fight_mode\": false } ``` #### Clean up configuration for BM Enterprise Subscription plan It is strongly recommended that you ensure you have [custom rules](https://developers.cloudflare.com/waf/custom-rules/) in place to protect your zone before disabling the SBFM rules. Without these protections, your zone is vulnerable to attacks. ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"fight_mode\": false } ``` (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"botnet-feed": "# botnet-feed — Botnet threat intelligence feeds — IP and ASN-level data on known command-and-control infrastructure\n\n## Commands\n\n### Read Operations\n\n- `cf botnet-feed configs asn get` — Gets a list of all ASNs registered for a user for the DDoS Botnet Feed API.\n\n### Delete Operations\n\n- `cf botnet-feed configs asn delete <asnId>` — Delete an ASN from botnet threat feed for a given user. (supports --dry-run)\n\n### Other Operations\n\n- `cf botnet-feed asn day-report <asnId>` — Gets all the data the botnet tracking database has for a given ASN registered to user account for given date. If no date is given, it will return results for the previous day. (supports --dry-run)\n- `cf botnet-feed asn full-report <asnId>` — Gets all the data the botnet threat feed tracking database has for a given ASN registered to user account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"brand-protection": "# brand-protection — Monitor the Internet for phishing sites, lookalike domains, and unauthorized use of your brand assets\n\n## Commands\n\n### Read Operations\n\n- `cf brand-protection v2 logo-matches get` — Get paginated list of logo matches for a specific brand protection logo query\n- `cf brand-protection v2 logos get` — Get all saved brand protection logo queries for an account. Optionally specify id to get a single query. Set download=true to include base64-encoded image data.\n- `cf brand-protection v2 matches get` — Get paginated list of domain matches for one or more brand protection queries. When multiple query_ids are provided (comma-separated), matches are deduplicated across queries and each match includes a match_details array with per-match query metadata and individual dismissed state.\n- `cf brand-protection v2 queries get` — Get all saved brand protection queries for an account\n\n### Create Operations\n\n- `cf brand-protection v2 logos create` — Create a new saved brand protection logo query for visual similarity matching (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf brand-protection v2 logos delete <queryId>` — Delete a saved brand protection logo query. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n\n### Other Operations\n\n- `cf brand-protection submit` — Submit an image and find the n closest matches from the scanned images index without creating any match records. Returns similarity scores and metadata for each match. (supports --dry-run, --body)\n- `cf brand-protection url-info` — Get the total number of saved brand protection queries (domain + logo) for an account (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"browser-rendering": "# browser-rendering — Headless browser API — render pages, take screenshots, generate PDFs, scrape content, and extract structured data\n\n## Commands\n\n### Read Operations\n\n- `cf browser-rendering crawl get <jobId>` — Returns the result of a crawl job.\n- `cf browser-rendering devtools browser page get <targetId>` — Establishes a WebSocket connection to a specific Chrome DevTools target or page.\n- `cf browser-rendering devtools browser targets get <targetId>` — Returns the debuggable target with the given ID.\n- `cf browser-rendering devtools browser targets list` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-rendering devtools json get <sessionId>` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-rendering devtools session get <sessionId>` — Get details for a specific browser session.\n- `cf browser-rendering devtools session list` — List active browser sessions.\n\n### Create Operations\n\n- `cf browser-rendering content create` — Fetches rendered HTML content from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering crawl create` — Starts a crawl job for the provided URL and its children. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering devtools browser create` — Acquire a new browser DevTools session (supports --dry-run)\n- `cf browser-rendering devtools browser targets create <sessionId>` — Opens a new tab in the browser. Optionally specify a URL to navigate to. (supports --dry-run)\n- `cf browser-rendering json create` — Gets json from a webpage from a provided URL or HTML. Pass `prompt` or `schema` in the body. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-rendering links create` — Get links from a web page. (supports --dry-run, --body)\n- `cf browser-rendering markdown create` — Gets markdown of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-rendering pdf create` — Fetches rendered PDF from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering scrape create` — Get meta attributes like height, width, text and others of selected elements. (supports --dry-run, --body)\n- `cf browser-rendering screenshot create` — Takes a screenshot of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n- `cf browser-rendering snapshot create` — Returns the page's HTML content and screenshot. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf browser-rendering crawl delete <jobId>` — Cancels an ongoing crawl job by setting its status to cancelled and stopping all queued URLs. (supports --dry-run)\n- `cf browser-rendering devtools browser delete <sessionId>` — Closes an existing browser session. (supports --dry-run)\n\n### Other Operations\n\n- `cf browser-rendering devtools browser connect <sessionId>` — Establishes a WebSocket connection to an existing browser session. (supports --dry-run)\n- `cf browser-rendering devtools browser launch` — Acquires and establishes a WebSocket connection to a browser session. (supports --dry-run)\n- `cf browser-rendering devtools browser protocol <sessionId>` — Returns the complete Chrome DevTools Protocol schema including all domains, commands, events, and types. This schema describes the entire CDP API surface. (supports --dry-run)\n- `cf browser-rendering devtools browser targets activate <targetId>` — Activates (brings to front) a specific browser target by its ID. (supports --dry-run)\n- `cf browser-rendering devtools browser version <sessionId>` — Get browser version metadata. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"builds": "# builds — Automated build and deployment pipeline for Workers — track builds, logs, and repo connections\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"cache": "# cache — Purge cached content and configure Cache Reserve, tiered caching, and variant serving\n\n## Commands\n\n### Read Operations\n\n- `cf cache cache-reserve get` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information.\n- `cf cache cache-reserve status` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.\n- `cf cache regional-tiered-cache get` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies.\n- `cf cache smart-tiered-cache get` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.\n- `cf cache variants get` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.\n\n### Update Operations\n\n- `cf cache cache-reserve edit` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information. (supports --dry-run, --body)\n- `cf cache regional-tiered-cache edit` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies. (supports --dry-run, --body)\n- `cf cache smart-tiered-cache edit` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run, --body)\n- `cf cache variants edit` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cache smart-tiered-cache delete` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run)\n- `cf cache variants delete` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run)\n\n### Other Operations\n\n- `cf cache cache-reserve clear` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation. (supports --dry-run, --body)\n- `cf cache purge` — ### Purge All Cached Content Removes ALL files from Cloudflare's cache. All tiers can purge everything. ``` {\"purge_everything\": true} ``` ### Purge Cached Content by URL Granularly removes one or more files from Cloudflare's cache by specifying URLs. All tiers can purge by URL. To purge files with custom cache keys, include the headers used to compute the cache key as in the example. If you have a device type or geo in your cache key, you will need to include the CF-Device-Type or CF-IPCountry headers. If you have lang in your cache key, you will need to include the Accept-Language header. **NB:** When including the Origin header, be sure to include the **scheme** and **hostname**. The port number can be omitted if it is the default port (80 for http, 443 for https), but must be included otherwise. Single file purge example with files: ``` {\"files\": [\"http://www.example.com/css/styles.css\", \"http://www.example.com/js/index.js\"]} ``` Single file purge example with url and header pairs: ``` {\"files\": [{url: \"http://www.example.com/cat_picture.jpg\", headers: { \"CF-IPCountry\": \"US\", \"CF-Device-Type\": \"desktop\", \"Accept-Language\": \"zh-CN\" }}, {url: \"http://www.example.com/dog_picture.jpg\", headers: { \"CF-IPCountry\": \"EU\", \"CF-Device-Type\": \"mobile\", \"Accept-Language\": \"en-US\" }}]} ``` ### Purge Cached Content by Tag, Host or Prefix Granularly removes one or more files from Cloudflare's cache either by specifying the host, the associated Cache-Tag, or a Prefix. Flex purge with tags: ``` {\"tags\": [\"a-cache-tag\", \"another-cache-tag\"]} ``` Flex purge with hosts: ``` {\"hosts\": [\"www.example.com\", \"images.example.com\"]} ``` Flex purge with prefixes: ``` {\"prefixes\": [\"www.example.com/foo\", \"images.example.com/bar/baz\"]} ``` ### Availability and limits please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"calls": "# calls — Real-time audio/video communication infrastructure — SFU apps for WebRTC and TURN relay keys\n\n## Commands\n\n### Read Operations\n\n- `cf calls sfu get <appId>` — Fetches details for a single Calls app.\n- `cf calls sfu list` — Lists all apps in the Cloudflare account\n- `cf calls turn get <keyId>` — Fetches details for a single TURN key.\n- `cf calls turn list` — Lists all TURN keys in the Cloudflare account\n\n### Create Operations\n\n- `cf calls sfu create` — Creates a new Cloudflare calls app. An app is an unique enviroment where each Session can access all Tracks within the app. (supports --dry-run, --body)\n- `cf calls turn create` — Creates a new Cloudflare Calls TURN key. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf calls sfu update <appId>` — Edit details for a single app. (supports --dry-run, --body)\n- `cf calls turn update <keyId>` — Edit details for a single TURN key. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf calls sfu delete <appId>` — Deletes an app from Cloudflare Calls (supports --dry-run)\n- `cf calls turn delete <keyId>` — Deletes a TURN key from Cloudflare Calls (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"certificate-authorities": "# certificate-authorities — Map client certificates to specific hostnames for mTLS authentication\n\n## Commands\n\n### Read Operations\n\n- `cf certificate-authorities hostname-associations get` — List Hostname Associations\n\n### Update Operations\n\n- `cf certificate-authorities hostname-associations update` — Replace Hostname Associations (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"client-certificates": "# client-certificates — Issue and manage client certificates for mutual TLS (mTLS) authentication on your zone\n\n## Commands\n\n### Read Operations\n\n- `cf client-certificates get <clientCertificateId>` — Get Details for a single mTLS API Shield Client Certificate\n- `cf client-certificates list` — List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination\n\n### Create Operations\n\n- `cf client-certificates create` — Create a new API Shield mTLS Client Certificate (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf client-certificates edit <clientCertificateId>` — If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf client-certificates delete <clientCertificateId>` — Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"botnet-feed": "# botnet-feed — Botnet threat intelligence feeds — IP and ASN-level data on known command-and-control infrastructure\n\n## Commands\n\n### Read Operations\n\n- `cf botnet-feed configs asn get` — Gets a list of all ASNs registered for a user for the DDoS Botnet Feed API.\n\n### Delete Operations\n\n- `cf botnet-feed configs asn delete <asn-id>` — Delete an ASN from botnet threat feed for a given user. (supports --dry-run)\n\n### Other Operations\n\n- `cf botnet-feed asn day-report <asn-id>` — Gets all the data the botnet tracking database has for a given ASN registered to user account for given date. If no date is given, it will return results for the previous day. (supports --dry-run)\n- `cf botnet-feed asn full-report <asn-id>` — Gets all the data the botnet threat feed tracking database has for a given ASN registered to user account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"brand-protection": "# brand-protection — Monitor the Internet for phishing sites, lookalike domains, and unauthorized use of your brand assets\n\n## Commands\n\n### Read Operations\n\n- `cf brand-protection v2 logo-matches get` — Get paginated list of logo matches for a specific brand protection logo query\n- `cf brand-protection v2 logos get` — Get all saved brand protection logo queries for an account. Optionally specify id to get a single query. Set download=true to include base64-encoded image data.\n- `cf brand-protection v2 matches get` — Get paginated list of domain matches for one or more brand protection queries. When multiple query_ids are provided (comma-separated), matches are deduplicated across queries and each match includes a match_details array with per-match query metadata and individual dismissed state.\n- `cf brand-protection v2 queries get` — Get all saved brand protection queries for an account\n\n### Create Operations\n\n- `cf brand-protection v2 logos create` — Create a new saved brand protection logo query for visual similarity matching (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf brand-protection v2 logos delete <query-id>` — Delete a saved brand protection logo query. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n\n### Other Operations\n\n- `cf brand-protection submit` — Submit an image and find the n closest matches from the scanned images index without creating any match records. Returns similarity scores and metadata for each match. (supports --dry-run, --body)\n- `cf brand-protection url-info` — Get the total number of saved brand protection queries (domain + logo) for an account (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"browser-rendering": "# browser-rendering — Headless browser API — render pages, take screenshots, generate PDFs, scrape content, and extract structured data\n\n## Commands\n\n### Read Operations\n\n- `cf browser-rendering crawl get <job-id>` — Returns the result of a crawl job.\n- `cf browser-rendering devtools browser page get <target-id>` — Establishes a WebSocket connection to a specific Chrome DevTools target or page.\n- `cf browser-rendering devtools browser targets get <target-id>` — Returns the debuggable target with the given ID.\n- `cf browser-rendering devtools browser targets list` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-rendering devtools json get <session-id>` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-rendering devtools session get <session-id>` — Get details for a specific browser session.\n- `cf browser-rendering devtools session list` — List active browser sessions.\n\n### Create Operations\n\n- `cf browser-rendering accessibilityTree create` — Returns the page's accessibility tree. Use `interestingOnly` to only return semantically meaningful nodes; use `root` to scope the tree to a CSS-selector-anchored subtree. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-rendering content create` — Fetches rendered HTML content from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering crawl create` — Starts a crawl job for the provided URL and its children. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering devtools browser create` — Acquires a browser and returns its session ID and websocket URL. (supports --dry-run)\n- `cf browser-rendering devtools browser targets create <session-id>` — Opens a new tab in the browser. Optionally specify a URL to navigate to. (supports --dry-run)\n- `cf browser-rendering json create` — Gets json from a webpage from a provided URL or HTML. Pass `prompt` or `schema` in the body. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-rendering links create` — Get links from a web page. (supports --dry-run, --body)\n- `cf browser-rendering markdown create` — Gets markdown of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-rendering pdf create` — Fetches rendered PDF from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-rendering scrape create` — Get meta attributes like height, width, text and others of selected elements. (supports --dry-run, --body)\n- `cf browser-rendering screenshot create` — Takes a screenshot of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n- `cf browser-rendering snapshot create` — Returns the page's HTML content and screenshot. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf browser-rendering crawl delete <job-id>` — Cancels an ongoing crawl job by setting its status to cancelled and stopping all queued URLs. (supports --dry-run)\n- `cf browser-rendering devtools browser delete <session-id>` — Closes an existing browser session. (supports --dry-run)\n\n### Other Operations\n\n- `cf browser-rendering devtools browser connect <session-id>` — Establishes a WebSocket connection to an existing browser session. (supports --dry-run)\n- `cf browser-rendering devtools browser launch` — Acquires and establishes a WebSocket connection to a browser session. (supports --dry-run)\n- `cf browser-rendering devtools browser protocol <session-id>` — Returns the complete Chrome DevTools Protocol schema including all domains, commands, events, and types. This schema describes the entire CDP API surface. (supports --dry-run)\n- `cf browser-rendering devtools browser targets activate <target-id>` — Activates (brings to front) a specific browser target by its ID. (supports --dry-run)\n- `cf browser-rendering devtools browser targets close <target-id>` — Closes a specific browser target (tab, page, etc.) by its ID. Returns 'Target is closing' on success or an error if the target is not found. (supports --dry-run)\n- `cf browser-rendering devtools browser version <session-id>` — Get browser version metadata. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"cache": "# cache — Purge cached content and configure Cache Reserve, tiered caching, and variant serving\n\n## Commands\n\n### Read Operations\n\n- `cf cache cache-reserve get` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information.\n- `cf cache cache-reserve status` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.\n- `cf cache regional-tiered-cache get` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies.\n- `cf cache smart-tiered-cache get` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.\n- `cf cache variants get` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.\n\n### Update Operations\n\n- `cf cache cache-reserve edit` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information. (supports --dry-run, --body)\n- `cf cache regional-tiered-cache edit` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies. (supports --dry-run, --body)\n- `cf cache smart-tiered-cache edit` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run, --body)\n- `cf cache variants edit` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cache smart-tiered-cache delete` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run)\n- `cf cache variants delete` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run)\n\n### Other Operations\n\n- `cf cache cache-reserve clear` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation. (supports --dry-run)\n- `cf cache purge` — ### Purge All Cached Content Removes ALL files from Cloudflare's cache. All tiers can purge everything. ``` {\"purge_everything\": true} ``` ### Purge Cached Content by URL Granularly removes one or more files from Cloudflare's cache by specifying URLs. All tiers can purge by URL. To purge files with custom cache keys, include the headers used to compute the cache key as in the example. If you have a device type or geo in your cache key, you will need to include the CF-Device-Type or CF-IPCountry headers. If you have lang in your cache key, you will need to include the Accept-Language header. **NB:** When including the Origin header, be sure to include the **scheme** and **hostname**. The port number can be omitted if it is the default port (80 for http, 443 for https), but must be included otherwise. Single file purge example with files: ``` {\"files\": [\"http://www.example.com/css/styles.css\", \"http://www.example.com/js/index.js\"]} ``` Single file purge example with url and header pairs: ``` {\"files\": [{\"url\": \"http://www.example.com/cat_picture.jpg\", \"headers\": {\"CF-IPCountry\": \"US\", \"CF-Device-Type\": \"desktop\", \"Accept-Language\": \"zh-CN\"}}, {\"url\": \"http://www.example.com/dog_picture.jpg\", \"headers\": {\"CF-IPCountry\": \"EU\", \"CF-Device-Type\": \"mobile\", \"Accept-Language\": \"en-US\"}}]} ``` ### Purge Cached Content by Tag, Host or Prefix Granularly removes one or more files from Cloudflare's cache either by specifying the host, the associated Cache-Tag, or a Prefix. Flex purge with tags: ``` {\"tags\": [\"a-cache-tag\", \"another-cache-tag\"]} ``` Flex purge with hosts: ``` {\"hosts\": [\"www.example.com\", \"images.example.com\"]} ``` Flex purge with prefixes: ``` {\"prefixes\": [\"www.example.com/foo\", \"images.example.com/bar/baz\"]} ``` ### Availability and limits Please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"calls": "# calls — Real-time audio/video communication infrastructure — SFU apps for WebRTC and TURN relay keys\n\n## Commands\n\n### Read Operations\n\n- `cf calls sfu get <app-id>` — Fetches details for a single Calls app.\n- `cf calls sfu list` — Lists all apps in the Cloudflare account\n- `cf calls turn get <key-id>` — Fetches details for a single TURN key.\n- `cf calls turn list` — Lists all TURN keys in the Cloudflare account\n\n### Create Operations\n\n- `cf calls sfu create` — Creates a new Cloudflare calls app. An app is an unique enviroment where each Session can access all Tracks within the app. (supports --dry-run, --body)\n- `cf calls turn create` — Creates a new Cloudflare Calls TURN key. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf calls sfu update <app-id>` — Edit details for a single app. (supports --dry-run, --body)\n- `cf calls turn update <key-id>` — Edit details for a single TURN key. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf calls sfu delete <app-id>` — Deletes an app from Cloudflare Calls (supports --dry-run)\n- `cf calls turn delete <key-id>` — Deletes a TURN key from Cloudflare Calls (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"certificate-authorities": "# certificate-authorities — Map client certificates to specific hostnames for mTLS authentication\n\n## Commands\n\n### Read Operations\n\n- `cf certificate-authorities hostname-associations get` — List Hostname Associations.\n\n### Update Operations\n\n- `cf certificate-authorities hostname-associations update` — Replace Hostname Associations. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"client-certificates": "# client-certificates — Issue and manage client certificates for mutual TLS (mTLS) authentication on your zone\n\n## Commands\n\n### Read Operations\n\n- `cf client-certificates get <client-certificate-id>` — Get Details for a single mTLS API Shield Client Certificate.\n- `cf client-certificates list` — List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination.\n\n### Create Operations\n\n- `cf client-certificates create` — Create a new API Shield mTLS Client Certificate. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf client-certificates edit <client-certificate-id>` — If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf client-certificates delete <client-certificate-id>` — Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"cloud-connector": "# cloud-connector — Route traffic from Cloudflare directly to cloud provider services (AWS, Azure, GCP) without origin servers\n\n## Commands\n\n### Read Operations\n\n- `cf cloud-connector rules list` — Retrieves the Cloud Connector rules configured for a zone. Rules define how traffic is routed to cloud services.\n\n### Update Operations\n\n- `cf cloud-connector rules update` — Updates Cloud Connector rules for a zone, replacing the existing rule configuration. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"cloudforce-one": "# cloudforce-one — Threat intelligence platform — request investigations, scan indicators, and track threat events\n\n## Commands\n\n### Read Operations\n\n- `cf cloudforce-one binary-storage get <hash>` — Retrieves a binary file from the Cloudforce One binary storage for analysis.\n- `cf cloudforce-one events aggregate get` — Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.\n- `cf cloudforce-one events categories catalog get` — Lists categories\n- `cf cloudforce-one events dataset events get <eventId>` — Retrieves a specific event by its UUID.\n- `cf cloudforce-one events dataset groups members get <groupId>` — List group members\n- `cf cloudforce-one events dataset indicators tags get <datasetId>` — Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.\n- `cf cloudforce-one events dataset permissions get <datasetId>` — List permissions\n- `cf cloudforce-one events dataset tags indicators get <tagUuid>` — Returns indicators associated with the provided tag UUID across all indicator datasets, with pagination.\n- `cf cloudforce-one events dataset target industries get <datasetId>` — Lists all target industries for a specific dataset\n- `cf cloudforce-one events indicator types get` — Lists indicator types across multiple datasets\n- `cf cloudforce-one events indicators get` — Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.\n- `cf cloudforce-one events relationships get <eventId>` — The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.\n- `cf cloudforce-one events tags categories get` — Returns all Source-of-Truth tag categories for an account.\n- `cf cloudforce-one events tags get` — Returns all Source-of-Truth tags for an account.\n- `cf cloudforce-one events target industries catalog get` — Lists all target industries from industry map catalog\n- `cf cloudforce-one requests assets get <assetId>` — Retrieves an asset attached to a Cloudforce One intelligence request.\n- `cf cloudforce-one requests get <requestId>` — Retrieves details for a specific Cloudforce One intelligence request.\n- `cf cloudforce-one requests list` — Lists Cloudforce One intelligence requests with filtering and pagination. (supports --body)\n- `cf cloudforce-one requests message get <requestId>` — Lists messages in a Cloudforce One intelligence request conversation. (supports --body)\n- `cf cloudforce-one requests priority get <priorityId>` — Retrieves a specific priority intelligence request from Cloudforce One.\n- `cf cloudforce-one requests priority list` — Lists priority intelligence requests in Cloudforce One. (supports --body)\n- `cf cloudforce-one rules get <id>` — Get a single rule by ID.\n- `cf cloudforce-one rules list` — List all rules for an account with optional filtering.\n- `cf cloudforce-one rules stats get` — Get statistics about rules for the dashboard.\n- `cf cloudforce-one rules tree get` — Get the folder tree structure for rules navigation.\n- `cf cloudforce-one scans config list` — List scan configurations\n- `cf cloudforce-one scans results get <configId>` — Get open ports scan results\n- `cf cloudforce-one threat-events attackers list` — Lists known threat attackers tracked in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-events categories get <categoryId>` — Retrieves details for a specific threat event category.\n- `cf cloudforce-one threat-events categories list` — Lists all threat event categories configured for classifying and organizing threat events.\n- `cf cloudforce-one threat-events countries list` — Lists countries referenced in Cloudforce One threat intelligence data.\n- `cf cloudforce-one threat-events datasets get <datasetId>` — Retrieves details for a specific threat event dataset.\n- `cf cloudforce-one threat-events datasets list` — Lists all threat event datasets configured in Cloudforce One.\n- `cf cloudforce-one threat-events get <eventId>` — This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.\n- `cf cloudforce-one threat-events indicator-types list` — This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.\n- `cf cloudforce-one threat-events list` — Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 10). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.\n- `cf cloudforce-one threat-events raw get <rawId>` — Retrieves raw threat event data for a specific event in Cloudforce One.\n- `cf cloudforce-one threat-events target-industries list` — Retrieves the catalog of industry classifications used in Cloudforce One threat intelligence.\n\n### Create Operations\n\n- `cf cloudforce-one binary-storage create` — Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. (supports --dry-run, --body)\n- `cf cloudforce-one events categories create <categoryId>` — Updates a category (supports --dry-run, --body)\n- `cf cloudforce-one events create <eventId>` — Updates an event (supports --dry-run, --body)\n- `cf cloudforce-one events dataset copy create <datasetId>` — Copies specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset create <datasetId>` — Updates an existing dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups create` — Create a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups members create <groupId>` — Create a group member (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicator types create create <datasetId>` — Creates a new indicator type and initializes its dedicated Durable Object (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators bulk create <datasetId>` — Creates multiple indicators at once with their respective types and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators create create <datasetId>` — Creates a new indicator with the specified type and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset move create <datasetId>` — Moves specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions create <datasetId>` — Create a permission (supports --dry-run, --body)\n- `cf cloudforce-one events datasets populate create` — Populate dataset-specific lookup tables from existing Events data with batch processing (supports --dry-run)\n- `cf cloudforce-one events queries create <queryId>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events raw create <rawId>` — Updates a raw event (supports --dry-run, --body)\n- `cf cloudforce-one events relate create create <eventId>` — Creates event references for a event (supports --dry-run, --body)\n- `cf cloudforce-one events relationships create create` — Creates a directed relationship between two events. The relationship is from parent to child with a specified type. (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories create create` — Creates a new Source-of-Truth tag category for an account. (supports --dry-run, --body)\n- `cf cloudforce-one requests asset-new create <requestId>` — Uploads a new asset to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets create <requestId>` — Lists assets attached to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests create` — Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. (supports --dry-run, --body)\n- `cf cloudforce-one requests message create <requestId>` — Adds a message to a Cloudforce One intelligence request conversation. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority create` — Creates a new priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one rules create` — Create a new detection rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules validate create` — Validate rule syntax, name uniqueness, namespace, and meta checks. (supports --dry-run, --body)\n- `cf cloudforce-one scans config create` — Create a scan configuration (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories create` — Creates a new threat event category in Cloudforce One for organizing and classifying threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events create` — To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets create` — Creates a new threat event dataset in Cloudforce One for organizing related threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events event-tags create <eventId>` — Adds a tag to a threat event in Cloudforce One for classification and filtering. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events tags create` — Creates a new tag to be used accross threat events. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf cloudforce-one events dataset groups update <groupId>` — Update a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators patch <indicatorId>` — Updates an existing indicator's properties. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions update <grantId>` — Update a permission (supports --dry-run, --body)\n- `cf cloudforce-one events queries patch <queryId>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories patch <categoryUuid>` — Updates a Source-of-Truth tag category by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags patch <tagUuid>` — Updates a Source-of-Truth tag by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events update bulk patch` — Updates multiple events with the same field values. Maximum 100 events per request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets update <assetId>` — Updates an asset in a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests message update <messageId>` — Updates a message in a Cloudforce One intelligence request thread. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority update <priorityId>` — Updates a priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one requests update <requestId>` — Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. (supports --dry-run, --body)\n- `cf cloudforce-one rules update <id>` — Update an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one scans config edit <configId>` — Update a scan configuration (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories edit <categoryId>` — Partially updates a threat event category in Cloudforce One, modifying specific fields without replacing the entire category. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets edit <datasetId>` — Partially updates a threat event dataset in Cloudforce One, modifying specific fields without replacing the entire dataset configuration. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events edit <eventId>` — Partially updates a threat event in Cloudforce One, modifying specific fields without replacing the entire event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events raw edit <rawId>` — Partially updates raw threat event data in Cloudforce One, modifying specific fields of the event. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cloudforce-one events dataset delete <datasetId>` — Deletes a dataset given a datasetId. (supports --dry-run)\n- `cf cloudforce-one events dataset groups delete <groupId>` — Delete a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups members delete <memberId>` — Delete a group member (supports --dry-run)\n- `cf cloudforce-one events dataset indicators delete <indicatorId>` — Deletes a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events dataset permissions delete <grantId>` — Delete a permission (supports --dry-run)\n- `cf cloudforce-one events delete delete <datasetId>` — Deletes one or more events (supports --dry-run)\n- `cf cloudforce-one events queries delete <queryId>` — Delete a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories delete <categoryUuid>` — Deletes a Source-of-Truth tag category by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags delete <tagUuid>` — Deletes a Source-of-Truth tag by UUID. (supports --dry-run)\n- `cf cloudforce-one requests assets delete <assetId>` — Removes an asset from a Cloudforce One intelligence request. (supports --dry-run)\n- `cf cloudforce-one requests delete <requestId>` — Deletes a Cloudforce One intelligence request and all associated data. (supports --dry-run)\n- `cf cloudforce-one requests message delete <messageId>` — Removes a message from a Cloudforce One intelligence request thread. (supports --dry-run)\n- `cf cloudforce-one requests priority delete <priorityId>` — Deletes a priority intelligence request from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one scans config delete <configId>` — Delete scan configurations (supports --dry-run)\n- `cf cloudforce-one threat-events categories delete <categoryId>` — Removes a threat event category from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one threat-events event-tags delete <eventId>` — Removes a tag from a threat event in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events relate delete <eventId>` — Removes a reference link between related threat events in Cloudforce One. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf cloudforce-one events dataset groups get group` — List groups for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups get v2 <groupId>` — Read a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset indicators get indicator <indicatorId>` — Retrieves a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph ql` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph qlv2` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events queries create-create` — Create a new saved event query for the account (supports --dry-run, --body)\n- `cf cloudforce-one events queries get event` — Retrieve all saved event queries for the account (supports --dry-run)\n- `cf cloudforce-one events queries get v2 <queryId>` — Retrieve a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one requests constants` — Retrieves constant values used in Cloudforce One requests, including valid statuses and types. (supports --dry-run)\n- `cf cloudforce-one requests priority quota` — Retrieves quota usage for Cloudforce One priority requests. (supports --dry-run)\n- `cf cloudforce-one requests quota` — Retrieves quota usage for Cloudforce One standard requests. (supports --dry-run)\n- `cf cloudforce-one requests types` — Lists available request types for Cloudforce One intelligence requests. (supports --dry-run)\n- `cf cloudforce-one rules delete all rules` — Delete all rules in an account. (supports --dry-run)\n- `cf cloudforce-one rules delete one rule <id>` — Delete an existing rule. (supports --dry-run)\n- `cf cloudforce-one threat-events bulk-create` — The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets raw <eventId>` — Retrieves the raw data associated with an event. Searches across all shards in the dataset. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"connectivity": "# connectivity — Service directory for network connectivity endpoints and their configurations\n\n## Commands\n\n### Read Operations\n\n- `cf connectivity directory services get <serviceId>` — Retrieves details for a specific connectivity service entry.\n- `cf connectivity directory services list` — Lists all connectivity service entries in the directory.\n\n### Create Operations\n\n- `cf connectivity directory services create` — Creates a new connectivity service entry in the directory. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf connectivity directory services update <serviceId>` — Updates an existing connectivity service entry in the directory. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf connectivity directory services delete <serviceId>` — Removes a connectivity service entry from the directory. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"content-scanning": "# content-scanning — Scan uploaded content in HTTP requests for malware and malicious payloads\n\n## Commands\n\n### Read Operations\n\n- `cf content-scanning get` — Retrieve the current status of Content Scanning.\n- `cf content-scanning payloads list` — Get a list of existing custom scan expressions for Content Scanning.\n- `cf content-scanning settings get` — Retrieve the current status of Content Scanning.\n\n### Create Operations\n\n- `cf content-scanning create` — Update the Content Scanning status. (supports --dry-run, --body)\n- `cf content-scanning payloads create` — Add custom scan expressions for Content Scanning. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf content-scanning update` — Update the Content Scanning status. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf content-scanning payloads delete <expressionId>` — Delete a Content Scan Custom Expression. (supports --dry-run)\n\n### Other Operations\n\n- `cf content-scanning disable` — Disable Content Scanning. (supports --dry-run)\n- `cf content-scanning enable` — Enable Content Scanning. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-certificates": "# custom-certificates — Upload and manage your own SSL/TLS certificates for a zone, with priority ordering\n\n## Commands\n\n### Read Operations\n\n- `cf custom-certificates get <customCertificateId>` — Retrieves details for a specific custom SSL certificate, including certificate metadata, bundle method, geographic restrictions, and associated keyless server configuration.\n- `cf custom-certificates list` — List, search, and filter all of your custom SSL certificates. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates.\n\n### Create Operations\n\n- `cf custom-certificates create` — Upload a new SSL certificate for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-certificates edit <customCertificateId>` — Upload a new private key and/or PEM/CRT for the SSL certificate. Note: PATCHing a configuration for sni_custom certificates will result in a new resource id being returned, and the previous one being deleted. (supports --dry-run, --body)\n- `cf custom-certificates prioritize update` — If a zone has multiple SSL certificates, you can set the order in which they should be used during a request. The higher priority will break ties across overlapping 'legacy_custom' certificates. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-certificates delete <customCertificateId>` — Remove a SSL certificate from a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-hostnames": "# custom-hostnames — Bring custom vanity domains to your SaaS zone with per-hostname SSL and origin mapping\n\n## Commands\n\n### Read Operations\n\n- `cf custom-hostnames fallback-origin get` — Retrieves the current fallback origin configuration for custom hostnames on a zone. The fallback origin handles traffic when specific custom hostname origins are unavailable.\n- `cf custom-hostnames get <customHostnameId>` — Retrieves detailed information about a specific custom hostname, including SSL certificate status, ownership verification, and origin configuration.\n- `cf custom-hostnames list` — List, search, sort, and filter all of your custom hostnames.\n\n### Create Operations\n\n- `cf custom-hostnames create` — Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-hostnames certificate-pack certificates update <certificateId>` — Replace a single custom certificate within a certificate pack that contains two bundled certificates. The replacement must adhere to the following constraints. You can only replace an RSA certificate with another RSA certificate or an ECDSA certificate with another ECDSA certificate. (supports --dry-run, --body)\n- `cf custom-hostnames edit <customHostnameId>` — Modify SSL configuration for a custom hostname. When sent with SSL config that matches existing config, used to indicate that hostname should pass domain control validation (DCV). Can also be used to change validation type, e.g., from 'http' to 'email'. Bundle an existing certificate with another certificate by using the \"custom_cert_bundle\" field. The bundling process supports combining certificates as long as the following condition is met. One certificate must use the RSA algorithm, and the other must use the ECDSA algorithm. (supports --dry-run, --body)\n- `cf custom-hostnames fallback-origin update` — Updates the fallback origin configuration for custom hostnames on a zone. Sets the default origin server for custom hostname traffic. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-hostnames certificate-pack certificates delete <certificateId>` — Delete a single custom certificate from a certificate pack that contains two bundled certificates. Deletion is subject to the following constraints. You cannot delete a certificate if it is the only remaining certificate in the pack. At least one certificate must remain in the pack. (supports --dry-run, --body)\n- `cf custom-hostnames delete <customHostnameId>` — Permanently deletes a custom hostname and revokes any SSL certificates that were issued for it. This action cannot be undone. (supports --dry-run, --body)\n- `cf custom-hostnames fallback-origin delete` — Removes the fallback origin configuration for custom hostnames on a zone. Custom hostnames without specific origins will no longer have a fallback. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-nameservers": "# custom-nameservers — Vanity nameservers that use your own domain instead of Cloudflare-assigned NS records\n\n## Commands\n\n### Read Operations\n\n- `cf custom-nameservers get` — List an account's custom nameservers.\n\n### Create Operations\n\n- `cf custom-nameservers create` — Adds a custom nameserver to the account for use as a vanity nameserver on zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-nameservers delete <customNsId>` — Removes a custom nameserver from the account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-pages": "# custom-pages — Custom error and challenge pages (1000s, WAF blocks, captchas) for zones and accounts\n\n## Commands\n\n### Read Operations\n\n- `cf custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages list` — Fetches all the custom pages at the account level.\n- `cf custom-pages zone-custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages zone-custom-pages list` — Fetches all the custom pages at the zone level.\n\n### Update Operations\n\n- `cf custom-pages account-custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n- `cf custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf custom-pages assets create custom asset` — Creates a new custom asset at the account level. (supports --dry-run, --body)\n- `cf custom-pages assets create v2 <zoneIdentifier>` — Creates a new custom asset at the zone level. (supports --dry-run, --body)\n- `cf custom-pages assets delete custom asset <assetName>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets delete v2 <assetName>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets get custom asset <assetName>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets get v2 <assetName>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets list custom assets` — Fetches all the custom assets at the account level. (supports --dry-run)\n- `cf custom-pages assets list v2 <zoneIdentifier>` — Fetches all the custom assets at the zone level. (supports --dry-run)\n- `cf custom-pages assets update custom asset <assetName>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n- `cf custom-pages assets update v2 <assetName>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"d1": "# d1 — D1 is Cloudflare's managed, serverless database with SQLite's SQL semantics, built-in disaster recovery, and Worker and HTTP API access.\n\n## Commands\n\n### Read Operations\n\n- `cf d1 export <databaseId>` — Returns a URL where the SQL contents of your D1 can be downloaded. Note: this process may take some time for larger DBs, during which your D1 will be unavailable to serve queries. To avoid blocking your DB unnecessarily, an in-progress export must be continually polled or will automatically cancel. (supports --body)\n- `cf d1 get <databaseId>` — Returns the specified D1 database.\n- `cf d1 list` — Returns a list of D1 databases.\n\n### Create Operations\n\n- `cf d1 create` — Returns the created D1 database. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf d1 edit <databaseId>` — Updates partially the specified D1 database. (supports --dry-run, --body)\n- `cf d1 update <databaseId>` — Updates the specified D1 database. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf d1 delete <databaseId>` — Deletes the specified D1 database. (supports --dry-run)\n\n### Other Operations\n\n- `cf d1 import <databaseId>` — Generates a temporary URL for uploading an SQL file to, then instructing the D1 to import it and polling it for status updates. Imports block the D1 for their duration. (supports --dry-run, --body)\n- `cf d1 query <databaseId>` — Returns the query result as an object. (supports --dry-run, --body)\n- `cf d1 raw <databaseId>` — Returns the query result rows as arrays rather than objects. This is a performance-optimized version of the /query endpoint. (supports --dry-run, --body)\n- `cf d1 time-travel get-bookmark <databaseId>` — Retrieves the current bookmark, or the nearest bookmark at or before a provided timestamp. Bookmarks can be used with the restore endpoint to revert the database to a previous point in time. (supports --dry-run)\n- `cf d1 time-travel restore <databaseId>` — Restores a D1 database to a previous point in time either via a bookmark or a timestamp. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"cloudforce-one": "# cloudforce-one — Threat intelligence platform — request investigations, scan indicators, and track threat events\n\n## Commands\n\n### Read Operations\n\n- `cf cloudforce-one binary-storage get <hash>` — Retrieves a binary file from the Cloudforce One binary storage for analysis.\n- `cf cloudforce-one events aggregate get` — Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.\n- `cf cloudforce-one events categories catalog get` — List all categories stored in the account catalog.\n- `cf cloudforce-one events dataset events get <event-id>` — Retrieves a specific event by its UUID.\n- `cf cloudforce-one events dataset groups members get <group-id>` — List group members\n- `cf cloudforce-one events dataset indicators tags get <dataset-id>` — Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.\n- `cf cloudforce-one events dataset permissions get <dataset-id>` — List permissions\n- `cf cloudforce-one events dataset tags indicators get <tag-uuid>` — Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets.\n- `cf cloudforce-one events dataset target industries get <dataset-id>` — List all target industries referenced in events for a specific dataset.\n- `cf cloudforce-one events indicator types get` — List indicator types across one or more datasets for the account.\n- `cf cloudforce-one events indicators get` — Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.\n- `cf cloudforce-one events relationships get <event-id>` — The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.\n- `cf cloudforce-one events tags categories get` — Returns all Source-of-Truth tag categories for an account.\n- `cf cloudforce-one events tags get` — Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.\n- `cf cloudforce-one events target industries catalog get` — List all predefined target industries from the industry map catalog.\n- `cf cloudforce-one requests assets get <asset-id>` — Retrieves an asset attached to a Cloudforce One intelligence request.\n- `cf cloudforce-one requests get <request-id>` — Retrieves details for a specific Cloudforce One intelligence request.\n- `cf cloudforce-one requests list` — Lists Cloudforce One intelligence requests with filtering and pagination. (supports --body)\n- `cf cloudforce-one requests message get <request-id>` — Lists messages in a Cloudforce One intelligence request conversation. (supports --body)\n- `cf cloudforce-one requests priority get <priority-id>` — Retrieves a specific priority intelligence request from Cloudforce One.\n- `cf cloudforce-one requests priority list` — Lists priority intelligence requests in Cloudforce One. (supports --body)\n- `cf cloudforce-one rules get <id>` — Get a single rule by ID.\n- `cf cloudforce-one rules list` — List all rules for an account with optional filtering.\n- `cf cloudforce-one rules stats get` — Get statistics about rules for the dashboard.\n- `cf cloudforce-one rules tree get` — Get the folder tree structure for rules navigation.\n- `cf cloudforce-one scans config list` — List Scan Configs\n- `cf cloudforce-one scans results get <config-id>` — Get the Latest Scan Result\n- `cf cloudforce-one threat-events attackers list` — List attacker names referenced in events across one or more datasets.\n- `cf cloudforce-one threat-events categories get <category-id>` — Retrieve a single category by its identifier.\n- `cf cloudforce-one threat-events categories list` — List categories across one or more datasets for the account.\n- `cf cloudforce-one threat-events countries list` — Retrieve country code information for all supported countries.\n- `cf cloudforce-one threat-events datasets get <dataset-id>` — Retrieve metadata for a specific dataset.\n- `cf cloudforce-one threat-events datasets list` — List all datasets accessible to the account.\n- `cf cloudforce-one threat-events get <event-id>` — This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.\n- `cf cloudforce-one threat-events indicator-types list` — This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.\n- `cf cloudforce-one threat-events list` — Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.\n- `cf cloudforce-one threat-events raw get <raw-id>` — Retrieve raw data for a specific event.\n- `cf cloudforce-one threat-events target-industries list` — List target industries referenced in events across one or more datasets.\n\n### Create Operations\n\n- `cf cloudforce-one binary-storage create` — Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. (supports --dry-run, --body)\n- `cf cloudforce-one events categories create <category-id>` — Update an existing category by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one events create <event-id>` — Update an existing event by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset copy create <dataset-id>` — Copy one or more events from a source dataset to a destination dataset. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset create <dataset-id>` — Update an existing dataset by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups create` — Create a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups members create <group-id>` — Create a group member (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicator types create create <dataset-id>` — Creates a new indicator type and initializes its dedicated Durable Object (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators bulk create <dataset-id>` — Creates multiple indicators at once with their respective types and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators create create <dataset-id>` — Creates a new indicator with the specified type and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset move create <dataset-id>` — Move one or more events from a source dataset to a destination dataset. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions create <dataset-id>` — Create a permission (supports --dry-run, --body)\n- `cf cloudforce-one events datasets populate create` — Populate dataset-specific lookup tables by scanning existing event data with batch processing. (supports --dry-run)\n- `cf cloudforce-one events queries create <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events raw create <raw-id>` — Update raw data for a specific event. (supports --dry-run, --body)\n- `cf cloudforce-one events relate create create <event-id>` — Create one or more references between events. (supports --dry-run, --body)\n- `cf cloudforce-one events relationships create create` — Creates a directed relationship between two events. The relationship is from parent to child with a specified type. (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories create create` — Creates a new Source-of-Truth tag category for an account. (supports --dry-run, --body)\n- `cf cloudforce-one requests asset-new create <request-id>` — Uploads a new asset to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets create <request-id>` — Lists assets attached to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests create` — Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. (supports --dry-run, --body)\n- `cf cloudforce-one requests message create <request-id>` — Adds a message to a Cloudforce One intelligence request conversation. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority create` — Creates a new priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one rules create` — Create a new detection rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules validate create` — Validate rule syntax, name uniqueness, namespace, and meta checks. (supports --dry-run, --body)\n- `cf cloudforce-one scans config create` — Create a new Scan Config (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories create` — Create a new event category for the account. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events create` — To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets create` — Create a new dataset in the account. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events event-tags create <event-id>` — Add one or more tags to an event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events tags create` — Creates a new tag to be used accross threat events. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf cloudforce-one events dataset groups update <group-id>` — Update a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators patch <indicator-id>` — Updates an existing indicator's properties. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions update <grant-id>` — Update a permission (supports --dry-run, --body)\n- `cf cloudforce-one events queries patch <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories patch <category-uuid>` — Updates a Source-of-Truth tag category by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags patch <tag-uuid>` — Updates a Source-of-Truth tag by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events update bulk patch` — Updates multiple events with the same field values. Maximum 100 events per request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets update <asset-id>` — Updates an asset in a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests message update <message-id>` — Updates a message in a Cloudforce One intelligence request thread. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority update <priority-id>` — Updates a priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one requests update <request-id>` — Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. (supports --dry-run, --body)\n- `cf cloudforce-one rules update <id>` — Update an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one scans config edit <config-id>` — Update an existing Scan Config (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories edit <category-id>` — Update an existing category by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets edit <dataset-id>` — Update an existing dataset by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events edit <event-id>` — Update an existing event by its identifier. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events raw edit <raw-id>` — Update raw data for a specific event. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cloudforce-one events dataset delete <dataset-id>` — Soft-deletes a dataset given a datasetId. (supports --dry-run)\n- `cf cloudforce-one events dataset groups delete <group-id>` — Delete a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups members delete <member-id>` — Delete a group member (supports --dry-run)\n- `cf cloudforce-one events dataset indicators delete <indicator-id>` — Deletes a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events dataset permissions delete <grant-id>` — Delete a permission (supports --dry-run)\n- `cf cloudforce-one events delete delete <dataset-id>` — Delete one or more events from a dataset. (supports --dry-run)\n- `cf cloudforce-one events queries delete <query-id>` — Delete a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories delete <category-uuid>` — Deletes a Source-of-Truth tag category by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags delete <tag-uuid>` — Deletes a Source-of-Truth tag by UUID. (supports --dry-run)\n- `cf cloudforce-one requests assets delete <asset-id>` — Removes an asset from a Cloudforce One intelligence request. (supports --dry-run)\n- `cf cloudforce-one requests delete <request-id>` — Deletes a Cloudforce One intelligence request and all associated data. (supports --dry-run)\n- `cf cloudforce-one requests message delete <message-id>` — Removes a message from a Cloudforce One intelligence request thread. (supports --dry-run)\n- `cf cloudforce-one requests priority delete <priority-id>` — Deletes a priority intelligence request from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one scans config delete <config-id>` — Delete a Scan Config (supports --dry-run)\n- `cf cloudforce-one threat-events categories delete <category-id>` — Delete a category by its identifier. (supports --dry-run)\n- `cf cloudforce-one threat-events event-tags delete <event-id>` — Remove one or more tags from an event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events relate delete <event-id>` — Remove one or more references from an event. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf cloudforce-one events dataset groups get group` — List groups for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups get v2 <group-id>` — Read a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset indicators get indicator <indicator-id>` — Retrieves a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph ql` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph qlv2` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events queries create-create` — Create a new saved event query for the account (supports --dry-run, --body)\n- `cf cloudforce-one events queries get event` — Retrieve all saved event queries for the account (supports --dry-run)\n- `cf cloudforce-one events queries get v2 <query-id>` — Retrieve a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one requests constants` — Retrieves constant values used in Cloudforce One requests, including valid statuses and types. (supports --dry-run)\n- `cf cloudforce-one requests priority quota` — Retrieves quota usage for Cloudforce One priority requests. (supports --dry-run)\n- `cf cloudforce-one requests quota` — Retrieves quota usage for Cloudforce One standard requests. (supports --dry-run)\n- `cf cloudforce-one requests types` — Lists available request types for Cloudforce One intelligence requests. (supports --dry-run)\n- `cf cloudforce-one rules delete all rules` — Delete all rules in an account. (supports --dry-run)\n- `cf cloudforce-one rules delete one rule <id>` — Delete an existing rule. (supports --dry-run)\n- `cf cloudforce-one threat-events bulk-create` — The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets raw <event-id>` — Retrieves the raw data associated with an event. Searches across all shards in the dataset. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"connectivity": "# connectivity — Service directory for network connectivity endpoints and their configurations\n\n## Commands\n\n### Read Operations\n\n- `cf connectivity directory services get <service-id>` — Get Workers VPC connectivity service\n- `cf connectivity directory services list` — List Workers VPC connectivity services\n\n### Create Operations\n\n- `cf connectivity directory services create` — Create Workers VPC connectivity service (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf connectivity directory services update <service-id>` — Update Workers VPC connectivity service (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf connectivity directory services delete <service-id>` — Delete Workers VPC connectivity service (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"content-scanning": "# content-scanning — Scan uploaded content in HTTP requests for malware and malicious payloads\n\n## Commands\n\n### Read Operations\n\n- `cf content-scanning get` — Retrieve the current status of Content Scanning.\n- `cf content-scanning payloads list` — Get a list of existing custom scan expressions for Content Scanning.\n\n### Create Operations\n\n- `cf content-scanning create` — Update the Content Scanning status. (supports --dry-run, --body)\n- `cf content-scanning payloads create` — Add custom scan expressions for Content Scanning. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf content-scanning payloads delete <expression-id>` — Delete a Content Scan Custom Expression. (supports --dry-run)\n\n### Other Operations\n\n- `cf content-scanning disable` — Disable Content Scanning. (supports --dry-run)\n- `cf content-scanning enable` — Enable Content Scanning. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-certificates": "# custom-certificates — Upload and manage your own SSL/TLS certificates for a zone, with priority ordering\n\n## Commands\n\n### Read Operations\n\n- `cf custom-certificates get <custom-certificate-id>` — Retrieves details for a specific custom SSL certificate, including certificate metadata, bundle method, geographic restrictions, and associated keyless server configuration.\n- `cf custom-certificates list` — List, search, and filter all of your custom SSL certificates. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates.\n\n### Create Operations\n\n- `cf custom-certificates create` — Upload a new SSL certificate for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-certificates edit <custom-certificate-id>` — Upload a new private key and/or PEM/CRT for the SSL certificate. Note: PATCHing a configuration for sni_custom certificates will result in a new resource id being returned, and the previous one being deleted. (supports --dry-run, --body)\n- `cf custom-certificates prioritize update` — If a zone has multiple SSL certificates, you can set the order in which they should be used during a request. The higher priority will break ties across overlapping 'legacy_custom' certificates. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-certificates delete <custom-certificate-id>` — Remove a SSL certificate from a zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-hostnames": "# custom-hostnames — Bring custom vanity domains to your SaaS zone with per-hostname SSL and origin mapping\n\n## Commands\n\n### Read Operations\n\n- `cf custom-hostnames fallback-origin get` — Retrieves the current fallback origin configuration for custom hostnames on a zone. The fallback origin handles traffic when specific custom hostname origins are unavailable.\n- `cf custom-hostnames get <custom-hostname-id>` — Retrieves detailed information about a specific custom hostname, including SSL certificate status, ownership verification, and origin configuration.\n- `cf custom-hostnames list` — List, search, sort, and filter all of your custom hostnames.\n\n### Create Operations\n\n- `cf custom-hostnames create` — Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-hostnames certificate-pack certificates update <certificate-id>` — Replace a single custom certificate within a certificate pack that contains two bundled certificates. The replacement must adhere to the following constraints. You can only replace an RSA certificate with another RSA certificate or an ECDSA certificate with another ECDSA certificate. (supports --dry-run, --body)\n- `cf custom-hostnames edit <custom-hostname-id>` — Modify SSL configuration for a custom hostname. When sent with SSL config that matches existing config, used to indicate that hostname should pass domain control validation (DCV). Can also be used to change validation type, e.g., from 'http' to 'email'. Bundle an existing certificate with another certificate by using the \"custom_cert_bundle\" field. The bundling process supports combining certificates as long as the following condition is met. One certificate must use the RSA algorithm, and the other must use the ECDSA algorithm. (supports --dry-run, --body)\n- `cf custom-hostnames fallback-origin update` — Updates the fallback origin configuration for custom hostnames on a zone. Sets the default origin server for custom hostname traffic. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-hostnames certificate-pack certificates delete <certificate-id>` — Delete a single custom certificate from a certificate pack that contains two bundled certificates. Deletion is subject to the following constraints. You cannot delete a certificate if it is the only remaining certificate in the pack. At least one certificate must remain in the pack. (supports --dry-run)\n- `cf custom-hostnames delete <custom-hostname-id>` — Permanently deletes a custom hostname and revokes any SSL certificates that were issued for it. This action cannot be undone. (supports --dry-run)\n- `cf custom-hostnames fallback-origin delete` — Removes the fallback origin configuration for custom hostnames on a zone. Custom hostnames without specific origins will no longer have a fallback. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-nameservers": "# custom-nameservers — Vanity nameservers that use your own domain instead of Cloudflare-assigned NS records\n\n## Commands\n\n### Read Operations\n\n- `cf custom-nameservers get` — List an account's custom nameservers.\n\n### Create Operations\n\n- `cf custom-nameservers create` — Adds a custom nameserver to the account for use as a vanity nameserver on zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-nameservers delete <custom-ns-id>` — Removes a custom nameserver from the account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-pages": "# custom-pages — Custom error and challenge pages (1000s, WAF blocks, captchas) for zones and accounts\n\n## Commands\n\n### Read Operations\n\n- `cf custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages list` — Fetches all the custom pages at the account level.\n- `cf custom-pages zone-custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages zone-custom-pages list` — Fetches all the custom pages at the zone level.\n\n### Update Operations\n\n- `cf custom-pages account-custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n- `cf custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf custom-pages assets create custom asset` — Creates a new custom asset at the account level. (supports --dry-run, --body)\n- `cf custom-pages assets create v2 <zone-identifier>` — Creates a new custom asset at the zone level. (supports --dry-run, --body)\n- `cf custom-pages assets delete custom asset <asset-name>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets delete v2 <asset-name>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets get custom asset <asset-name>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets get v2 <asset-name>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets list custom assets` — Fetches all the custom assets at the account level. (supports --dry-run)\n- `cf custom-pages assets list v2 <zone-identifier>` — Fetches all the custom assets at the zone level. (supports --dry-run)\n- `cf custom-pages assets update custom asset <asset-name>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n- `cf custom-pages assets update v2 <asset-name>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"d1": "# d1 — D1 is Cloudflare's managed, serverless database with SQLite's SQL semantics, built-in disaster recovery, and Worker and HTTP API access.\n\n## Commands\n\n### Read Operations\n\n- `cf d1 export <database-id>` — Returns a URL where the SQL contents of your D1 can be downloaded. Note: this process may take some time for larger DBs, during which your D1 will be unavailable to serve queries. To avoid blocking your DB unnecessarily, an in-progress export must be continually polled or will automatically cancel. (supports --body)\n- `cf d1 get <database-id>` — Returns the specified D1 database.\n- `cf d1 list` — Returns a list of D1 databases.\n\n### Create Operations\n\n- `cf d1 create` — Returns the created D1 database. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf d1 edit <database-id>` — Updates partially the specified D1 database. (supports --dry-run, --body)\n- `cf d1 update <database-id>` — Updates the specified D1 database. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf d1 delete <database-id>` — Deletes the specified D1 database. (supports --dry-run)\n\n### Other Operations\n\n- `cf d1 import <database-id>` — Generates a temporary URL for uploading an SQL file to, then instructing the D1 to import it and polling it for status updates. Imports block the D1 for their duration. (supports --dry-run, --body)\n- `cf d1 query <database-id>` — Returns the query result as an object. (supports --dry-run, --body)\n- `cf d1 raw <database-id>` — Returns the query result rows as arrays rather than objects. This is a performance-optimized version of the /query endpoint. (supports --dry-run, --body)\n- `cf d1 time-travel get-bookmark <database-id>` — Retrieves the current bookmark, or the nearest bookmark at or before a provided timestamp. Bookmarks can be used with the restore endpoint to revert the database to a previous point in time. (supports --dry-run)\n- `cf d1 time-travel restore <database-id>` — Restores a D1 database to a previous point in time either via a bookmark or a timestamp. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"data-security": "# data-security — data-security\n\n## Commands\n\n### Update Operations\n\n- `cf data-security posture update <webhook-id>` — Updates an existing webhook configuration with new settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf data-security posture delete <webhook-id>` — Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. (supports --dry-run)\n\n### Other Operations\n\n- `cf data-security posture archiveFindingInstance <finding-id>` — Archive one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture changeFindingSeverity <finding-id>` — Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. (supports --dry-run)\n- `cf data-security posture createContentExport` — Creates a CSV export for content and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingExportCSV` — Creates a CSV export for findings and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingInstancesExportCSV <storage-namespace-id>` — Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobs` — Create one or more remediation jobs tied to a specific Cloudflare Account. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobsExportCSV` — Creates a CSV export for remediation jobs and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createWebhook` — Creates a new webhook configuration for sending finding notifications to external endpoints. (supports --dry-run, --body)\n- `cf data-security posture createWebhookJobs` — Creates webhook jobs to send a finding instance to one or more configured webhooks. (supports --dry-run, --body)\n- `cf data-security posture evaluateExistingWebhook <webhook-id>` — Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run)\n- `cf data-security posture evaluateNewWebhook` — Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run, --body)\n- `cf data-security posture getExportJob <id>` — Retrieves a single export job by its unique identifier (supports --dry-run)\n- `cf data-security posture getFinding <finding-id>` — Gets a security Finding that has been identified as being problematic. (supports --dry-run)\n- `cf data-security posture getFindingInstance <instance-id>` — Gets a security Finding instance by id. (supports --dry-run)\n- `cf data-security posture getFindingType <finding-type-id>` — Retrieve a specific finding type by its unique identifier. (supports --dry-run)\n- `cf data-security posture getRemediationTypesForFindingType <finding-type-id>` — List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. (supports --dry-run)\n- `cf data-security posture getWebhookConfigByID <webhook-id>` — Retrieves a specific webhook configuration by its unique identifier. (supports --dry-run)\n- `cf data-security posture ignoreFinding` — Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. (supports --dry-run, --body)\n- `cf data-security posture listExportJobs` — List all export jobs for a given requestor's organization (supports --dry-run)\n- `cf data-security posture listFindingInstances <finding-id>` — Lists all security finding instances for a given security finding. (supports --dry-run)\n- `cf data-security posture listFindingTypes` — List all available finding types with pagination support. (supports --dry-run)\n- `cf data-security posture listWebhooks` — Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. (supports --dry-run)\n- `cf data-security posture resetFindingSeverity <finding-id>` — If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. (supports --dry-run)\n- `cf data-security posture unarchiveFindingInstance <finding-id>` — Remove the archive marking from one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture unIgnoreFinding` — Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dcv-delegation": "# dcv-delegation — Delegate domain control validation (DCV) to Cloudflare so certificates auto-renew without manual DNS changes\n\n## Commands\n\n### Read Operations\n\n- `cf dcv-delegation get` — Retrieve the account and zone specific unique identifier used as part of the CNAME target for DCV Delegation.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"diagnostics": "# diagnostics — Network diagnostic tools — traceroutes from Cloudflare's edge and endpoint health checks\n\n## Commands\n\n### Read Operations\n\n- `cf diagnostics endpoint-healthchecks get <id>` — Get a single Endpoint Health Check.\n- `cf diagnostics endpoint-healthchecks list` — List Endpoint Health Checks.\n\n### Create Operations\n\n- `cf diagnostics endpoint-healthchecks create` — Create Endpoint Health Check. (supports --dry-run, --body)\n- `cf diagnostics traceroutes create` — Run traceroutes from Cloudflare colos. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf diagnostics endpoint-healthchecks update <id>` — Update a Endpoint Health Check. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf diagnostics endpoint-healthchecks delete <id>` — Delete Endpoint Health Check. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"dispatch-namespaces": "# dispatch-namespaces — Workers for Platforms dispatch namespaces — isolate customer Workers for SaaS and multi-tenant deployments\n\n## Commands\n\n### Read Operations\n\n- `cf dispatch-namespaces get <dispatchNamespace>` — Get a Workers for Platforms namespace.\n- `cf dispatch-namespaces list` — Fetch a list of Workers for Platforms namespaces.\n- `cf dispatch-namespaces scripts bindings get <scriptName>` — Fetch script bindings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts content get <scriptName>` — Fetch script content from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts get <scriptName>` — Fetch information about a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts list` — Fetch a list of scripts uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets get <secretName>` — Get a given secret binding (value omitted) on a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets list` — List secrets bound to a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts settings get <scriptName>` — Get script settings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts tags list` — Fetch tags from a script uploaded to a Workers for Platforms namespace.\n\n### Create Operations\n\n- `cf dispatch-namespaces create` — Create a new Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts asset-upload create <scriptName>` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags create <tag>` — Put a single tag on a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Update Operations\n\n- `cf dispatch-namespaces edit <dispatchNamespace>` — Patch a Workers for Platforms namespace. Omitted fields are left unchanged. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts content update <scriptName>` — Put script content for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts secrets update <scriptName>` — Add a secret to a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts settings edit <scriptName>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags update <scriptName>` — Put script tags for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts update <scriptName>` — Upload a worker module to a Workers for Platforms namespace. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf dispatch-namespaces update <dispatchNamespace>` — Update a Workers for Platforms namespace. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dispatch-namespaces delete <dispatchNamespace>` — Delete a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts delete <scriptName>` — Delete a worker from a Workers for Platforms namespace. This call has no response body on a successful delete. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts secrets delete <secretName>` — Remove a secret from a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts tags delete <tag>` — Delete script tag for a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Other Operations\n\n- `cf dispatch-namespaces scripts bulk-delete` — Delete multiple scripts from a Workers for Platforms namespace based on optional tag filters. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"dns": "# dns — DNS management API for zones, records, DNSSEC, analytics, and zone transfers\n\n## Commands\n\n### Read Operations\n\n- `cf dns analytics reports bytimes get` — Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns analytics reports get` — Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns dnssec get` — Details about DNSSEC status and configuration.\n- `cf dns records export` — You can export your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information.\n- `cf dns records get <dnsRecordId>` — Retrieves details for a specific DNS record in the zone.\n- `cf dns records list` — List, search, sort, and filter a zones' DNS records.\n- `cf dns settings account get` — Show DNS settings for an account\n- `cf dns settings account views get <viewId>` — Get DNS Internal View\n- `cf dns settings account views list` — List DNS Internal Views for an Account\n- `cf dns settings zone get` — Show DNS settings for a zone\n- `cf dns usage account get` — Get the current DNS record usage and quota for an account. May include internal DNS usage and quota.\n- `cf dns usage zone get` — Get the current DNS record usage for a zone, including the number of records and the quota limit.\n- `cf dns zone-transfers acls get <aclId>` — Get ACL.\n- `cf dns zone-transfers acls list` — List ACLs.\n- `cf dns zone-transfers incoming get` — Get secondary zone configuration for incoming zone transfers.\n- `cf dns zone-transfers outgoing get` — Get primary zone configuration for outgoing zone transfers.\n- `cf dns zone-transfers outgoing status get` — Get primary zone transfer status.\n- `cf dns zone-transfers peers get <peerId>` — Get Peer.\n- `cf dns zone-transfers peers list` — List Peers.\n- `cf dns zone-transfers tsigs get <tsigId>` — Get TSIG.\n- `cf dns zone-transfers tsigs list` — List TSIGs.\n\n### Create Operations\n\n- `cf dns records create` — Create a new DNS record for a zone. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account views create` — Create Internal DNS View for an account (supports --dry-run, --body)\n- `cf dns zone-transfers acls create` — Create ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers force-axfr create` — Sends AXFR zone transfer request to primary nameserver(s). (supports --dry-run, --body)\n- `cf dns zone-transfers incoming create` — Create secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing create` — Create primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers create` — Create Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs create` — Create TSIG. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns dnssec edit` — Enable or disable DNSSEC. (supports --dry-run, --body)\n- `cf dns records edit <dnsRecordId>` — Update an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns records update <dnsRecordId>` — Overwrite an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account edit` — Update DNS settings for an account (supports --dry-run, --body)\n- `cf dns settings account views edit <viewId>` — Update an existing Internal DNS View (supports --dry-run, --body)\n- `cf dns settings zone edit` — Update DNS settings for a zone (supports --dry-run, --body)\n- `cf dns zone-transfers acls update <aclId>` — Modify ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers incoming update` — Update secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing update` — Update primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers update <peerId>` — Modify Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs update <tsigId>` — Modify TSIG. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns dnssec delete` — Delete DNSSEC. (supports --dry-run, --body)\n- `cf dns records delete <dnsRecordId>` — Permanently removes a DNS record from the zone. (supports --dry-run, --body)\n- `cf dns settings account views delete <viewId>` — Delete an existing Internal DNS View (supports --dry-run, --body)\n- `cf dns zone-transfers acls delete <aclId>` — Delete ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers incoming delete` — Delete secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing delete` — Delete primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers delete <peerId>` — Delete Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs delete <tsigId>` — Delete TSIG. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf dns dnssec list zsks` — List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone. (supports --dry-run)\n- `cf dns records batch` — Send a Batch of DNS Record API calls to be executed together. Notes: - Although Cloudflare will execute the batched operations in a single database transaction, Cloudflare's distributed KV store must treat each record change as a single key-value pair. This means that the propagation of changes is not atomic. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/batch-record-changes/ \"Batch DNS records\") for more information. - The operations you specify within the /batch request body are always executed in the following order: - Deletes - Patches - Puts - Posts (supports --dry-run, --body)\n- `cf dns records import` — You can upload your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. It assumes that cURL is called from a location with bind_config.txt (valid BIND config) present. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information. (supports --dry-run, --body)\n- `cf dns records scan` — Scan for common DNS records on your domain and automatically add them to your zone. Useful if you haven't updated your nameservers yet. (supports --dry-run, --body)\n- `cf dns records scan-list` — Retrieves the list of DNS records discovered up to this point by the asynchronous scan. These records are temporary until explicitly accepted or rejected via `POST /scan/review`. Additional records may be discovered by the scan later. (supports --dry-run)\n- `cf dns records scan-review` — Accept or reject DNS records found by the DNS records scan. Accepted records will be permanently added to the zone, while rejected records will be permanently deleted. (supports --dry-run, --body)\n- `cf dns records scan-trigger` — Initiates an asynchronous scan for common DNS records on your domain. Note that this **does not** automatically add records to your zone. The scan runs in the background, and results can be reviewed later using the `/scan/review` endpoints. Useful if you haven't updated your nameservers yet. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing disable` — Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing enable` — Enable outgoing zone transfers for primary zone. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing force-notify` — Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"dns-firewall": "# dns-firewall — DNS proxy clusters that filter and forward DNS queries with DDoS protection and caching\n\n## Commands\n\n### Read Operations\n\n- `cf dns-firewall analytics reports bytimes get <dnsFirewallId>` — Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns-firewall analytics reports get <dnsFirewallId>` — Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns-firewall get <dnsFirewallId>` — Show a single DNS Firewall cluster for an account\n- `cf dns-firewall list` — List DNS Firewall clusters for an account\n- `cf dns-firewall reverse-dns get <dnsFirewallId>` — Show reverse DNS configuration (PTR records) for a DNS Firewall cluster\n\n### Create Operations\n\n- `cf dns-firewall create` — Create a DNS Firewall cluster (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns-firewall edit <dnsFirewallId>` — Modify the configuration of a DNS Firewall cluster (supports --dry-run, --body)\n- `cf dns-firewall reverse-dns edit <dnsFirewallId>` — Update reverse DNS configuration (PTR records) for a DNS Firewall cluster (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns-firewall delete <dnsFirewallId>` — Delete a DNS Firewall cluster (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"dispatch-namespaces": "# dispatch-namespaces — Workers for Platforms dispatch namespaces — isolate customer Workers for SaaS and multi-tenant deployments\n\n## Commands\n\n### Read Operations\n\n- `cf dispatch-namespaces get <dispatch-namespace>` — Get a Workers for Platforms namespace.\n- `cf dispatch-namespaces list` — Fetch a list of Workers for Platforms namespaces.\n- `cf dispatch-namespaces scripts bindings get <script-name>` — Fetch script bindings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts content get <script-name>` — Fetch script content from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts get <script-name>` — Fetch information about a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts list` — Fetch a list of scripts uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets get <secret-name>` — Get a given secret binding (value omitted) on a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets list` — List secrets bound to a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts settings get <script-name>` — Get script settings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts tags list` — Fetch tags from a script uploaded to a Workers for Platforms namespace.\n\n### Create Operations\n\n- `cf dispatch-namespaces create` — Create a new Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts asset-upload create <script-name>` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags create <tag>` — Put a single tag on a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Update Operations\n\n- `cf dispatch-namespaces edit <dispatch-namespace>` — Patch a Workers for Platforms namespace. Omitted fields are left unchanged. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts content update <script-name>` — Put script content for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts secrets update <script-name>` — Add a secret to a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts settings edit <script-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags update <script-name>` — Put script tags for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts update <script-name>` — Upload a worker module to a Workers for Platforms namespace. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf dispatch-namespaces update <dispatch-namespace>` — Update a Workers for Platforms namespace. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dispatch-namespaces delete <dispatch-namespace>` — Delete a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts delete <script-name>` — Delete a worker from a Workers for Platforms namespace. This call has no response body on a successful delete. (supports --dry-run)\n- `cf dispatch-namespaces scripts secrets delete <secret-name>` — Remove a secret from a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts tags delete <tag>` — Delete script tag for a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Other Operations\n\n- `cf dispatch-namespaces scripts bulk-delete` — Delete multiple scripts from a Workers for Platforms namespace based on optional tag filters. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"dns": "# dns — DNS management API for zones, records, DNSSEC, analytics, and zone transfers\n\n## Commands\n\n### Read Operations\n\n- `cf dns analytics reports bytimes get` — Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns analytics reports get` — Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns dnssec get` — Details about DNSSEC status and configuration.\n- `cf dns records export` — You can export your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information.\n- `cf dns records get <dns-record-id>` — Retrieves details for a specific DNS record in the zone.\n- `cf dns records list` — List, search, sort, and filter a zones' DNS records.\n- `cf dns settings account get` — Show DNS settings for an account\n- `cf dns settings account views get <view-id>` — Get DNS Internal View\n- `cf dns settings account views list` — List DNS Internal Views for an Account\n- `cf dns settings zone get` — Show DNS settings for a zone\n- `cf dns usage account get` — Get the current DNS record usage and quota for an account. May include internal DNS usage and quota.\n- `cf dns usage zone get` — Get the current DNS record usage for a zone, including the number of records and the quota limit.\n- `cf dns zone-transfers acls get <acl-id>` — Get ACL.\n- `cf dns zone-transfers acls list` — List ACLs.\n- `cf dns zone-transfers incoming get` — Get secondary zone configuration for incoming zone transfers.\n- `cf dns zone-transfers outgoing get` — Get primary zone configuration for outgoing zone transfers.\n- `cf dns zone-transfers outgoing status get` — Get primary zone transfer status.\n- `cf dns zone-transfers peers get <peer-id>` — Get Peer.\n- `cf dns zone-transfers peers list` — List Peers.\n- `cf dns zone-transfers tsigs get <tsig-id>` — Get TSIG.\n- `cf dns zone-transfers tsigs list` — List TSIGs.\n\n### Create Operations\n\n- `cf dns records create` — Create a new DNS record for a zone. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account views create` — Create Internal DNS View for an account (supports --dry-run, --body)\n- `cf dns zone-transfers acls create` — Create ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers force-axfr create` — Sends AXFR zone transfer request to primary nameserver(s). (supports --dry-run)\n- `cf dns zone-transfers incoming create` — Create secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing create` — Create primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers create` — Create Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs create` — Create TSIG. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns dnssec edit` — Enable or disable DNSSEC. (supports --dry-run, --body)\n- `cf dns records edit <dns-record-id>` — Update an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns records update <dns-record-id>` — Overwrite an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account edit` — Update DNS settings for an account (supports --dry-run, --body)\n- `cf dns settings account views edit <view-id>` — Update an existing Internal DNS View (supports --dry-run, --body)\n- `cf dns settings zone edit` — Update DNS settings for a zone (supports --dry-run, --body)\n- `cf dns zone-transfers acls update <acl-id>` — Modify ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers incoming update` — Update secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing update` — Update primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers update <peer-id>` — Modify Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs update <tsig-id>` — Modify TSIG. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns dnssec delete` — Delete DNSSEC. (supports --dry-run)\n- `cf dns records delete <dns-record-id>` — Permanently removes a DNS record from the zone. (supports --dry-run)\n- `cf dns settings account views delete <view-id>` — Delete an existing Internal DNS View (supports --dry-run)\n- `cf dns zone-transfers acls delete <acl-id>` — Delete ACL. (supports --dry-run)\n- `cf dns zone-transfers incoming delete` — Delete secondary zone configuration for incoming zone transfers. (supports --dry-run)\n- `cf dns zone-transfers outgoing delete` — Delete primary zone configuration for outgoing zone transfers. (supports --dry-run)\n- `cf dns zone-transfers peers delete <peer-id>` — Delete Peer. (supports --dry-run)\n- `cf dns zone-transfers tsigs delete <tsig-id>` — Delete TSIG. (supports --dry-run)\n\n### Other Operations\n\n- `cf dns dnssec list zsks` — List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone. (supports --dry-run)\n- `cf dns records batch` — Send a Batch of DNS Record API calls to be executed together. Notes: - Although Cloudflare will execute the batched operations in a single database transaction, Cloudflare's distributed KV store must treat each record change as a single key-value pair. This means that the propagation of changes is not atomic. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/batch-record-changes/ \"Batch DNS records\") for more information. - The operations you specify within the /batch request body are always executed in the following order: - Deletes - Patches - Puts - Posts (supports --dry-run, --body)\n- `cf dns records import` — You can upload your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. It assumes that cURL is called from a location with bind_config.txt (valid BIND config) present. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information. (supports --dry-run, --body)\n- `cf dns records scan` — Scan for common DNS records on your domain and automatically add them to your zone. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns records scan-list` — Retrieves the list of DNS records discovered up to this point by the asynchronous scan. These records are temporary until explicitly accepted or rejected via `POST /scan/review`. Additional records may be discovered by the scan later. (supports --dry-run)\n- `cf dns records scan-review` — Accept or reject DNS records found by the DNS records scan. Accepted records will be permanently added to the zone, while rejected records will be permanently deleted. (supports --dry-run, --body)\n- `cf dns records scan-trigger` — Initiates an asynchronous scan for common DNS records on your domain. Note that this **does not** automatically add records to your zone. The scan runs in the background, and results can be reviewed later using the `/scan/review` endpoints. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns zone-transfers outgoing disable` — Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing enable` — Enable outgoing zone transfers for primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing force-notify` — Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"dns-firewall": "# dns-firewall — DNS proxy clusters that filter and forward DNS queries with DDoS protection and caching\n\n## Commands\n\n### Read Operations\n\n- `cf dns-firewall analytics reports bytimes get <dns-firewall-id>` — Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns-firewall analytics reports get <dns-firewall-id>` — Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.\n- `cf dns-firewall get <dns-firewall-id>` — Show a single DNS Firewall cluster for an account\n- `cf dns-firewall list` — List DNS Firewall clusters for an account\n- `cf dns-firewall reverse-dns get <dns-firewall-id>` — Show reverse DNS configuration (PTR records) for a DNS Firewall cluster\n\n### Create Operations\n\n- `cf dns-firewall create` — Create a DNS Firewall cluster (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns-firewall edit <dns-firewall-id>` — Modify the configuration of a DNS Firewall cluster (supports --dry-run, --body)\n- `cf dns-firewall reverse-dns edit <dns-firewall-id>` — Update reverse DNS configuration (PTR records) for a DNS Firewall cluster (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns-firewall delete <dns-firewall-id>` — Delete a DNS Firewall cluster (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"durable-objects": "# durable-objects — Stateful serverless objects with transactional storage, ideal for coordination, sessions, and real-time collaboration\n\n## Commands\n\n### Read Operations\n\n- `cf durable-objects namespaces list` — Returns the Durable Object namespaces owned by an account.\n- `cf durable-objects namespaces objects list` — Returns the Durable Objects in a given namespace.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-routing": "# email-routing — Route incoming emails to destination addresses using custom rules, catch-all handlers, and DNS configuration\n\n## Commands\n\n### Read Operations\n\n- `cf email-routing addresses get <destinationAddressIdentifier>` — Gets information for a specific destination email already created.\n- `cf email-routing addresses list` — Lists existing destination addresses.\n- `cf email-routing dns get` — Show the DNS records needed to configure your Email Routing zone.\n- `cf email-routing get` — Get information about the settings for your Email Routing zone.\n- `cf email-routing rules catch-alls get` — Get information on the default catch-all routing rule.\n- `cf email-routing rules get <ruleIdentifier>` — Get information for a specific routing rule already created.\n- `cf email-routing rules list` — Lists existing routing rules.\n- `cf email-routing suppression routing get <suppressionId>` — Get a routing suppression entry\n- `cf email-routing suppression routing list` — List routing suppression entries\n- `cf email-routing suppression sending get <suppressionId>` — Get a sending suppression entry\n- `cf email-routing suppression sending list` — List sending suppression entries\n- `cf email-routing suppression zone routing get <suppressionId>` — Get a zone routing suppression entry\n- `cf email-routing suppression zone routing list` — List zone routing suppression entries\n- `cf email-routing suppression zone sending get <suppressionId>` — Get a zone sending suppression entry\n- `cf email-routing suppression zone sending list` — List zone sending suppression entries\n\n### Create Operations\n\n- `cf email-routing addresses create` — Create a destination address to forward your emails to. Destination addresses need to be verified before they can be used. (supports --dry-run, --body)\n- `cf email-routing dns create` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run, --body)\n- `cf email-routing rules create` — Rules consist of a set of criteria for matching emails (such as an email being sent to a specific custom email address) plus a set of actions to take on the email (like forwarding it to a specific destination address). Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n- `cf email-routing suppression routing create` — Create a routing suppression entry (supports --dry-run, --body)\n- `cf email-routing suppression sending create` — Create a sending suppression entry (supports --dry-run, --body)\n- `cf email-routing suppression zone routing create` — Create a zone routing suppression entry (supports --dry-run, --body)\n- `cf email-routing suppression zone sending create` — Create a zone sending suppression entry (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-routing dns edit` — Unlock MX Records previously locked by Email Routing. (supports --dry-run, --body)\n- `cf email-routing rules catch-alls update` — Enable or disable catch-all routing rule, or change action to forward to specific destination address. Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n- `cf email-routing rules update <ruleIdentifier>` — Update actions and matches, or enable/disable specific routing rules. Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-routing addresses delete <destinationAddressIdentifier>` — Deletes a specific destination address. (supports --dry-run)\n- `cf email-routing dns delete` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run, --body)\n- `cf email-routing rules delete <ruleIdentifier>` — Delete a specific routing rule. (supports --dry-run)\n- `cf email-routing suppression routing delete <suppressionId>` — Delete a routing suppression entry (supports --dry-run)\n- `cf email-routing suppression sending delete <suppressionId>` — Delete a sending suppression entry (supports --dry-run)\n- `cf email-routing suppression zone routing delete <suppressionId>` — Delete a zone routing suppression entry (supports --dry-run)\n- `cf email-routing suppression zone sending delete <suppressionId>` — Delete a zone sending suppression entry (supports --dry-run)\n\n### Other Operations\n\n- `cf email-routing disable` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run, --body)\n- `cf email-routing enable` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-security": "# email-security — Cloud email security (Area 1) — investigate threats, manage allow/block policies, and detect phishing\n\n## Commands\n\n### Read Operations\n\n- `cf email-security investigate detections get <postfixId>` — Returns detection details such as threat categories and sender information for non-benign messages.\n- `cf email-security investigate get <postfixId>` — Retrieves detailed information about a specific email message, including headers, metadata, and security scan results.\n- `cf email-security investigate list` — Returns information for each email that matches the search parameter(s). If the search takes too long, the endpoint returns 202 with a Location header pointing to a polling endpoint where results can be retrieved once ready.\n- `cf email-security investigate preview get <postfixId>` — Returns a preview of the message body as a base64 encoded PNG image for non-benign messages.\n- `cf email-security investigate raw get <postfixId>` — Returns the raw eml of any non-benign message.\n- `cf email-security investigate trace get <postfixId>` — Gets the delivery trace for an email message, showing its path through email security processing.\n- `cf email-security phishguard reports list` — Retrieves `PhishGuard` reports showing phishing attempts and suspicious email patterns detected.\n- `cf email-security settings allow-policies get <policyId>` — Retrieves details for a specific email allow policy, including its matching criteria and scope.\n- `cf email-security settings allow-policies list` — Lists, searches, and sorts an account’s email allow policies.\n- `cf email-security settings block-senders get <patternId>` — Gets information about a specific blocked sender entry, including the pattern and block reason.\n- `cf email-security settings block-senders list` — Lists all blocked sender entries with their patterns and block reasons.\n- `cf email-security settings domains get <domainId>` — Gets configuration details for a specific domain in email security.\n- `cf email-security settings domains list` — Lists, searches, and sorts an account’s email domains.\n- `cf email-security settings impersonation-registry get <displayNameId>` — Retrieves a display name entry used for impersonation protection.\n- `cf email-security settings impersonation-registry list` — Lists, searches, and sorts entries in the impersonation registry.\n- `cf email-security settings trusted-domains get <trustedDomainId>` — Gets information about a specific trusted domain entry.\n- `cf email-security settings trusted-domains list` — Lists, searches, and sorts an account’s trusted email domains.\n- `cf email-security submissions list` — This endpoint returns information for submissions to made to reclassify emails.\n\n### Create Operations\n\n- `cf email-security investigate move create <postfixId>` — Moves a single email message to a different folder or changes its quarantine status. (supports --dry-run, --body)\n- `cf email-security investigate preview create` — Generates a preview of an email message for safe viewing without executing any embedded content. (supports --dry-run, --body)\n- `cf email-security investigate reclassify create <postfixId>` — Submits an email message for reclassification, updating its threat assessment based on new analysis. (supports --dry-run, --body)\n- `cf email-security settings allow-policies create` — Creates a new email allow policy that permits specific senders, domains, or patterns to bypass security scanning. (supports --dry-run, --body)\n- `cf email-security settings batch allow policies batch create` — Send a Batch of Allow Policies API calls to be executed together. (supports --dry-run, --body)\n- `cf email-security settings batch block senders batch create` — Send a Batch of Block Senders API calls to be executed together. (supports --dry-run, --body)\n- `cf email-security settings batch sending domain restrictions batch create` — Send a Batch of `sending_domain_restrictions` API calls to be executed together. (supports --dry-run, --body)\n- `cf email-security settings batch trusted domains batch create` — Send a Batch of Trusted Domains API calls to be executed together. (supports --dry-run, --body)\n- `cf email-security settings block-senders create` — Adds a sender pattern to the email block list, preventing messages from matching senders from being delivered. (supports --dry-run, --body)\n- `cf email-security settings impersonation-registry create` — Creates a display name entry for email security impersonation protection. (supports --dry-run, --body)\n- `cf email-security settings trusted-domains create` — Adds a domain to the trusted domains list for email security, reducing false positive detections. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-security settings allow-policies edit <policyId>` — Updates an existing email allow policy, modifying its matching criteria or scope. (supports --dry-run, --body)\n- `cf email-security settings block-senders edit <patternId>` — Modifies a blocked sender entry, updating its pattern or block reason. (supports --dry-run, --body)\n- `cf email-security settings domains edit <domainId>` — Updates configuration for a domain in email security. (supports --dry-run, --body)\n- `cf email-security settings impersonation-registry edit <displayNameId>` — Updates a display name entry used for impersonation protection. (supports --dry-run, --body)\n- `cf email-security settings trusted-domains edit <trustedDomainId>` — Modifies a trusted domain entry's configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-security settings allow-policies delete <policyId>` — Removes an email allow policy. Previously allowed senders will be subject to normal security scanning. (supports --dry-run)\n- `cf email-security settings block-senders delete <patternId>` — Removes a sender from the email block list, allowing their messages to be delivered normally. (supports --dry-run)\n- `cf email-security settings domains delete <domainId>` — Removes a domain from the email security configuration. (supports --dry-run)\n- `cf email-security settings impersonation-registry delete <displayNameId>` — Removes a display name from impersonation protection monitoring. (supports --dry-run)\n- `cf email-security settings trusted-domains delete <trustedDomainId>` — Removes a domain from the trusted domains list, subjecting it to normal security scanning. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-security investigate get-action log <investigateId>` — Returns the list of post-delivery actions (moves, quarantine releases, previews, etc.) that have been applied to a specific email message. (supports --dry-run)\n- `cf email-security investigate move bulk` — Maximum batch size: 1000 messages per request (supports --dry-run, --body)\n- `cf email-security investigate release bulk` — Releases a quarantined email message, allowing it to be delivered to the recipient. (supports --dry-run, --body)\n- `cf email-security settings domains bulk-delete` — Bulk removes multiple domains from email security configuration in a single request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-sending": "# email-sending — Send emails and manage sending subdomains\n\n## Commands\n\n### Read Operations\n\n- `cf email-sending limits get` — Returns the current daily sending quota for the account. Null when the quota is not yet available.\n- `cf email-sending subdomains dns get <subdomainId>` — Returns the expected DNS records for a sending subdomain.\n- `cf email-sending subdomains get <subdomainId>` — Gets information for a specific sending subdomain.\n- `cf email-sending subdomains list` — Lists all sending-enabled subdomains for the zone.\n\n### Create Operations\n\n- `cf email-sending subdomains create` — Creates a new sending subdomain or re-enables sending on an existing subdomain that had it disabled. If zone-level Email Sending has not been enabled yet, the zone flag is automatically set when the entitlement is present. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-sending subdomains delete <subdomainId>` — Disables sending on a subdomain and removes its DNS records. If routing is still active on the subdomain, only sending is disabled. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-sending send` — Send an email (supports --dry-run, --body)\n- `cf email-sending send-raw` — Send a raw MIME email (supports --dry-run, --body)\n- `cf email-sending subdomains preview` — Returns the DNS records that would be created for a sending subdomain, flags which records are missing, and reports any conflicts with existing DNS records. This is a read-only dry-run — no records are created or modified. Use before or after creating a subdomain to check DNS status. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"filters": "# filters — Filter expressions used by legacy firewall rules to match requests — prefer Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf filters get <filterId>` — Fetches the details of a filter.\n- `cf filters list` — Fetches filters in a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf filters create` — Creates one or more filters. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf filters update <filterId>` — Updates an existing filter. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf filters delete <filterId>` — Deletes an existing filter. (supports --dry-run)\n\n### Other Operations\n\n- `cf filters bulk-delete` — Deletes one or more existing filters. (supports --dry-run)\n- `cf filters bulk-update` — Updates one or more existing filters. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"firewall": "# firewall — Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages\n\n## Commands\n\n### Read Operations\n\n- `cf firewall access-rules get <ruleId>` — Fetches the details of an IP Access rule defined at the account level.\n- `cf firewall access-rules list` — Fetches IP Access rules of an account. These rules apply to all the zones in the account. You can filter the results using several optional parameters.\n- `cf firewall lockdowns get <lockDownsId>` — Fetches the details of a Zone Lockdown rule.\n- `cf firewall lockdowns list` — Fetches Zone Lockdown rules. You can filter the results using several optional parameters.\n- `cf firewall rules get <ruleId>` — Fetches the details of a firewall rule.\n- `cf firewall rules list` — Fetches firewall rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall ua-rules get <uaRuleId>` — Fetches the details of a User Agent Blocking rule.\n- `cf firewall ua-rules list` — Fetches User Agent Blocking rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall waf overrides get <overridesId>` — Fetches the details of a URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf overrides list` — Fetches the URI-based WAF overrides in a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages get <packageId>` — Fetches the details of a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages groups get <groupId>` — Fetches the details of a WAF rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages groups list` — Fetches the WAF rule groups in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages list` — Fetches WAF packages for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages rules get <ruleId>` — Fetches the details of a WAF rule in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages rules list` — Fetches WAF rules in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall zone-access-rules list` — Fetches IP Access rules of a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf firewall access-rules create` — Creates a new IP Access rule for an account. The rule will apply to all zones in the account. Note: To create an IP Access rule that applies to a single zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf firewall lockdowns create` — Creates a new Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules create` — Create one or more firewall rules. (supports --dry-run, --body)\n- `cf firewall ua-rules create` — Creates a new User Agent Blocking rule in a zone. (supports --dry-run, --body)\n- `cf firewall waf overrides create` — Creates a URI-based WAF override for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall zone-access-rules create` — Creates a new IP Access rule for a zone. Note: To create an IP Access rule that applies to multiple zones, refer to [IP Access rules for a user](#ip-access-rules-for-a-user) or [IP Access rules for an account](#ip-access-rules-for-an-account) as appropriate. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf firewall access-rules edit <ruleId>` — Updates an IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run, --body)\n- `cf firewall lockdowns update <lockDownsId>` — Updates an existing Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules edit <ruleId>` — Updates the priority of an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall rules update <ruleId>` — Updates an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules update <uaRuleId>` — Updates an existing User Agent Blocking rule. (supports --dry-run, --body)\n- `cf firewall waf overrides update <overridesId>` — Updates an existing URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall waf packages groups edit <groupId>` — Updates a WAF rule group. You can update the state (`mode` parameter) of a rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall waf packages rules edit <ruleId>` — Updates a WAF rule. You can only update the mode/action of the rule. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall zone-access-rules edit <ruleId>` — Updates an IP Access rule defined at the zone level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf firewall access-rules delete <ruleId>` — Deletes an existing IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run, --body)\n- `cf firewall lockdowns delete <lockDownsId>` — Deletes an existing Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules delete <ruleId>` — Deletes an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules delete <uaRuleId>` — Deletes an existing User Agent Blocking rule. (supports --dry-run, --body)\n- `cf firewall waf overrides delete <overridesId>` — Deletes an existing URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall zone-access-rules delete <ruleId>` — Deletes an IP Access rule defined at the zone level. Optionally, you can use the `cascade` property to specify that you wish to delete similar rules in other zones managed by the same zone owner. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf firewall rules bulk-delete` — Deletes existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-edit` — Updates the priority of existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-update` — Updates one or more existing firewall rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-routing": "# email-routing — Route incoming emails to destination addresses using custom rules, catch-all handlers, and DNS configuration\n\n## Commands\n\n### Read Operations\n\n- `cf email-routing addresses get <destination-address-identifier>` — Gets information for a specific destination email already created.\n- `cf email-routing addresses list` — Lists existing destination addresses.\n- `cf email-routing dns get` — Show the DNS records needed to configure your Email Routing zone.\n- `cf email-routing get` — Get information about the settings for your Email Routing zone.\n- `cf email-routing rules catch-alls get` — Get information on the default catch-all routing rule.\n- `cf email-routing rules get <rule-identifier>` — Get information for a specific routing rule already created.\n- `cf email-routing rules list` — Lists existing routing rules.\n- `cf email-routing suppression routing get <suppression-id>` — Retrieves a single email suppression for the specified account.\n- `cf email-routing suppression routing list` — Lists email suppressions for the specified account.\n- `cf email-routing suppression sending get <suppression-id>` — Retrieves a single email suppression for the specified account.\n- `cf email-routing suppression sending list` — Lists email suppressions for the specified account.\n- `cf email-routing suppression zone routing get <suppression-id>` — Retrieves a single email suppression for the specified zone.\n- `cf email-routing suppression zone routing list` — Lists email suppressions for the specified zone.\n- `cf email-routing suppression zone sending get <suppression-id>` — Retrieves a single email suppression for the specified zone.\n- `cf email-routing suppression zone sending list` — Lists email suppressions for the specified zone.\n\n### Create Operations\n\n- `cf email-routing addresses create` — Create a destination address to forward your emails to. Destination addresses need to be verified before they can be used. (supports --dry-run, --body)\n- `cf email-routing dns create` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run, --body)\n- `cf email-routing rules create` — Rules consist of a set of criteria for matching emails (such as an email being sent to a specific custom email address) plus a set of actions to take on the email (like forwarding it to a specific destination address). Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n- `cf email-routing suppression routing create` — Creates a new email suppression for the specified account. (supports --dry-run, --body)\n- `cf email-routing suppression sending create` — Creates a new email suppression for the specified account. (supports --dry-run, --body)\n- `cf email-routing suppression zone routing create` — Creates a new email suppression for the specified zone. (supports --dry-run, --body)\n- `cf email-routing suppression zone sending create` — Creates a new email suppression for the specified zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-routing addresses update <destination-address-identifier>` — Updates the status of a specific destination address. (supports --dry-run, --body)\n- `cf email-routing dns edit` — Unlock MX Records previously locked by Email Routing. (supports --dry-run, --body)\n- `cf email-routing edit` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n- `cf email-routing rules catch-alls update` — Enable or disable catch-all routing rule, or change action to forward to specific destination address. Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n- `cf email-routing rules update <rule-identifier>` — Update actions and matches, or enable/disable specific routing rules. Forward actions require all destination addresses to be verified. (supports --dry-run, --body)\n- `cf email-routing update` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-routing addresses delete <destination-address-identifier>` — Deletes a specific destination address. (supports --dry-run)\n- `cf email-routing dns delete` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run, --body)\n- `cf email-routing rules delete <rule-identifier>` — Delete a specific routing rule. (supports --dry-run)\n- `cf email-routing suppression routing delete <suppression-id>` — Deletes an email suppression for the specified account. (supports --dry-run)\n- `cf email-routing suppression sending delete <suppression-id>` — Deletes an email suppression for the specified account. (supports --dry-run)\n- `cf email-routing suppression zone routing delete <suppression-id>` — Deletes an email suppression for the specified zone. (supports --dry-run)\n- `cf email-routing suppression zone sending delete <suppression-id>` — Deletes an email suppression for the specified zone. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-routing disable` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run)\n- `cf email-routing enable` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run)\n- `cf email-routing rules list-account` — Lists existing routing rules across all zones in the account. (supports --dry-run)\n- `cf email-routing rules plan` — Computes the Email Routing rule changes that would be needed to reconcile a Wrangler-managed desired ruleset. This endpoint is read-only and does not create, update, or delete rules. (supports --dry-run, --body)\n- `cf email-routing unlock` — Unlock MX records previously locked by Email Routing. Deprecated - use PATCH /zones/{zone_id}/email/routing/dns instead. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-security": "# email-security — Cloud email security (Area 1) — investigate threats, manage allow/block policies, and detect phishing\n\n## Commands\n\n### Read Operations\n\n- `cf email-security investigate detections get <investigate-id>` — Returns detection details such as threat categories and sender information for non-benign messages.\n- `cf email-security investigate get <investigate-id>` — Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information.\n- `cf email-security investigate list` — Returns information for each email that matches the search parameter(s).\n- `cf email-security investigate preview get <investigate-id>` — Returns a preview of the message body as a base64 encoded PNG image for non-benign messages.\n- `cf email-security investigate raw get <investigate-id>` — Returns the raw eml of any non-benign message.\n- `cf email-security investigate trace get <investigate-id>` — Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues.\n- `cf email-security phishguard reports list` — Retrieves PhishGuard security alert reports for a specified date range. Reports include detected threats, dispositions, and contextual information. Use for security monitoring and threat analysis.\n- `cf email-security settings allow-policies get <policy-id>` — Retrieves details for a specific allow policy including its pattern, dispositions that are exempted, and whether it applies to all detections.\n- `cf email-security settings allow-policies list` — Returns a paginated list of email allow policies. These policies exempt matching emails from security detection, allowing them to bypass disposition actions. Supports filtering by pattern type and policy attributes.\n- `cf email-security settings block-senders get <pattern-id>` — Retrieves details for a specific blocked sender pattern including its pattern type, value, and metadata.\n- `cf email-security settings block-senders list` — Returns a paginated list of blocked email sender patterns. These patterns prevent emails from matching senders from being delivered. Supports filtering by pattern type and searching across patterns.\n- `cf email-security settings domains get <domain-id>` — Retrieves detailed information for a specific protected email domain including its delivery configuration, SPF/DMARC status, and authorization state.\n- `cf email-security settings domains list` — Returns a paginated list of email domains protected by Email Security. Includes domain configuration, delivery modes, and authorization status. Supports filtering by delivery mode and integration ID.\n- `cf email-security settings trusted-domains get <trusted-domain-id>` — Retrieves details for a specific trusted domain pattern including its pattern value, whether it uses regex matching, and which detection types it affects.\n- `cf email-security settings trusted-domains list` — Returns a paginated list of trusted domain patterns. Trusted domains prevent false positives for recently registered domains and lookalike domain detections. Patterns can use regular expressions for flexible matching.\n- `cf email-security submissions list` — Returns information for submissions made to reclassify emails. Shows the status, outcome, and disposition changes for reclassification requests made by users or the security team. Useful for tracking false positive/negative reports.\n\n### Create Operations\n\n- `cf email-security investigate move create <investigate-id>` — Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. (supports --dry-run, --body)\n- `cf email-security investigate preview create` — Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body. (supports --dry-run, --body)\n- `cf email-security investigate reclassify create <investigate-id>` — Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously. (supports --dry-run, --body)\n- `cf email-security settings allow-policies create` — Creates a new allow policy that exempts matching emails from security detections. Use with caution as this bypasses email security scanning. Policies can match on sender patterns and apply to specific detections or all detections. (supports --dry-run, --body)\n- `cf email-security settings batch allow policies batch create` — Execute multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security settings batch block senders batch create` — Execute multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security settings batch sending domain restrictions batch create` — Executes multiple delete operations on sending domain restrictions atomically. All operations succeed or fail together as a transaction. Currently only supports batch deletion. Removes TLS enforcement requirements for the specified domains. (supports --dry-run, --body)\n- `cf email-security settings batch trusted domains batch create` — Execute multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security settings block-senders create` — Creates a new blocked sender pattern. Emails matching this pattern will be blocked from delivery. Patterns can be email addresses, domains, or IP addresses, and support regular expressions. (supports --dry-run, --body)\n- `cf email-security settings trusted-domains create` — Creates a new trusted domain pattern. Use for partner domains or approved senders that should bypass recent domain registration and similarity checks. Configure whether it prevents recent domain or spoof dispositions. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-security settings allow-policies edit <policy-id>` — Updates an existing allow policy. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n- `cf email-security settings block-senders edit <pattern-id>` — Updates an existing blocked sender pattern. Only provided fields will be modified. The pattern will continue blocking emails until deleted. (supports --dry-run, --body)\n- `cf email-security settings domains edit <domain-id>` — Updates configuration for a protected email domain. Only provided fields will be modified. Changes affect delivery mode, security settings, and regional processing. (supports --dry-run, --body)\n- `cf email-security settings trusted-domains edit <trusted-domain-id>` — Updates an existing trusted domain pattern. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-security settings allow-policies delete <policy-id>` — Removes an allow policy. After deletion, emails matching this pattern will be subject to normal security scanning and disposition actions. (supports --dry-run)\n- `cf email-security settings block-senders delete <pattern-id>` — Removes a blocked sender pattern. After deletion, emails from this sender will no longer be automatically blocked based on this rule. (supports --dry-run)\n- `cf email-security settings domains delete <domain-id>` — Removes email security protection from a domain. After deletion, emails for this domain will no longer be processed by Email Security. This action cannot be undone. (supports --dry-run)\n- `cf email-security settings trusted-domains delete <trusted-domain-id>` — Removes a trusted domain pattern. After deletion, emails from this domain will be subject to normal recent domain and similarity checks. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-security investigate get-action log <investigate-id>` — Returns the list of post-delivery actions (moves, quarantine releases, previews, etc.) that have been applied to a specific email message. (supports --dry-run)\n- `cf email-security investigate release bulk` — Releases one or more quarantined messages, delivering them to the intended recipients. Use when a message was incorrectly quarantined. Returns delivery status for each recipient. (supports --dry-run, --body)\n- `cf email-security settings domains bulk-delete` — Deprecated. Use the batch endpoint instead. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-sending": "# email-sending — Send emails and manage sending subdomains\n\n## Commands\n\n### Read Operations\n\n- `cf email-sending limits get` — Returns the current daily sending quota for the account and, when a quota is resolved, the account's current usage against it. Quota is null when not yet available; usage is null when there is no resolved quota or usage is temporarily unavailable.\n- `cf email-sending subdomains dns get <subdomain-id>` — Returns the expected DNS records for a sending subdomain.\n- `cf email-sending subdomains get <subdomain-id>` — Gets information for a specific sending subdomain.\n- `cf email-sending subdomains list` — Lists all sending-enabled subdomains for the zone.\n\n### Create Operations\n\n- `cf email-sending subdomains create` — Creates a new sending subdomain or re-enables sending on an existing subdomain that had it disabled. If zone-level Email Sending has not been enabled yet, the zone flag is automatically set when the entitlement is present. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-sending subdomains update <subdomain-id>` — Updates the activity-log preview preference for a sending subdomain. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-sending subdomains delete <subdomain-id>` — Disables sending on a subdomain and removes its DNS records. If routing is still active on the subdomain, only sending is disabled. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-sending send` — Send an email for the specified account using the structured builder. Provide the sender, recipients, subject, and at least one of text or html; attachments are optional. (supports --dry-run, --body)\n- `cf email-sending send-raw` — Send a raw RFC 5322 (MIME) email for the specified account. Provide the full MIME message plus the SMTP envelope (from and recipients). (supports --dry-run, --body)\n- `cf email-sending subdomains dns fix <subdomain-id>` — Idempotently re-applies the sending DNS records (creates missing records, re-applies the email_routing lock on records whose lock has been cleared). Refuses with a 409 if foreign MX, multiple SPF, multiple DMARC, or multiple DKIM records exist at the relevant DNS names — those require manual cleanup. (supports --dry-run)\n- `cf email-sending subdomains dns get-status <subdomain-id>` — Returns the desired DNS records for a sending subdomain along with a live diff against actual DNS state. Use this to detect missing, unlocked, foreign, or multi-record conflicts before deciding whether to call the fix endpoint. (supports --dry-run)\n- `cf email-sending subdomains preview` — Returns the DNS records that would be created for a sending subdomain, flags which records are missing, and reports any conflicts with existing DNS records. This is a read-only dry-run — no records are created or modified. Use before or after creating a subdomain to check DNS status. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"filters": "# filters — Filter expressions used by legacy firewall rules to match requests — prefer Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf filters get <filter-id>` — Fetches the details of a filter.\n- `cf filters list` — Fetches filters in a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf filters create` — Creates one or more filters. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf filters update <filter-id>` — Updates an existing filter. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf filters delete <filter-id>` — Deletes an existing filter. (supports --dry-run)\n\n### Other Operations\n\n- `cf filters bulk-delete` — Deletes one or more existing filters. (supports --dry-run)\n- `cf filters bulk-update` — Updates one or more existing filters. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"firewall": "# firewall — Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages\n\n## Commands\n\n### Read Operations\n\n- `cf firewall access-rules get <rule-id>` — Fetches the details of an IP Access rule defined at the account level.\n- `cf firewall access-rules list` — Fetches IP Access rules of an account. These rules apply to all the zones in the account. You can filter the results using several optional parameters.\n- `cf firewall lockdowns get <lock-downs-id>` — Fetches the details of a Zone Lockdown rule.\n- `cf firewall lockdowns list` — Fetches Zone Lockdown rules. You can filter the results using several optional parameters.\n- `cf firewall rules get <rule-id>` — Fetches the details of a firewall rule.\n- `cf firewall rules list` — Fetches firewall rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall ua-rules get <ua-rule-id>` — Fetches the details of a User Agent Blocking rule.\n- `cf firewall ua-rules list` — Fetches User Agent Blocking rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall waf overrides get <overrides-id>` — Fetches the details of a URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf overrides list` — Fetches the URI-based WAF overrides in a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages get <package-id>` — Fetches the details of a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages groups get <group-id>` — Fetches the details of a WAF rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages groups list` — Fetches the WAF rule groups in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages list` — Fetches WAF packages for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages rules get <rule-id>` — Fetches the details of a WAF rule in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages rules list` — Fetches WAF rules in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall zone-access-rules list` — Fetches IP Access rules of a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf firewall access-rules create` — Creates a new IP Access rule for an account. The rule will apply to all zones in the account. Note: To create an IP Access rule that applies to a single zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf firewall lockdowns create` — Creates a new Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules create` — Create one or more firewall rules. (supports --dry-run, --body)\n- `cf firewall ua-rules create` — Creates a new User Agent Blocking rule in a zone. (supports --dry-run, --body)\n- `cf firewall waf overrides create` — Creates a URI-based WAF override for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall zone-access-rules create` — Creates a new IP Access rule for a zone. Note: To create an IP Access rule that applies to multiple zones, refer to [IP Access rules for a user](#ip-access-rules-for-a-user) or [IP Access rules for an account](#ip-access-rules-for-an-account) as appropriate. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf firewall access-rules edit <rule-id>` — Updates an IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run, --body)\n- `cf firewall lockdowns update <lock-downs-id>` — Updates an existing Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules edit <rule-id>` — Updates the priority of an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall rules update <rule-id>` — Updates an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules update <ua-rule-id>` — Updates an existing User Agent Blocking rule. (supports --dry-run, --body)\n- `cf firewall waf overrides update <overrides-id>` — Updates an existing URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall waf packages groups edit <group-id>` — Updates a WAF rule group. You can update the state (`mode` parameter) of a rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall waf packages rules edit <rule-id>` — Updates a WAF rule. You can only update the mode/action of the rule. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run, --body)\n- `cf firewall zone-access-rules edit <rule-id>` — Updates an IP Access rule defined at the zone level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf firewall access-rules delete <rule-id>` — Deletes an existing IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run)\n- `cf firewall lockdowns delete <lock-downs-id>` — Deletes an existing Zone Lockdown rule. (supports --dry-run)\n- `cf firewall rules delete <rule-id>` — Deletes an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules delete <ua-rule-id>` — Deletes an existing User Agent Blocking rule. (supports --dry-run)\n- `cf firewall waf overrides delete <overrides-id>` — Deletes an existing URI-based WAF override. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/). (supports --dry-run)\n- `cf firewall zone-access-rules delete <rule-id>` — Deletes an IP Access rule defined at the zone level. Optionally, you can use the `cascade` property to specify that you wish to delete similar rules in other zones managed by the same zone owner. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf firewall rules bulk-delete` — Deletes existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-edit` — Updates the priority of existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-update` — Updates one or more existing firewall rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"fraud": "# fraud — Fraud detection for login and signup flows — identify credential stuffing, account takeover, and fake accounts\n\n## Commands\n\n### Read Operations\n\n- `cf fraud get` — Retrieve Fraud Detection settings for a zone.\n\n### Update Operations\n\n- `cf fraud update` — Update Fraud Detection settings for a zone. Notes on `username_expressions` behavior: - If omitted or set to null, expressions are not modified. - If provided as an empty array `[]`, all expressions will be cleared. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"google-tag-gateway": "# google-tag-gateway — Google Tag Gateway operations\n\n## Commands\n\n### Read Operations\n\n- `cf google-tag-gateway config get` — Gets the Google Tag Gateway configuration for a zone.\n\n### Update Operations\n\n- `cf google-tag-gateway config update` — Updates the Google Tag Gateway configuration for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"healthchecks": "# healthchecks — Standalone health checks that monitor origin server availability from Cloudflare's edge\n\n## Commands\n\n### Read Operations\n\n- `cf healthchecks get <healthcheckId>` — Fetch a single configured health check.\n- `cf healthchecks list` — List configured health checks.\n- `cf healthchecks previews get <healthcheckId>` — Fetch a single configured health check preview.\n\n### Create Operations\n\n- `cf healthchecks create` — Create a new health check. (supports --dry-run, --body)\n- `cf healthchecks previews create` — Create a new preview health check. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf healthchecks edit <healthcheckId>` — Patch a configured health check. (supports --dry-run, --body)\n- `cf healthchecks update <healthcheckId>` — Update a configured health check. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf healthchecks delete <healthcheckId>` — Delete a health check. (supports --dry-run, --body)\n- `cf healthchecks previews delete <healthcheckId>` — Delete a health check. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"hostnames": "# hostnames — Per-hostname TLS settings — minimum TLS version, ciphers, and certificate pinning overrides\n\n## Commands\n\n### Read Operations\n\n- `cf hostnames settings tls get <settingId>` — List the requested TLS setting for the hostnames under this zone.\n- `cf hostnames settings tls-single get <hostname>` — Get the requested TLS setting for the hostname.\n\n### Update Operations\n\n- `cf hostnames settings tls update <hostname>` — Update the tls setting value for the hostname. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf hostnames settings tls delete <hostname>` — Delete the tls setting value for the hostname. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"hyperdrive": "# hyperdrive — Accelerate access to existing databases by caching queries and pooling connections at the edge\n\n## Commands\n\n### Read Operations\n\n- `cf hyperdrive get <hyperdriveId>` — Returns the specified Hyperdrive configuration.\n- `cf hyperdrive list` — Returns a list of Hyperdrives.\n\n### Create Operations\n\n- `cf hyperdrive create` — Creates and returns a new Hyperdrive configuration. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf hyperdrive edit <hyperdriveId>` — Patches and returns the specified Hyperdrive configuration. Custom caching settings are not kept if caching is disabled. (supports --dry-run, --body)\n- `cf hyperdrive update <hyperdriveId>` — Updates and returns the specified Hyperdrive configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf hyperdrive delete <hyperdriveId>` — Deletes the specified Hyperdrive. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"iam": "# iam — Identity and access management — permission groups, resource groups, user groups, and SSO connectors\n\n## Commands\n\n### Read Operations\n\n- `cf iam permission-groups get <permissionGroupId>` — Get information about a specific permission group in an account.\n- `cf iam permission-groups list` — List all the permissions groups for an account.\n- `cf iam resource-groups get <resourceGroupId>` — Get information about a specific resource group in an account.\n- `cf iam resource-groups list` — List all the resource groups for an account.\n- `cf iam sso get <ssoConnectorId>` — Get SSO connector details\n- `cf iam sso list` — List all SSO connectors\n- `cf iam user-groups get <userGroupId>` — Get information about a specific user group in an account.\n- `cf iam user-groups list` — List all the user groups for an account.\n- `cf iam user-groups members list` — List all the members attached to a user group.\n\n### Create Operations\n\n- `cf iam resource-groups create` — Create a new Resource Group under the specified account. (supports --dry-run, --body)\n- `cf iam sso create` — Create a new SSO connector (supports --dry-run, --body)\n- `cf iam user-groups create` — Create a new user group under the specified account. (supports --dry-run, --body)\n- `cf iam user-groups members create <userGroupId>` — Add members to a User Group. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf iam resource-groups update <resourceGroupId>` — Modify an existing resource group. (supports --dry-run, --body)\n- `cf iam sso update <ssoConnectorId>` — Update SSO connector state (supports --dry-run, --body)\n- `cf iam user-groups members update <userGroupId>` — Replace the set of members attached to a User Group. (supports --dry-run, --body)\n- `cf iam user-groups update <userGroupId>` — Modify an existing user group. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf iam resource-groups delete <resourceGroupId>` — Remove a resource group from an account. (supports --dry-run, --body)\n- `cf iam sso delete <ssoConnectorId>` — Delete an SSO connector (supports --dry-run)\n- `cf iam user-groups delete <userGroupId>` — Remove a user group from an account. (supports --dry-run)\n- `cf iam user-groups members delete <memberId>` — Remove a member from User Group (supports --dry-run)\n\n### Other Operations\n\n- `cf iam sso begin-verification <ssoConnectorId>` — Begin SSO connector verification (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"images": "# images — Store, resize, and deliver optimized images globally — variants, signing keys, and direct uploads\n\n## Commands\n\n### Read Operations\n\n- `cf images v1 blobs get <imageId>` — Fetch base image. For most images this will be the originally uploaded file. For larger images it can be a near-lossless version of the original.\n- `cf images v1 get <imageId>` — Fetch details for a single image.\n- `cf images v1 keys list` — Lists your signing keys. These can be found on your Cloudflare Images dashboard.\n- `cf images v1 list` — List up to 100 images with one request. Use the optional parameters below to get a specific range of images.\n- `cf images v1 stats get` — Fetch image statistics details for Cloudflare Images. The returned statistics detail storage usage, including the current image count vs this account's allowance.\n- `cf images v1 variants get <variantId>` — Fetch details for a single variant.\n- `cf images v1 variants list` — Lists existing variants.\n- `cf images v1 variants-flat get <variantId>` — Fetch details for a single variant with properties at the top level of the result.\n- `cf images v2 list` — List up to 10000 images with up to 1000 results per page. Use the optional parameters below to get a specific range of images. Pagination is supported via continuation_token. **Metadata Filtering (Optional):** You can optionally filter images by custom metadata fields using the `meta.<field>[<operator>]=<value>` syntax. **Supported Operators:** - `eq` / `eq:string` / `eq:number` / `eq:boolean` - Exact match - `in` / `in:string` / `in:number` - Match any value in list (pipe-separated) **Metadata Filter Constraints:** - Maximum 5 metadata filters per request - Maximum 5 levels of nesting (e.g., `meta.first.second.third.fourth.fifth`) - Maximum 10 elements for list operators (`in`) - Supports string, number, and boolean value types **Examples:** ``` # List all images /images/v2 # Filter by metadata [eq] /images/v2?meta.status[eq:string]=active # Filter by metadata [in] /images/v2?meta.status[in]=pending|deleted|flagged # Filter by metadata [in:number] /images/v2?meta.ratings[in:number]=4|5 # Filter by nested metadata /images/v2?meta.region.name[eq]=eu-west # Combine metadata filters with creator /images/v2?meta.status[eq]=active&creator=user123 # Multiple metadata filters (AND logic) /images/v2?meta.status[eq]=active&meta.priority[eq:number]=5 ```\n\n### Create Operations\n\n- `cf images v1 create` — Upload an image with up to 10 Megabytes using a single HTTP POST (multipart/form-data) request. An image can be uploaded by sending an image file or passing an accessible to an API url. (supports --dry-run, --body)\n- `cf images v1 variants create` — Specify variants that allow you to resize images for different use cases. (supports --dry-run, --body)\n- `cf images v2 direct-uploads create` — Direct uploads allow users to upload images without API keys. A common use case are web apps, client-side applications, or mobile devices where users upload content directly to Cloudflare Images. This method creates a draft record for a future image. It returns an upload URL and an image identifier. To verify if the image itself has been uploaded, send an image details request (accounts/:account_identifier/images/v1/:identifier), and check that the `draft: true` property is not present. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf images v1 edit <imageId>` — Update image access control. On access control change, all copies of the image are purged from cache. (supports --dry-run, --body)\n- `cf images v1 keys update <signingKeyName>` — Create a new signing key with specified name. Returns all keys available. (supports --dry-run)\n- `cf images v1 variants edit <variantId>` — Updating a variant purges the cache for all images associated with the variant. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf images v1 delete <imageId>` — Delete an image on Cloudflare Images. On success, all copies of the image are deleted and purged from cache. (supports --dry-run, --body)\n- `cf images v1 keys delete <signingKeyName>` — Delete signing key with specified name. Returns all keys available. When last key is removed, a new default signing key will be generated. (supports --dry-run)\n- `cf images v1 variants delete <variantId>` — Deleting a variant purges the cache for all images associated with the variant. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"intel": "# intel — Threat intelligence lookups — IP reputation, domain info, ASN details, WHOIS, and indicator feeds\n\n## Commands\n\n### Read Operations\n\n- `cf intel asn get <asn>` — Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.\n- `cf intel asn subnets get <asn>` — Get ASN Subnets.\n- `cf intel attack-surface-report issue-types get` — Lists all available issue types in Security Center, describing categories of security issues.\n- `cf intel attack-surface-report issues list` — Lists all Security Center issues for the account, showing active security problems requiring attention.\n- `cf intel dns list` — Gets a list of all the domains that have resolved to a specific IP address.\n- `cf intel domain-history get` — Gets historical security threat and content categories currently and previously assigned to a domain.\n- `cf intel domains bulks get` — Same as summary.\n- `cf intel domains get` — Gets security details and statistics about a domain.\n- `cf intel indicator-feeds downloads get <feedId>` — Downloads the content of a custom threat indicator feed.\n- `cf intel indicator-feeds get <feedId>` — Retrieves details for a specific custom threat indicator feed.\n- `cf intel indicator-feeds list` — Retrieves details for all accessible custom threat indicator feeds.\n- `cf intel indicator-feeds permissions list` — Lists current access permissions for custom threat indicator feeds.\n- `cf intel ip-lists get` — Returns a list of available IP list categories (e.g., anonymizer, botnetcc, malware, tor, vpn, open_proxies). This endpoint provides metadata about which IP lists are available in the system.\n- `cf intel ips get` — Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address. **Must provide ip query parameters.** For example, `/intel/ip?ipv4=1.1.1.1` or `/intel/ip?ipv6=2001:db8::1`.\n- `cf intel sinkholes list` — Retrieves DNS sinkhole configurations used for redirecting malicious domain traffic to safe destinations.\n- `cf intel whois get` — Retrieves WHOIS registration data for a domain, including registrant and nameserver information.\n\n### Create Operations\n\n- `cf intel indicator-feeds create` — Creates a new custom threat indicator feed for sharing threat intelligence data. (supports --dry-run, --body)\n- `cf intel indicator-feeds permissions create` — Grants access permissions for a custom threat indicator feed to other accounts. (supports --dry-run, --body)\n- `cf intel miscategorizations create` — Allows you to submit requests to change a domain’s category. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf intel indicator-feeds snapshots update <feedId>` — Revises the raw data entries in a custom threat indicator feed. (supports --dry-run, --body)\n- `cf intel indicator-feeds update <feedId>` — Revises details for a specific custom threat indicator feed. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf intel indicator-feeds permissions delete` — Revokes access permissions for a custom threat indicator feed. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf intel attack-surface-report issues class` — Retrieves Security Center issue counts aggregated by classification class. (supports --dry-run)\n- `cf intel attack-surface-report issues dismiss <issueId>` — Deprecated endpoint for archiving Security Center insights. Use the newer archive-security-center-insight endpoint instead. (supports --dry-run, --body)\n- `cf intel attack-surface-report issues severity` — Retrieves Security Center issue counts aggregated by severity level. (supports --dry-run)\n- `cf intel attack-surface-report issues type` — Retrieves Security Center issue counts aggregated by issue type. (supports --dry-run)\n- `cf intel indicator-feeds data <feedId>` — Retrieves the raw data entries in a custom threat indicator feed. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"healthchecks": "# healthchecks — Standalone health checks that monitor origin server availability from Cloudflare's edge\n\n## Commands\n\n### Read Operations\n\n- `cf healthchecks get <healthcheck-id>` — Fetch a single configured health check.\n- `cf healthchecks list` — List configured health checks.\n- `cf healthchecks previews get <healthcheck-id>` — Fetch a single configured health check preview.\n\n### Create Operations\n\n- `cf healthchecks create` — Create a new health check. (supports --dry-run, --body)\n- `cf healthchecks previews create` — Create a new preview health check. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf healthchecks edit <healthcheck-id>` — Patch a configured health check. (supports --dry-run, --body)\n- `cf healthchecks update <healthcheck-id>` — Update a configured health check. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf healthchecks delete <healthcheck-id>` — Delete a health check. (supports --dry-run)\n- `cf healthchecks previews delete <healthcheck-id>` — Delete a health check. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"hostnames": "# hostnames — Per-hostname TLS settings — minimum TLS version, ciphers, and certificate pinning overrides\n\n## Commands\n\n### Read Operations\n\n- `cf hostnames settings tls get <setting-id>` — List the requested TLS setting for the hostnames under this zone.\n- `cf hostnames settings tls-single get <hostname>` — Get the requested TLS setting for the hostname.\n\n### Update Operations\n\n- `cf hostnames settings tls update <hostname>` — Update the tls setting value for the hostname. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf hostnames settings tls delete <hostname>` — Delete the tls setting value for the hostname. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"hyperdrive": "# hyperdrive — Accelerate access to existing databases by caching queries and pooling connections at the edge\n\n## Commands\n\n### Read Operations\n\n- `cf hyperdrive get <hyperdrive-id>` — Returns the specified Hyperdrive configuration.\n- `cf hyperdrive list` — Returns a list of Hyperdrives.\n\n### Create Operations\n\n- `cf hyperdrive create` — Creates and returns a new Hyperdrive configuration. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf hyperdrive edit <hyperdrive-id>` — Patches and returns the specified Hyperdrive configuration. Custom caching settings are not kept if caching is disabled. (supports --dry-run, --body)\n- `cf hyperdrive update <hyperdrive-id>` — Updates and returns the specified Hyperdrive configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf hyperdrive delete <hyperdrive-id>` — Deletes the specified Hyperdrive. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"iam": "# iam — Identity and access management — permission groups, resource groups, user groups, and SSO connectors\n\n## Commands\n\n### Read Operations\n\n- `cf iam permission-groups get <permission-group-id>` — Get information about a specific permission group in an account.\n- `cf iam permission-groups list` — List all the permissions groups for an account.\n- `cf iam resource-groups get <resource-group-id>` — Get information about a specific resource group in an account.\n- `cf iam resource-groups list` — List all the resource groups for an account.\n- `cf iam sso get <sso-connector-id>` — Retrieves details for a specific SSO connector.\n- `cf iam sso list` — Lists all SSO connectors configured for the account.\n- `cf iam user-groups get <user-group-id>` — Get information about a specific user group in an account.\n- `cf iam user-groups list` — List all the user groups for an account.\n- `cf iam user-groups members list` — List all the members attached to a user group.\n\n### Create Operations\n\n- `cf iam resource-groups create` — Create a new Resource Group under the specified account. (supports --dry-run, --body)\n- `cf iam sso create` — Creates a new SSO connector for logging into Cloudflare through an identity provider. (supports --dry-run, --body)\n- `cf iam user-groups create` — Create a new user group under the specified account. (supports --dry-run, --body)\n- `cf iam user-groups members create <user-group-id>` — Add members to a User Group. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf iam resource-groups update <resource-group-id>` — Modify an existing resource group. (supports --dry-run, --body)\n- `cf iam sso update <sso-connector-id>` — Updates the state or configuration of an SSO connector. (supports --dry-run, --body)\n- `cf iam user-groups members update <user-group-id>` — Replace the set of members attached to a User Group. (supports --dry-run, --body)\n- `cf iam user-groups update <user-group-id>` — Modify an existing user group. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf iam resource-groups delete <resource-group-id>` — Remove a resource group from an account. (supports --dry-run)\n- `cf iam sso delete <sso-connector-id>` — Deletes an SSO connector from the account. (supports --dry-run)\n- `cf iam user-groups delete <user-group-id>` — Remove a user group from an account. (supports --dry-run)\n- `cf iam user-groups members delete <member-id>` — Remove a member from User Group (supports --dry-run)\n\n### Other Operations\n\n- `cf iam sso begin-verification <sso-connector-id>` — Validates the user has added the DNS TXT record required for validating ownership of the domain they are trying to set up a connector for. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"images": "# images — Store, resize, and deliver optimized images globally — variants, signing keys, and direct uploads\n\n## Commands\n\n### Read Operations\n\n- `cf images v1 blobs get <image-id>` — Download an image from CF Images. For most images this will be the originally uploaded file. For larger images it can be a near-lossless version of the original.\n- `cf images v1 get <image-id>` — Fetch details for a CF Images image.\n- `cf images v1 keys list` — List your CF Images signing keys.\n- `cf images v1 list` — List up to 100 images with one request. Use the optional parameters below to get a specific range of images.\n- `cf images v1 stats get` — Fetch image statistics details for Cloudflare Images. The returned statistics detail storage usage, including the current image count vs this account's allowance.\n- `cf images v1 variants get <variant-id>` — Fetch details for a CF Images variant.\n- `cf images v1 variants list` — List existing CF Images variants.\n- `cf images v1 variants-flat get <variant-id>` — Fetch details for a single variant with properties at the top level of the result.\n- `cf images v2 list` — List up to 10000 images from CF Images, with up to 1000 results per page. Use the optional parameters below to get a specific range of images. Pagination is supported via continuation_token. **Metadata Filtering (Optional):** You can optionally filter images by custom metadata fields using the `meta.<field>[<operator>]=<value>` syntax. **Supported Operators:** - `eq` / `eq:string` / `eq:number` / `eq:boolean` - Exact match - `gt` / `gt:number` - Greater than (number only) - `gte` / `gte:number` - Greater than or equal (number only) - `lt` / `lt:number` - Less than (number only) - `lte` / `lte:number` - Less than or equal (number only) - `in` / `in:string` / `in:number` - Match any value in list (pipe-separated) **Metadata Filter Constraints:** - Maximum 5 metadata filters per request - Maximum 5 levels of nesting (e.g., `meta.first.second.third.fourth.fifth`) - Maximum 10 elements for list operators (`in`) - Supports string, number, and boolean value types - Range operators (`gt`, `gte`, `lt`, `lte`) only accept numeric values **Filter Consistency:** Filters are combined with AND logic. The system does not validate whether filter combinations are logically consistent. For example, `meta.priority[eq:number]=5&meta.priority[lte:number]=3` will return zero results because no value can satisfy both conditions simultaneously. It is the caller's responsibility to ensure filter combinations make sense. **Examples:** ``` # List all images /images/v2 # Filter by metadata [eq] /images/v2?meta.status[eq:string]=active # Filter by metadata [in] /images/v2?meta.status[in]=pending|deleted|flagged # Filter by metadata [in:number] /images/v2?meta.ratings[in:number]=4|5 # Filter by metadata range [gte:number] /images/v2?meta.priority[gte:number]=1 # Filter by bounded range /images/v2?meta.priority[gte:number]=1&meta.priority[lte:number]=5 # Filter by nested metadata /images/v2?meta.region.name[eq]=eu-west # Combine metadata filters with creator /images/v2?meta.status[eq]=active&creator=user123 # Multiple metadata filters (AND logic) /images/v2?meta.status[eq]=active&meta.priority[eq:number]=5 ```\n\n### Create Operations\n\n- `cf images v1 create` — Upload an image to CF Images. Images up to 10 Megabytes can be uploaded using a single HTTP POST (multipart/form-data) request by sending an image file or passing a URL accessible to the API. (supports --dry-run, --body)\n- `cf images v1 variants create` — Create a CF Images variant that allows you to resize images for different use cases. (supports --dry-run, --body)\n- `cf images v2 direct-uploads create` — Direct uploads allow users to upload images without API keys. A common use case are web apps, client-side applications, or mobile devices where users upload content directly to Cloudflare Images. This method creates a draft record for a future image. It returns an upload URL and an image identifier. To verify if the image itself has been uploaded, send an image details request (accounts/:account_identifier/images/v1/:identifier), and check that the `draft: true` property is not present. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf images v1 edit <image-id>` — Update a CF Images image's metadata, creator, or access control. On access control change, all copies of the image are purged from cache. (supports --dry-run, --body)\n- `cf images v1 keys update <signing-key-name>` — Create a new CF Images signing key with specified name. Returns all keys available. (supports --dry-run)\n- `cf images v1 variants edit <variant-id>` — Update a CF Images variant. This will purge the cache for all images associated with the variant. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf images v1 delete <image-id>` — Delete an image on Cloudflare Images. On success, all copies of the image are deleted and purged from cache. (supports --dry-run)\n- `cf images v1 keys delete <signing-key-name>` — Delete a CF Images signing key with specified name. Returns all keys available. When the last key is removed, a new default signing key will be generated. (supports --dry-run)\n- `cf images v1 variants delete <variant-id>` — Delete a CF Images variant. This will purge the cache for all images associated with the variant. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"intel": "# intel — Threat intelligence lookups — IP reputation, domain info, ASN details, WHOIS, and indicator feeds\n\n## Commands\n\n### Read Operations\n\n- `cf intel asn get <asn>` — Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.\n- `cf intel asn subnets get <asn>` — Get ASN Subnets.\n- `cf intel attack-surface-report issue-types get` — Lists all available issue types in Security Center, describing categories of security issues.\n- `cf intel attack-surface-report issues list` — Lists all Security Center issues for the account, showing active security problems requiring attention.\n- `cf intel dns list` — Gets a list of all the domains that have resolved to a specific IP address.\n- `cf intel domain-history get` — Gets historical security threat and content categories currently and previously assigned to a domain.\n- `cf intel domains bulks get` — Returns security details and statistics about multiple domains in a single request. **Behavior change — domain ranking is becoming opt-in.** This endpoint previously included domain ranking data in every response and accepted a `skip_ranking=true` query parameter to opt out. That parameter is being deprecated and ranking will no longer be returned by default. Callers that want ranking data must pass `include_ranking=true`. The `skip_ranking` parameter will be silently ignored once the change ships.\n- `cf intel domains get` — Gets security details and statistics about a domain.\n- `cf intel indicator-feeds downloads get <feed-id>` — Downloads the content of a custom threat indicator feed.\n- `cf intel indicator-feeds get <feed-id>` — Retrieves details for a specific custom threat indicator feed.\n- `cf intel indicator-feeds list` — Retrieves details for all accessible custom threat indicator feeds.\n- `cf intel indicator-feeds permissions list` — Lists current access permissions for custom threat indicator feeds.\n- `cf intel ip-lists get` — Returns a list of available IP list categories (e.g., anonymizer, botnetcc, malware, tor, vpn, open_proxies). This endpoint provides metadata about which IP lists are available in the system.\n- `cf intel ips get` — Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address. **Must provide ip query parameters.** For example, `/intel/ip?ipv4=1.1.1.1` or `/intel/ip?ipv6=2001:db8::1`.\n- `cf intel whois get` — Retrieves WHOIS registration data for a domain, including registrant and nameserver information.\n\n### Create Operations\n\n- `cf intel indicator-feeds create` — Creates a new custom threat indicator feed for sharing threat intelligence data. (supports --dry-run, --body)\n- `cf intel indicator-feeds permissions create` — Grants access permissions for a custom threat indicator feed to other accounts. (supports --dry-run, --body)\n- `cf intel miscategorizations create` — Allows you to submit requests to change a domain’s category. Requests that include category `169` (New Domains) or category `177` (Newly Seen) in any of `content_adds`, `content_removes`, `security_adds`, or `security_removes` will be rejected with a `400 Bad Request`. These categories are automatically managed and fall off 30 days after they are applied. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf intel indicator-feeds snapshots update <feed-id>` — Revises the raw data entries in a custom threat indicator feed. Accepts both plain and gzipped STIX2/CRDF bodies. Gzip is detected by RFC 1952 magic bytes (`0x1f 0x8b`) and/or a `.gz` filename suffix (case-insensitive) — either signal alone is sufficient to trigger the gzip path; if the body is not valid gzip, the upload fails fast. Customers are encouraged to gzip larger uploads — the api-gateway 500 MB body cap applies to the on-the-wire (compressed) size, so gzip lets a single upload carry several GiB of decompressed STIX. (supports --dry-run, --body)\n- `cf intel indicator-feeds update <feed-id>` — Revises details for a specific custom threat indicator feed. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf intel indicator-feeds permissions delete` — Revokes access permissions for a custom threat indicator feed. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf intel attack-surface-report issues class` — Retrieves Security Center issue counts aggregated by classification class. (supports --dry-run)\n- `cf intel attack-surface-report issues dismiss <issue-id>` — Deprecated endpoint for archiving Security Center insights. Use the newer archive-security-center-insight endpoint instead. (supports --dry-run, --body)\n- `cf intel attack-surface-report issues severity` — Retrieves Security Center issue counts aggregated by severity level. (supports --dry-run)\n- `cf intel attack-surface-report issues type` — Retrieves Security Center issue counts aggregated by issue type. (supports --dry-run)\n- `cf intel indicator-feeds data <feed-id>` — Retrieves the raw data entries in a custom threat indicator feed. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ips": "# ips — List Cloudflare's IP ranges used for proxying traffic — useful for firewall allowlisting\n\n## Commands\n\n### Read Operations\n\n- `cf ips list` — Get IPs used on the Cloudflare/JD Cloud network, see https://www.cloudflare.com/ips for Cloudflare IPs or https://developers.cloudflare.com/china-network/reference/infrastructure/ for JD Cloud IPs.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"keyless-certificates": "# keyless-certificates — Use your own SSL certificates without exposing private keys — keys stay on your infrastructure\n\n## Commands\n\n### Read Operations\n\n- `cf keyless-certificates get <keylessCertificateId>` — Get details for one Keyless SSL configuration.\n- `cf keyless-certificates list` — List all Keyless SSL configurations for a given zone.\n\n### Create Operations\n\n- `cf keyless-certificates create` — Creates a Keyless SSL configuration that allows SSL/TLS termination without exposing private keys to Cloudflare. Keys remain on your infrastructure. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf keyless-certificates edit <keylessCertificateId>` — This will update attributes of a Keyless SSL. Consists of one or more of the following: host,name,port. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf keyless-certificates delete <keylessCertificateId>` — Removes a Keyless SSL configuration. SSL connections will no longer use the keyless server for cryptographic operations. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"kv": "# kv — Global, low-latency key-value storage for Workers — namespaces, keys, values, and bulk operations\n\n## Commands\n\n### Read Operations\n\n- `cf kv bulk get <namespaceId>` — Retrieve up to 100 KV pairs from the namespace. Keys must contain text-based values. JSON values can optionally be parsed instead of being returned as a string value. Metadata can be included if `withMetadata` is true. (supports --body)\n- `cf kv keys get <keyName>` — Returns the value associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. If the KV-pair is set to expire at some point, the expiration time as measured in seconds since the UNIX epoch will be returned in the `expiration` response header.\n- `cf kv keys list` — Lists a namespace's keys.\n- `cf kv metadata get <keyName>` — Returns the metadata associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.\n- `cf kv namespaces get <namespaceId>` — Get the namespace corresponding to the given ID.\n- `cf kv namespaces list` — Returns the namespaces owned by an account.\n\n### Create Operations\n\n- `cf kv namespaces create` — Creates a namespace under the given title. A `400` is returned if the account already owns a namespace with this title. A namespace must be explicitly deleted to be replaced. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf kv bulk update <namespaceId>` — Write multiple keys and values at once. Body should be an array of up to 10,000 key-value pairs to be stored, along with optional expiration information. Existing values and expirations will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. The entire request size must be 100 megabytes or less. (supports --dry-run, --body)\n- `cf kv keys update <keyName>` — Write a value identified by a key. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. Body should be the value to be stored. If JSON metadata to be associated with the key/value pair is needed, use `multipart/form-data` content type for your PUT request (see dropdown below in `REQUEST BODY SCHEMA`). Existing values, expirations, and metadata will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. (supports --dry-run, --body)\n- `cf kv namespaces update <namespaceId>` — Modifies a namespace's title. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf kv bulk delete <namespaceId>` — Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed. (supports --dry-run, --body)\n- `cf kv keys delete <keyName>` — Remove a KV pair from the namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. (supports --dry-run, --body)\n- `cf kv namespaces delete <namespaceId>` — Deletes the namespace corresponding to the given ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"leaked-credential-checks": "# leaked-credential-checks — Detect compromised credentials in login requests by checking against known breach databases\n\n## Commands\n\n### Read Operations\n\n- `cf leaked-credential-checks detections get <detectionId>` — Get user-defined detection pattern for Leaked Credential Checks.\n- `cf leaked-credential-checks detections list` — List user-defined detection patterns for Leaked Credential Checks.\n- `cf leaked-credential-checks get` — Retrieves the current status of Leaked Credential Checks.\n\n### Create Operations\n\n- `cf leaked-credential-checks create` — Updates the current status of Leaked Credential Checks. (supports --dry-run, --body)\n- `cf leaked-credential-checks detections create` — Create user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf leaked-credential-checks detections update <detectionId>` — Update user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf leaked-credential-checks detections delete <detectionId>` — Remove user-defined detection pattern for Leaked Credential Checks. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"load-balancers": "# load-balancers — Distribute traffic across origin pools with health monitoring, geo-steering, and failover\n\n## Commands\n\n### Read Operations\n\n- `cf load-balancers get <loadBalancerId>` — Fetch a single configured load balancer.\n- `cf load-balancers list` — List configured load balancers.\n- `cf load-balancers monitor-groups get <monitorGroupId>` — Fetch a single configured monitor group.\n- `cf load-balancers monitor-groups list` — List configured monitor groups.\n- `cf load-balancers monitor-groups references list` — Get the list of resources that reference the provided monitor group.\n- `cf load-balancers monitors get <monitorId>` — List a single configured monitor for an account.\n- `cf load-balancers monitors list` — List configured monitors for an account.\n- `cf load-balancers monitors references get <monitorId>` — Get the list of resources that reference the provided monitor.\n- `cf load-balancers pools get <poolId>` — Fetch a single configured pool.\n- `cf load-balancers pools health get <poolId>` — Fetch the latest pool health status for a single pool.\n- `cf load-balancers pools list` — List configured pools.\n- `cf load-balancers pools references get <poolId>` — Get the list of resources that reference the provided pool.\n- `cf load-balancers previews get <previewId>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf load-balancers regions get <regionId>` — Get a single region mapping.\n- `cf load-balancers regions list` — List all region mappings.\n- `cf load-balancers searches list` — Search for Load Balancing resources.\n\n### Create Operations\n\n- `cf load-balancers create` — Create a new load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups create` — Create a new monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers monitors previews create <monitorId>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf load-balancers pools health create <poolId>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf load-balancers edit <loadBalancerId>` — Apply changes to an existing load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups edit <monitorGroupId>` — Apply changes to an existing monitor group, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups update <monitorGroupId>` — Modify a configured monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors edit <monitorId>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitors update <monitorId>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools edit <poolId>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers pools update <poolId>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf load-balancers update <loadBalancerId>` — Update a configured load balancer. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf load-balancers delete <loadBalancerId>` — Delete a configured load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups delete <monitorGroupId>` — Delete a configured monitor group. (supports --dry-run)\n- `cf load-balancers monitors delete <monitorId>` — Delete a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools delete <poolId>` — Delete a configured pool. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf load-balancers pools bulk-edit` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"logpush": "# logpush — Push Cloudflare logs to external storage destinations — R2, S3, Splunk, Datadog, and more\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <datasetId>` — Lists Logpush jobs for an account for a dataset.\n- `cf logpush account-jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account.\n- `cf logpush datasets fields get <datasetId>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush datasets jobs get <datasetId>` — Lists Logpush jobs for a zone for a dataset.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush jobs get <jobId>` — Gets the details of a Logpush job.\n- `cf logpush jobs list` — Lists Logpush jobs for a zone.\n- `cf logpush log-explorer-datasets accounts available list` — Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets accounts get <datasetId>` — Retrieve a single Log Explorer dataset by ID for the account.\n- `cf logpush log-explorer-datasets accounts list` — Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logpush log-explorer-datasets zones available list` — Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logpush log-explorer-datasets zones get <datasetId>` — Retrieve a single Log Explorer dataset by ID for the zone.\n- `cf logpush log-explorer-datasets zones list` — Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush jobs create` — Creates a new Logpush job for a zone. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts create` — Create a new Log Explorer dataset for the account. Use the `/accounts/{account_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones create` — Create a new Log Explorer dataset for the zone. Use the `/zones/{zone_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. (supports --dry-run, --body)\n- `cf logpush ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush jobs update <jobId>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets accounts update <datasetId>` — Updates the enabled state and/or field configuration of an account dataset. (supports --dry-run, --body)\n- `cf logpush log-explorer-datasets zones update <datasetId>` — Updates the enabled state and/or field configuration of a zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush jobs delete <jobId>` — Deletes a Logpush job. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush log-explorer-query accounts query` — Run a SQL query against account-level datasets. (supports --dry-run, --body)\n- `cf logpush log-explorer-query zones query` — Run a SQL query against zone-level datasets. (supports --dry-run, --body)\n- `cf logpush ownership validate` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush validate destination` — Validates destination. (supports --dry-run, --body)\n- `cf logpush validate destination-exists` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush validate origin` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"logs": "# logs — Log control, retention, and raw log access — CMB config, ray ID lookups, and received fields\n\n## Commands\n\n### Read Operations\n\n- `cf logs control cmb config get` — Gets CMB config.\n- `cf logs control retention get` — Gets log retention flag for Logpull API.\n- `cf logs rayid get <rayId>` — The `/rayids` api route allows lookups by specific rayid. The rayids route will return zero, one, or more records (ray ids are not unique).\n- `cf logs received fields get` — Lists all fields available. The response is json object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logs received get` — The `/received` api route allows customers to retrieve their edge HTTP logs. The basic access pattern is \"give me all the logs for zone Z for minute M\", where the minute M refers to the time records were received at Cloudflare's central data center. `start` is inclusive, and `end` is exclusive. Because of that, to get all data, at minutely cadence, starting at 10AM, the proper values are: `start=2018-05-20T10:00:00Z&end=2018-05-20T10:01:00Z`, then `start=2018-05-20T10:01:00Z&end=2018-05-20T10:02:00Z` and so on; the overlap will be handled properly.\n\n### Create Operations\n\n- `cf logs control cmb config create` — Updates CMB config. (supports --dry-run, --body)\n- `cf logs control retention create` — Updates log retention flag for Logpull API. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logs control cmb config delete` — Deletes CMB config. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"magic-cloud-networking": "# magic-cloud-networking — Multi-cloud networking — discover cloud resources, manage on-ramps, and automate cross-cloud connectivity\n\n## Commands\n\n### Read Operations\n\n- `cf magic-cloud-networking catalog-syncs get <syncId>` — Read a Catalog Sync (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs list` — List Catalog Syncs (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs prebuilt-policies list` — List prebuilt catalog sync policies (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations get <providerId>` — Read a Cloud Integration (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations list` — List Cloud Integrations (Closed Beta).\n- `cf magic-cloud-networking on-ramps address-spaces list` — Read the Magic WAN Address Space (Closed Beta).\n- `cf magic-cloud-networking on-ramps export <onrampId>` — Export an On-ramp to terraform ready file(s) (Closed Beta).\n- `cf magic-cloud-networking on-ramps get <onrampId>` — Read an On-ramp (Closed Beta).\n- `cf magic-cloud-networking on-ramps list` — List On-ramps (Closed Beta).\n- `cf magic-cloud-networking resources export` — Export resources in the Resource Catalog as a JSON file (Closed Beta).\n- `cf magic-cloud-networking resources get <resourceId>` — Read an resource from the Resource Catalog (Closed Beta).\n- `cf magic-cloud-networking resources list` — List resources in the Resource Catalog (Closed Beta).\n\n### Create Operations\n\n- `cf magic-cloud-networking catalog-syncs create` — Create a new Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations create` — Create a new Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps create` — Create a new On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-cloud-networking catalog-syncs edit <syncId>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking catalog-syncs update <syncId>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations edit <providerId>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations update <providerId>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces edit` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces update` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps edit <onrampId>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps update <onrampId>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-cloud-networking catalog-syncs delete <syncId>` — Delete a Catalog Sync (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations delete <providerId>` — Delete a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps delete <onrampId>` — Delete an On-ramp (Closed Beta). (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-cloud-networking catalog-syncs refresh <syncId>` — Refresh a Catalog Sync's destination by running the sync policy against latest resource catalog (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover <providerId>` — Run discovery for a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover-all` — Run discovery for all Cloud Integrations in an account (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations initial-setup <providerId>` — Get initial configuration to complete Cloud Integration setup (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps apply <onrampId>` — Apply an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps plan <onrampId>` — Plan an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking resources policy-preview` — Preview Rego query result against the latest resource catalog (Closed Beta). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"magic-network-monitoring": "# magic-network-monitoring — Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion\n\n## Commands\n\n### Read Operations\n\n- `cf magic-network-monitoring configs full get` — Lists default sampling, router IPs, warp devices, and rules for account.\n- `cf magic-network-monitoring configs get` — Lists default sampling, router IPs and warp devices for account.\n- `cf magic-network-monitoring rules get <ruleId>` — List a single network monitoring rule for account.\n- `cf magic-network-monitoring rules list` — Lists network monitoring rules for account.\n\n### Create Operations\n\n- `cf magic-network-monitoring configs create` — Create a new network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules create` — Create network monitoring rules for account. Currently only supports creating a single rule per API request. (supports --dry-run, --body)\n- `cf magic-network-monitoring vpc-flows tokens create` — Generate authentication token for VPC flow logs export. (supports --dry-run)\n\n### Update Operations\n\n- `cf magic-network-monitoring configs edit` — Update fields in an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring configs update` — Update an existing network monitoring configuration, requires the entire configuration to be updated at once. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules advertisements edit <ruleId>` — Update advertisement for rule. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules edit <ruleId>` — Update a network monitoring rule for account. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules update` — Update network monitoring rules for account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-network-monitoring configs delete` — Delete an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules delete <ruleId>` — Delete a network monitoring rule for account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"magic-transit": "# magic-transit — DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures\n\n## Commands\n\n### Read Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules get <ruleId>` — Get a DNS Protection rule specified by the given UUID.\n- `cf magic-transit advanced-dns-protection configs dns protection rules list` — List all DNS Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs allowlist get <prefixId>` — Get an allowlist prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs allowlist list` — List all allowlist prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs prefixes get <prefixId>` — Get a prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs prefixes list` — List all prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters get <filterId>` — Get a SYN Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters list` — List all SYN Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules get <ruleId>` — Get a SYN Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules list` — List all SYN Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters get <filterId>` — Get a TCP Flow Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters list` — List all TCP Flow Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules get <ruleId>` — Get a TCP Flow Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules list` — List all TCP Flow Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp protection status get` — Get the protection status of the account.\n- `cf magic-transit apps list` — Lists Apps associated with an account.\n- `cf magic-transit cf-interconnects get <cfInterconnectId>` — Lists details for a specific interconnect.\n- `cf magic-transit cf-interconnects list` — Lists interconnects associated with an account.\n- `cf magic-transit connectors events get <eventN>` — Retrieves a specific telemetry event from a Magic WAN Connector for troubleshooting and monitoring.\n- `cf magic-transit connectors events latest list` — Retrieves the most recent telemetry events from a Magic WAN Connector.\n- `cf magic-transit connectors events list` — Lists telemetry events from a Magic WAN Connector, showing connection events and status changes.\n- `cf magic-transit connectors get <connectorId>` — Retrieves detailed configuration for a specific Magic WAN Connector, including its status and network settings.\n- `cf magic-transit connectors list` — Lists all Magic WAN Connectors configured for the account with their status and connection information.\n- `cf magic-transit connectors snapshots get <snapshotT>` — Gets a specific telemetry snapshot from a Magic WAN Connector, showing point-in-time metrics.\n- `cf magic-transit connectors snapshots latest list` — Retrieves the most recent telemetry snapshots from a Magic WAN Connector.\n- `cf magic-transit connectors snapshots list` — Lists telemetry snapshots from a Magic WAN Connector, providing historical performance data.\n- `cf magic-transit gre-tunnels get <greTunnelId>` — Lists informtion for a specific GRE tunnel.\n- `cf magic-transit gre-tunnels list` — Lists GRE tunnels associated with an account.\n- `cf magic-transit ipsec-tunnels get <ipsecTunnelId>` — Lists details for a specific IPsec tunnel.\n- `cf magic-transit ipsec-tunnels list` — Lists IPsec tunnels associated with an account.\n- `cf magic-transit pcaps download get <pcapId>` — Download PCAP information into a file. Response is a binary PCAP file.\n- `cf magic-transit pcaps get <pcapId>` — Get information for a PCAP request by id.\n- `cf magic-transit pcaps list` — Lists all packet capture requests for an account.\n- `cf magic-transit pcaps ownership get` — List all buckets configured for use with PCAPs API.\n- `cf magic-transit routes get <routeId>` — Get a specific Magic static route.\n- `cf magic-transit routes list` — List all Magic static routes.\n- `cf magic-transit sites acls get <aclId>` — Get a specific Site ACL.\n- `cf magic-transit sites acls list` — Lists Site ACLs associated with an account.\n- `cf magic-transit sites app-configuration list` — Lists App Configs associated with a site.\n- `cf magic-transit sites get <siteId>` — Get a specific Site.\n- `cf magic-transit sites lans get <lanId>` — Get a specific Site LAN.\n- `cf magic-transit sites lans list` — Lists Site LANs associated with an account.\n- `cf magic-transit sites list` — Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.\n- `cf magic-transit sites netflow-config get <siteId>` — Get NetFlow configuration for a site.\n- `cf magic-transit sites wans get <wanId>` — Get a specific Site WAN.\n- `cf magic-transit sites wans list` — Lists Site WANs associated with an account.\n\n### Create Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules create` — Create a DNS Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist create` — Create an allowlist prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes bulk create` — Create multiple prefixes for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes create` — Create a prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters create` — Create a SYN Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules create` — Create a SYN Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters create` — Create a TCP Flow Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules create` — Create a TCP Flow Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit apps create` — Creates a new App for an account (supports --dry-run, --body)\n- `cf magic-transit connectors create` — Creates a new Magic WAN Connector for establishing secure network connectivity. Connectors enable site-to-site VPN and SDWAN functionality. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels create` — Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels create` — Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit pcaps create` — Create new PCAP request for account. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership create` — Adds an AWS or GCP bucket to use with full packet captures. (supports --dry-run, --body)\n- `cf magic-transit routes create` — Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls create <siteId>` — Creates a new Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration create <siteId>` — Creates a new App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites create` — Creates a new Site (supports --dry-run, --body)\n- `cf magic-transit sites lans create <siteId>` — Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config create <siteId>` — Creates a NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites wans create <siteId>` — Creates a new Site WAN. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules update <ruleId>` — Update a DNS Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist update <prefixId>` — Update an allowlist prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes update <prefixId>` — Update a prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters update <filterId>` — Update a SYN Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules update <ruleId>` — Update a SYN Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters update <filterId>` — Update a TCP Flow Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules update <ruleId>` — Update a TCP Flow Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp protection status update` — Update the protection status of the account. (supports --dry-run, --body)\n- `cf magic-transit apps edit <accountAppId>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit apps update <accountAppId>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit cf-interconnects update <cfInterconnectId>` — Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit connectors edit <connectorId>` — Updates the configuration of an existing Magic WAN Connector, such as network settings or policies. (supports --dry-run, --body)\n- `cf magic-transit connectors update <connectorId>` — Replaces the configuration of an existing Magic WAN Connector with new settings. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels update <greTunnelId>` — Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels update <ipsecTunnelId>` — Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit routes update <routeId>` — Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls edit <aclId>` — Patch a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites acls update <aclId>` — Update a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration edit <appConfigId>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration update <appConfigId>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites edit <siteId>` — Patch a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites lans edit <lanId>` — Patch a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites lans update <lanId>` — Update a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config edit <siteId>` — Updates NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config update <siteId>` — Updates NetFlow configuration for a site (partial update). (supports --dry-run, --body)\n- `cf magic-transit sites update <siteId>` — Update a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites wans edit <wanId>` — Patch a specific Site WAN. (supports --dry-run, --body)\n- `cf magic-transit sites wans update <wanId>` — Update a specific Site WAN. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-transit apps delete <accountAppId>` — Deletes specific Account App. (supports --dry-run)\n- `cf magic-transit connectors delete <connectorId>` — Removes a Magic WAN Connector. The connector will be deregistered and network connectivity through it will be terminated. (supports --dry-run)\n- `cf magic-transit gre-tunnels delete <greTunnelId>` — Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels delete <ipsecTunnelId>` — Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership delete <ownershipId>` — Deletes buckets added to the packet captures API. (supports --dry-run)\n- `cf magic-transit routes delete <routeId>` — Disable and remove a specific Magic static route. (supports --dry-run, --body)\n- `cf magic-transit sites acls delete <aclId>` — Remove a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration delete <appConfigId>` — Deletes specific App Config associated with a site. (supports --dry-run)\n- `cf magic-transit sites delete <siteId>` — Remove a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites lans delete <lanId>` — Remove a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config delete <siteId>` — Remove NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites wans delete <wanId>` — Remove a specific Site WAN. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete for account` — Delete all DNS Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule <ruleId>` — Delete a DNS Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix <prefixId>` — Delete the allowlist prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete for account` — Delete all allowlist prefixes for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs prefixes delete for account` — Delete all prefixes for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs prefixes delete prefix <prefixId>` — Delete the prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete for account` — Delete all SYN Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete protection filter <filterId>` — Delete a SYN Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete for account` — Delete all SYN Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete protection rule <ruleId>` — Delete a SYN Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete for account` — Delete all TCP Flow Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete protection filter <filterId>` — Delete a TCP Flow Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete for account` — Delete all TCP Flow Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete protection rule <ruleId>` — Delete a TCP Flow Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit cf-interconnects bulk-update` — Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels bulk-update` — Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels bulk-update` — Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels psk-generate <ipsecTunnelId>` — Generates a Pre Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Note the PSK in a safe place. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership validate` — Validates buckets added to the packet captures API. (supports --dry-run, --body)\n- `cf magic-transit pcaps stop <pcapId>` — Stop full PCAP. (supports --dry-run)\n- `cf magic-transit routes bulk-update` — Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided. (supports --dry-run, --body)\n- `cf magic-transit routes empty` — Delete multiple Magic static routes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"keyless-certificates": "# keyless-certificates — Use your own SSL certificates without exposing private keys — keys stay on your infrastructure\n\n## Commands\n\n### Read Operations\n\n- `cf keyless-certificates get <keyless-certificate-id>` — Get details for one Keyless SSL configuration.\n- `cf keyless-certificates list` — List all Keyless SSL configurations for a given zone.\n\n### Create Operations\n\n- `cf keyless-certificates create` — Creates a Keyless SSL configuration that allows SSL/TLS termination without exposing private keys to Cloudflare. Keys remain on your infrastructure. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf keyless-certificates edit <keyless-certificate-id>` — This will update attributes of a Keyless SSL. Consists of one or more of the following: host,name,port. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf keyless-certificates delete <keyless-certificate-id>` — Removes a Keyless SSL configuration. SSL connections will no longer use the keyless server for cryptographic operations. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"kv": "# kv — Global, low-latency key-value storage for Workers — namespaces, keys, values, and bulk operations\n\n## Commands\n\n### Read Operations\n\n- `cf kv bulk get <namespace-id>` — Retrieve up to 100 KV pairs from the namespace. Keys must contain text-based values. JSON values can optionally be parsed instead of being returned as a string value. Metadata can be included if `withMetadata` is true. (supports --body)\n- `cf kv keys get <key-name>` — Returns the value associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. If the KV-pair is set to expire at some point, the expiration time as measured in seconds since the UNIX epoch will be returned in the `expiration` response header.\n- `cf kv keys list` — Lists a namespace's keys.\n- `cf kv metadata get <key-name>` — Returns the metadata associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.\n- `cf kv namespaces get <namespace-id>` — Get the namespace corresponding to the given ID.\n- `cf kv namespaces list` — Returns the namespaces owned by an account.\n\n### Create Operations\n\n- `cf kv namespaces create` — Creates a namespace under the given title. A `400` is returned if the account already owns a namespace with this title. A namespace must be explicitly deleted to be replaced. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf kv bulk update <namespace-id>` — Write multiple keys and values at once. Body should be an array of up to 10,000 key-value pairs to be stored, along with optional expiration information. Existing values and expirations will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. The entire request size must be 100 megabytes or less. (supports --dry-run, --body)\n- `cf kv keys update <key-name>` — Write a value identified by a key. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. Body should be the value to be stored. If JSON metadata to be associated with the key/value pair is needed, use `multipart/form-data` content type for your PUT request (see dropdown below in `REQUEST BODY SCHEMA`). Existing values, expirations, and metadata will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. (supports --dry-run, --body)\n- `cf kv namespaces update <namespace-id>` — Modifies a namespace's title. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf kv bulk delete <namespace-id>` — Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed. (supports --dry-run, --body)\n- `cf kv keys delete <key-name>` — Remove a KV pair from the namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. (supports --dry-run)\n- `cf kv namespaces delete <namespace-id>` — Deletes the namespace corresponding to the given ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"leaked-credential-checks": "# leaked-credential-checks — Detect compromised credentials in login requests by checking against known breach databases\n\n## Commands\n\n### Read Operations\n\n- `cf leaked-credential-checks detections get <detection-id>` — Get user-defined detection pattern for Leaked Credential Checks.\n- `cf leaked-credential-checks detections list` — List user-defined detection patterns for Leaked Credential Checks.\n- `cf leaked-credential-checks get` — Retrieves the current status of Leaked Credential Checks.\n\n### Create Operations\n\n- `cf leaked-credential-checks create` — Updates the current status of Leaked Credential Checks. (supports --dry-run, --body)\n- `cf leaked-credential-checks detections create` — Create user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf leaked-credential-checks detections update <detection-id>` — Update user-defined detection pattern for Leaked Credential Checks. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf leaked-credential-checks detections delete <detection-id>` — Remove user-defined detection pattern for Leaked Credential Checks. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"load-balancers": "# load-balancers — Distribute traffic across origin pools with health monitoring, geo-steering, and failover\n\n## Commands\n\n### Read Operations\n\n- `cf load-balancers get <load-balancer-id>` — Fetch a single configured load balancer.\n- `cf load-balancers list` — List configured load balancers.\n- `cf load-balancers monitor-groups get <monitor-group-id>` — Fetch a single configured monitor group.\n- `cf load-balancers monitor-groups list` — List configured monitor groups.\n- `cf load-balancers monitor-groups references list` — Get the list of resources that reference the provided monitor group.\n- `cf load-balancers monitors get <monitor-id>` — List a single configured monitor for an account.\n- `cf load-balancers monitors list` — List configured monitors for an account.\n- `cf load-balancers monitors references get <monitor-id>` — Get the list of resources that reference the provided monitor.\n- `cf load-balancers pools get <pool-id>` — Fetch a single configured pool.\n- `cf load-balancers pools health get <pool-id>` — Fetch the latest pool health status for a single pool.\n- `cf load-balancers pools list` — List configured pools.\n- `cf load-balancers pools references get <pool-id>` — Get the list of resources that reference the provided pool.\n- `cf load-balancers previews get <preview-id>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf load-balancers regions get <region-id>` — Get a single region mapping.\n- `cf load-balancers regions list` — List all region mappings.\n- `cf load-balancers searches list` — Search for Load Balancing resources.\n\n### Create Operations\n\n- `cf load-balancers create` — Create a new load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups create` — Create a new monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers monitors previews create <monitor-id>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf load-balancers pools health create <pool-id>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf load-balancers edit <load-balancer-id>` — Apply changes to an existing load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups edit <monitor-group-id>` — Apply changes to an existing monitor group, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups update <monitor-group-id>` — Modify a configured monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors edit <monitor-id>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitors update <monitor-id>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools edit <pool-id>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers pools update <pool-id>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf load-balancers update <load-balancer-id>` — Update a configured load balancer. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf load-balancers delete <load-balancer-id>` — Delete a configured load balancer. (supports --dry-run)\n- `cf load-balancers monitor-groups delete <monitor-group-id>` — Delete a configured monitor group. (supports --dry-run)\n- `cf load-balancers monitors delete <monitor-id>` — Delete a configured monitor. (supports --dry-run)\n- `cf load-balancers pools delete <pool-id>` — Delete a configured pool. (supports --dry-run)\n\n### Other Operations\n\n- `cf load-balancers pools bulk-edit` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"logpush": "# logpush — Push Cloudflare logs to external storage destinations — R2, S3, Splunk, Datadog, and more\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <dataset-id>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <dataset-id>` — Lists Logpush jobs for an account for a dataset.\n- `cf logpush account-jobs get <job-id>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account.\n- `cf logpush datasets fields get <dataset-id>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush datasets jobs get <dataset-id>` — Lists Logpush jobs for a zone for a dataset.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush jobs get <job-id>` — Gets the details of a Logpush job.\n- `cf logpush jobs list` — Lists Logpush jobs for a zone.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush jobs create` — Creates a new Logpush job for a zone. (supports --dry-run, --body)\n- `cf logpush ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <job-id>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush jobs update <job-id>` — Updates a Logpush job. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <job-id>` — Deletes a Logpush job. (supports --dry-run)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush jobs delete <job-id>` — Deletes a Logpush job. (supports --dry-run)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush ownership validate` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush validate destination` — Validates destination. (supports --dry-run, --body)\n- `cf logpush validate destination-exists` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush validate origin` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"logs": "# logs — Log control, retention, and raw log access — CMB config, ray ID lookups, and received fields\n\n## Commands\n\n### Read Operations\n\n- `cf logs control cmb config get` — Gets CMB config.\n- `cf logs control retention get` — Gets log retention flag for Logpull API.\n- `cf logs list get` — Lists R2 objects containing logs matching the provided query parameters.\n- `cf logs log-explorer datasets accounts available list` — Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logs log-explorer datasets accounts get <dataset-id>` — Retrieve a single Log Explorer dataset by ID for the account.\n- `cf logs log-explorer datasets accounts list` — Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logs log-explorer datasets zones available list` — Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.\n- `cf logs log-explorer datasets zones get <dataset-id>` — Retrieve a single Log Explorer dataset by ID for the zone.\n- `cf logs log-explorer datasets zones list` — Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logs rayid get <ray-id>` — The `/rayids` api route allows lookups by specific rayid. The rayids route will return zero, one, or more records (ray ids are not unique).\n- `cf logs received fields get` — Lists all fields available. The response is json object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logs received get` — The `/received` api route allows customers to retrieve their edge HTTP logs. The basic access pattern is \"give me all the logs for zone Z for minute M\", where the minute M refers to the time records were received at Cloudflare's central data center. `start` is inclusive, and `end` is exclusive. Because of that, to get all data, at minutely cadence, starting at 10AM, the proper values are: `start=2018-05-20T10:00:00Z&end=2018-05-20T10:01:00Z`, then `start=2018-05-20T10:01:00Z&end=2018-05-20T10:02:00Z` and so on; the overlap will be handled properly.\n- `cf logs retrieve get` — Returns logs stored in R2 that match the provided query parameters.\n\n### Create Operations\n\n- `cf logs control cmb config create` — Updates CMB config. (supports --dry-run, --body)\n- `cf logs control retention create` — Updates log retention flag for Logpull API. (supports --dry-run, --body)\n- `cf logs log-explorer datasets accounts create` — Create a new Log Explorer dataset for the account. Use the `/accounts/{account_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. For zone-level datasets use the zone-scoped endpoint: POST /zones/{zone_id}/logs/explorer/datasets For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n- `cf logs log-explorer datasets zones create` — Create a new Log Explorer dataset for the zone. Use the `/zones/{zone_id}/logs/explorer/datasets/available` endpoint to list dataset types you can create along with their available fields. The `fields` property is optional. If not specified, all available fields will be enabled. For account-level datasets use the account-scoped endpoint: POST /accounts/{account_id}/logs/explorer/datasets For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logs log-explorer datasets accounts update <dataset-id>` — Updates the enabled state and/or field configuration of an account dataset. (supports --dry-run, --body)\n- `cf logs log-explorer datasets zones update <dataset-id>` — Updates the enabled state and/or field configuration of a zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logs control cmb config delete` — Deletes CMB config. (supports --dry-run)\n\n### Other Operations\n\n- `cf logs log-explorer query accounts sql` — Run a SQL query against account-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' Check /accounts/{account_id}/logs/explorer/datasets to see enabled account level datasets. Zone-level datasets will not appear here. Check /accounts/{account_id}/logs/explorer/datasets/available for the schemas, and the name of the timestamp fields. For zone-level datasets use the zone-scoped endpoint: POST /zones/{zone_id}/logs/explorer/query/sql For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n- `cf logs log-explorer query zones sql` — Run a SQL query against zone-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' Check /zones/{zone_id}/logs/explorer/datasets to see enabled zone level datasets. Check /zones/{zone_id}/logs/explorer/datasets/available for the schemas and the name of the timestamp fields. For account-level datasets use the account-scoped endpoint: POST /accounts/{account_id}/logs/explorer/query/sql For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"magic-cloud-networking": "# magic-cloud-networking — Multi-cloud networking — discover cloud resources, manage on-ramps, and automate cross-cloud connectivity\n\n## Commands\n\n### Read Operations\n\n- `cf magic-cloud-networking catalog-syncs get <sync-id>` — Read a Catalog Sync (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs list` — List Catalog Syncs (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs prebuilt-policies list` — List prebuilt catalog sync policies (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations get <provider-id>` — Read a Cloud Integration (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations list` — List Cloud Integrations (Closed Beta).\n- `cf magic-cloud-networking on-ramps address-spaces list` — Read the Magic WAN Address Space (Closed Beta).\n- `cf magic-cloud-networking on-ramps export <onramp-id>` — Export an On-ramp to terraform ready file(s) (Closed Beta).\n- `cf magic-cloud-networking on-ramps get <onramp-id>` — Read an On-ramp (Closed Beta).\n- `cf magic-cloud-networking on-ramps list` — List On-ramps (Closed Beta).\n- `cf magic-cloud-networking resources export` — Export resources in the Resource Catalog as a JSON file (Closed Beta).\n- `cf magic-cloud-networking resources get <resource-id>` — Read an resource from the Resource Catalog (Closed Beta).\n- `cf magic-cloud-networking resources list` — List resources in the Resource Catalog (Closed Beta).\n\n### Create Operations\n\n- `cf magic-cloud-networking catalog-syncs create` — Create a new Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations create` — Create a new Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps create` — Create a new On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-cloud-networking catalog-syncs edit <sync-id>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking catalog-syncs update <sync-id>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations edit <provider-id>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations update <provider-id>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces edit` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces update` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps edit <onramp-id>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps update <onramp-id>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-cloud-networking catalog-syncs delete <sync-id>` — Delete a Catalog Sync (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations delete <provider-id>` — Delete a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps delete <onramp-id>` — Delete an On-ramp (Closed Beta). (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-cloud-networking catalog-syncs refresh <sync-id>` — Refresh a Catalog Sync's destination by running the sync policy against latest resource catalog (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover <provider-id>` — Run discovery for a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover-all` — Run discovery for all Cloud Integrations in an account (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations initial-setup <provider-id>` — Get initial configuration to complete Cloud Integration setup (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps apply <onramp-id>` — Apply an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps plan <onramp-id>` — Plan an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking resources policy-preview` — Preview Rego query result against the latest resource catalog (Closed Beta). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"magic-network-monitoring": "# magic-network-monitoring — Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion\n\n## Commands\n\n### Read Operations\n\n- `cf magic-network-monitoring configs full get` — Lists default sampling, router IPs, warp devices, and rules for account.\n- `cf magic-network-monitoring configs get` — Lists default sampling, router IPs and warp devices for account.\n- `cf magic-network-monitoring rules get <rule-id>` — List a single network monitoring rule for account.\n- `cf magic-network-monitoring rules list` — Lists network monitoring rules for account.\n\n### Create Operations\n\n- `cf magic-network-monitoring configs create` — Create a new network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules create` — Create network monitoring rules for account. Currently only supports creating a single rule per API request. (supports --dry-run, --body)\n- `cf magic-network-monitoring vpc-flows tokens create` — Generate authentication token for VPC flow logs export. (supports --dry-run)\n\n### Update Operations\n\n- `cf magic-network-monitoring configs edit` — Update fields in an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring configs update` — Update an existing network monitoring configuration, requires the entire configuration to be updated at once. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules advertisements edit <rule-id>` — Update advertisement for rule. (supports --dry-run)\n- `cf magic-network-monitoring rules edit <rule-id>` — Update a network monitoring rule for account. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules update` — Update network monitoring rules for account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-network-monitoring configs delete` — Delete an existing network monitoring configuration. (supports --dry-run)\n- `cf magic-network-monitoring rules delete <rule-id>` — Delete a network monitoring rule for account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"magic-transit": "# magic-transit — DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures\n\n## Commands\n\n### Read Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules get <rule-id>` — Get a DNS Protection rule specified by the given UUID.\n- `cf magic-transit advanced-dns-protection configs dns protection rules list` — List all DNS Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs allowlist get <prefix-id>` — Get an allowlist prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs allowlist list` — List all allowlist prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs prefixes get <prefix-id>` — Get a prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs prefixes list` — List all prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters get <filter-id>` — Get a SYN Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters list` — List all SYN Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules get <rule-id>` — Get a SYN Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules list` — List all SYN Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters get <filter-id>` — Get a TCP Flow Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters list` — List all TCP Flow Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules get <rule-id>` — Get a TCP Flow Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules list` — List all TCP Flow Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp protection status get` — Get the protection status of the account.\n- `cf magic-transit apps list` — Lists Apps associated with an account.\n- `cf magic-transit bgp-filter-profiles get <profile-id>` — Gets a specific BGP filter profile for an account.\n- `cf magic-transit bgp-filter-profiles list` — Lists all BGP filter profiles for an account.\n- `cf magic-transit bgp-settings get` — Gets the BGP settings for an account, including the default ASN and redistribution configuration.\n- `cf magic-transit cf-interconnects get <cf-interconnect-id>` — Lists details for a specific interconnect.\n- `cf magic-transit cf-interconnects list` — Lists interconnects associated with an account.\n- `cf magic-transit connectors events list` — Lists Magic WAN Connector Telemetry Events\n- `cf magic-transit connectors get <connector-id>` — Fetches a Magic WAN Connector.\n- `cf magic-transit connectors list` — Lists Magic WAN Connectors.\n- `cf magic-transit connectors snapshots list` — Lists Magic WAN Connector Telemetry Snapshots\n- `cf magic-transit gre-tunnels get <gre-tunnel-id>` — Lists informtion for a specific GRE tunnel.\n- `cf magic-transit gre-tunnels list` — Lists GRE tunnels associated with an account.\n- `cf magic-transit ipsec-tunnels get <ipsec-tunnel-id>` — Lists details for a specific IPsec tunnel.\n- `cf magic-transit ipsec-tunnels list` — Lists IPsec tunnels associated with an account.\n- `cf magic-transit pcaps download get <pcap-id>` — Download PCAP information into a file. Response is a binary PCAP file.\n- `cf magic-transit pcaps get <pcap-id>` — Get information for a PCAP request by id.\n- `cf magic-transit pcaps list` — Lists all packet capture requests for an account.\n- `cf magic-transit pcaps ownership get` — List all buckets configured for use with PCAPs API.\n- `cf magic-transit routes get <route-id>` — Get a specific Magic static route.\n- `cf magic-transit routes list` — List all Magic static routes.\n- `cf magic-transit sites acls get <acl-id>` — Get a specific Site ACL.\n- `cf magic-transit sites acls list` — Lists Site ACLs associated with an account.\n- `cf magic-transit sites app-configuration list` — Lists App Configs associated with a site.\n- `cf magic-transit sites get <site-id>` — Get a specific Site.\n- `cf magic-transit sites lans get <lan-id>` — Get a specific Site LAN.\n- `cf magic-transit sites lans list` — Lists Site LANs associated with an account.\n- `cf magic-transit sites list` — Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.\n- `cf magic-transit sites netflow-config get <site-id>` — Get NetFlow configuration for a site.\n- `cf magic-transit sites wans get <wan-id>` — Get a specific Site WAN.\n- `cf magic-transit sites wans list` — Lists Site WANs associated with an account.\n\n### Create Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules create` — Create a DNS Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist create` — Create an allowlist prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes bulk create` — Create multiple prefixes for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes create` — Create a prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters create` — Create a SYN Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules create` — Create a SYN Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters create` — Create a TCP Flow Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules create` — Create a TCP Flow Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit apps create` — Creates a new App for an account (supports --dry-run, --body)\n- `cf magic-transit bgp-filter-profiles create` — Creates a new BGP filter profile for an account. (supports --dry-run, --body)\n- `cf magic-transit connectors create` — Creates a Magic WAN Connector. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels create` — Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels create` — Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit pcaps create` — Create new PCAP request for account. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership create` — Adds an AWS or GCP bucket to use with full packet captures. (supports --dry-run, --body)\n- `cf magic-transit routes create` — Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls create <site-id>` — Creates a new Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration create <site-id>` — Creates a new App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites create` — Creates a new Site (supports --dry-run, --body)\n- `cf magic-transit sites lans create <site-id>` — Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config create <site-id>` — Creates a NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites wans create <site-id>` — Creates a new Site WAN. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules update <rule-id>` — Update a DNS Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist update <prefix-id>` — Update an allowlist prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes update <prefix-id>` — Update a prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters update <filter-id>` — Update a SYN Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules update <rule-id>` — Update a SYN Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters update <filter-id>` — Update a TCP Flow Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules update <rule-id>` — Update a TCP Flow Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp protection status update` — Update the protection status of the account. (supports --dry-run, --body)\n- `cf magic-transit apps edit <account-app-id>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit apps update <account-app-id>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit bgp-filter-profiles update <profile-id>` — Updates a BGP filter profile. Omitted properties are left unchanged. To clear an existing description send `description: \"\"`. (supports --dry-run, --body)\n- `cf magic-transit bgp-settings update` — Modifies the BGP settings for an account, including the default ASN and redistribution configuration. (supports --dry-run, --body)\n- `cf magic-transit cf-interconnects update <cf-interconnect-id>` — Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit connectors edit <connector-id>` — Updates properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n- `cf magic-transit connectors update <connector-id>` — Replaces properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels update <gre-tunnel-id>` — Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels update <ipsec-tunnel-id>` — Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit routes update <route-id>` — Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls edit <acl-id>` — Patch a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites acls update <acl-id>` — Update a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration edit <app-config-id>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration update <app-config-id>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites edit <site-id>` — Patch a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites lans edit <lan-id>` — Patch a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites lans update <lan-id>` — Update a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config edit <site-id>` — Updates NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config update <site-id>` — Updates NetFlow configuration for a site (partial update). (supports --dry-run, --body)\n- `cf magic-transit sites update <site-id>` — Update a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites wans edit <wan-id>` — Patch a specific Site WAN. (supports --dry-run, --body)\n- `cf magic-transit sites wans update <wan-id>` — Update a specific Site WAN. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-transit apps delete <account-app-id>` — Deletes specific Account App. (supports --dry-run)\n- `cf magic-transit bgp-filter-profiles delete <profile-id>` — Deletes a BGP filter profile. (supports --dry-run)\n- `cf magic-transit connectors delete <connector-id>` — Deletes a Magic WAN Connector. (supports --dry-run)\n- `cf magic-transit gre-tunnels delete <gre-tunnel-id>` — Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run)\n- `cf magic-transit ipsec-tunnels delete <ipsec-tunnel-id>` — Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run)\n- `cf magic-transit pcaps ownership delete <ownership-id>` — Deletes buckets added to the packet captures API. (supports --dry-run)\n- `cf magic-transit routes delete <route-id>` — Disable and remove a specific Magic static route. (supports --dry-run)\n- `cf magic-transit sites acls delete <acl-id>` — Remove a specific Site ACL. (supports --dry-run)\n- `cf magic-transit sites app-configuration delete <app-config-id>` — Deletes specific App Config associated with a site. (supports --dry-run)\n- `cf magic-transit sites delete <site-id>` — Remove a specific Site. (supports --dry-run)\n- `cf magic-transit sites lans delete <lan-id>` — Remove a specific Site LAN. (supports --dry-run)\n- `cf magic-transit sites netflow-config delete <site-id>` — Remove NetFlow configuration for a site. (supports --dry-run)\n- `cf magic-transit sites wans delete <wan-id>` — Remove a specific Site WAN. (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete for account` — Delete all DNS Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule <rule-id>` — Delete a DNS Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix <prefix-id>` — Delete the allowlist prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete for account` — Delete all allowlist prefixes for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs prefixes delete for account` — Delete all prefixes for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs prefixes delete prefix <prefix-id>` — Delete the prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete for account` — Delete all SYN Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete protection filter <filter-id>` — Delete a SYN Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete for account` — Delete all SYN Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete protection rule <rule-id>` — Delete a SYN Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete for account` — Delete all TCP Flow Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete protection filter <filter-id>` — Delete a TCP Flow Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete for account` — Delete all TCP Flow Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete protection rule <rule-id>` — Delete a TCP Flow Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit cf-interconnects bulk-update` — Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels bulk-update` — Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels bulk-update` — Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels psk-generate <ipsec-tunnel-id>` — Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a safe place. (supports --dry-run)\n- `cf magic-transit pcaps ownership validate` — Validates buckets added to the packet captures API. (supports --dry-run, --body)\n- `cf magic-transit pcaps stop <pcap-id>` — Stop full PCAP. (supports --dry-run)\n- `cf magic-transit routes bulk-update` — Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided. (supports --dry-run, --body)\n- `cf magic-transit routes empty` — Delete multiple Magic static routes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"managed-transforms": "# managed-transforms — Cloudflare-managed HTTP header transforms — automatically add security headers, remove server info, etc.\n\n## Commands\n\n### Read Operations\n\n- `cf managed-transforms list` — Fetches a list of all Managed Transforms.\n\n### Update Operations\n\n- `cf managed-transforms edit` — Updates the status of one or more Managed Transforms. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf managed-transforms delete` — Disables all Managed Transforms. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"mtls-certificates": "# mtls-certificates — Upload and manage mTLS certificates used by API Shield, Workers, and Gateway for client authentication\n\n## Commands\n\n### Read Operations\n\n- `cf mtls-certificates associations get <mtlsCertificateId>` — Lists all active associations between the certificate and Cloudflare services.\n- `cf mtls-certificates get <mtlsCertificateId>` — Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/).\n- `cf mtls-certificates list` — Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/).\n\n### Create Operations\n\n- `cf mtls-certificates create` — Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mtls-certificates delete <mtlsCertificateId>` — Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"network-interconnects": "# network-interconnects — Physical and virtual private interconnects between your infrastructure and Cloudflare's network\n\n## Commands\n\n### Read Operations\n\n- `cf network-interconnects cnis get <cni>` — Retrieves configuration details for a specific Cloud Network Interconnect (CNI), including connection status and parameters.\n- `cf network-interconnects cnis list` — Lists all Cloud Network Interconnects (CNIs) configured for the account, showing connection status and parameters.\n- `cf network-interconnects interconnects get <icon>` — Retrieves configuration and status details for a specific network interconnect.\n- `cf network-interconnects interconnects list` — Lists all network interconnects configured for the account, including physical and virtual connections.\n- `cf network-interconnects interconnects status <icon>` — Gets the current operational status of a network interconnect, including link state and traffic metrics.\n- `cf network-interconnects settings get` — Retrieves current settings configuration for the specified resource or service.\n- `cf network-interconnects slots get <slot>` — Gets information about a specific infrastructure slot allocation.\n- `cf network-interconnects slots list` — Lists all available infrastructure slots for the account, showing allocation status and capacity.\n\n### Create Operations\n\n- `cf network-interconnects cnis create` — Creates a new Cloud Network Interconnect (CNI) for private network connectivity between Cloudflare and your infrastructure. CNIs enable dedicated, high-performance network links. (supports --dry-run, --body)\n- `cf network-interconnects interconnects create` — Creates a new network interconnect for connecting Cloudflare's network to external networks. Interconnects provide dedicated bandwidth and reduced latency for traffic exchange. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network-interconnects cnis update <cni>` — Updates the configuration of an existing Cloud Network Interconnect (CNI), including connection parameters and routing settings. (supports --dry-run, --body)\n- `cf network-interconnects settings update` — Updates configuration settings for the specified resource or service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network-interconnects cnis delete <cni>` — Permanently removes a Cloud Network Interconnect (CNI) configuration. The private network connection will be terminated. (supports --dry-run)\n- `cf network-interconnects interconnects delete <icon>` — Permanently removes a network interconnect configuration. The physical or virtual connection will be terminated. (supports --dry-run)\n\n### Other Operations\n\n- `cf network-interconnects interconnects loa <icon>` — Downloads the Letter of Authorization (LOA) for a network interconnect, required for physical cross-connect provisioning. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"organizations": "# organizations — Multi-user organizations that group accounts, members, and shared settings under a single entity\n\n## Commands\n\n### Read Operations\n\n- `cf organizations account-organizations list` — Retrieve a list of the organizations that \"contain\" this account or are managing it. The returned list will be in order from \"root\" to \"leaf\", where the \"leaf\" will be the organization that _immediately_ contains the specified account.\n- `cf organizations get <organizationId>` — Retrieve the details of a certain organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations list` — Retrieve a list of organizations a particular user has access to. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations logs audit get <organizationId>` — Gets a list of audit logs for an organization.\n- `cf organizations members get <memberId>` — Retrieve a single membership from an Organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations members list` — List memberships for an Organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations organization-accounts get <organizationId>` — Retrieve a list of accounts that belong to a specific organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations organization-profile get <organizationId>` — Get an organizations profile if it exists. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations shares list` — Lists all organization shares.\n\n### Create Operations\n\n- `cf organizations create` — Create a new organization for a user. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations members create <organizationId>` — Create a membership that grants access to a specific Organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations members-batch-create create <organizationId>` — Batch create multiple memberships that grant access to a specific Organization. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf organizations organization-profile update <organizationId>` — Modify organization profile. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations update <organizationId>` — Modify organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf organizations delete <organizationId>` — Delete an organization. The organization MUST be empty before deleting. It must not contain any sub-organizations, accounts, members or users. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run)\n- `cf organizations members delete <memberId>` — Delete a membership to a particular Organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"origin-ca-certificates": "# origin-ca-certificates — Free Cloudflare-signed certificates installed on your origin server for Full (strict) SSL mode\n\n## Commands\n\n### Read Operations\n\n- `cf origin-ca-certificates get <certificateId>` — Get an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n- `cf origin-ca-certificates list` — List all existing Origin CA certificates for a given zone. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n\n### Create Operations\n\n- `cf origin-ca-certificates create` — Create an Origin CA certificate. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf origin-ca-certificates delete <certificateId>` — Revoke an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"mtls-certificates": "# mtls-certificates — Upload and manage mTLS certificates used by API Shield, Workers, and Gateway for client authentication\n\n## Commands\n\n### Read Operations\n\n- `cf mtls-certificates associations get <mtls-certificate-id>` — Lists all active associations between the certificate and Cloudflare services.\n- `cf mtls-certificates get <mtls-certificate-id>` — Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/).\n- `cf mtls-certificates list` — Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/).\n\n### Create Operations\n\n- `cf mtls-certificates create` — Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mtls-certificates delete <mtls-certificate-id>` — Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"network-interconnects": "# network-interconnects — Physical and virtual private interconnects between your infrastructure and Cloudflare's network\n\n## Commands\n\n### Read Operations\n\n- `cf network-interconnects cnis get <cni>` — Get information about a CNI object\n- `cf network-interconnects cnis list` — List existing CNI objects\n- `cf network-interconnects interconnects get <icon>` — Get information about an interconnect object\n- `cf network-interconnects interconnects list` — List existing interconnects\n- `cf network-interconnects interconnects status <icon>` — Get the current status of an interconnect object\n- `cf network-interconnects settings get` — Get the current settings for the active account\n- `cf network-interconnects slots get <slot>` — Get information about the specified slot\n- `cf network-interconnects slots list` — Retrieve a list of all slots matching the specified parameters\n\n### Create Operations\n\n- `cf network-interconnects cnis create` — Create a new CNI object (supports --dry-run, --body)\n- `cf network-interconnects interconnects create` — Create a new interconnect (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network-interconnects cnis update <cni>` — Modify stored information about a CNI object (supports --dry-run, --body)\n- `cf network-interconnects settings update` — Update the current settings for the active account (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network-interconnects cnis delete <cni>` — Delete a specified CNI object (supports --dry-run)\n- `cf network-interconnects interconnects delete <icon>` — Delete an interconnect object (supports --dry-run)\n\n### Other Operations\n\n- `cf network-interconnects interconnects loa <icon>` — Generate the Letter of Authorization (LOA) for a given interconnect (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"observability": "# observability — observability\n\n## Commands\n\n### Read Operations\n\n- `cf observability destinations list` — List your Workers Observability Telemetry Destinations.\n- `cf observability queries get <queryId>` — Retrieve a saved query.\n- `cf observability queries list` — List saved queries.\n\n### Create Operations\n\n- `cf observability destinations create` — Create a new Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries create` — Persist query for later use. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf observability destinations update <slug>` — Update an existing Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries edit <queryId>` — Update saved query. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf observability destinations delete <slug>` — Delete a Workers Observability Telemetry Destination. (supports --dry-run)\n- `cf observability queries delete <queryId>` — Delete a saved query. (supports --dry-run)\n\n### Other Operations\n\n- `cf observability telemetry keys` — List all the keys in your telemetry events. (supports --dry-run, --body)\n- `cf observability telemetry query` — Run a temporary or saved query. (supports --dry-run, --body)\n- `cf observability telemetry values` — List unique values found in your events. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"organizations": "# organizations — Multi-user organizations that group accounts, members, and shared settings under a single entity\n\n## Commands\n\n### Read Operations\n\n- `cf organizations account-organizations list` — Retrieve a list of the organizations that \"contain\" this account or are managing it. The returned list will be in order from \"root\" to \"leaf\", where the \"leaf\" will be the organization that _immediately_ contains the specified account.\n- `cf organizations get <organization-id>` — Retrieve the details of a certain organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations list` — Retrieve a list of organizations a particular user has access to. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations logs audit get <organization-id>` — Gets a list of audit logs for an organization.\n- `cf organizations members get <member-id>` — Retrieve a single membership from an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations members list` — List memberships for an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations organization-accounts get <organization-id>` — Retrieve a list of accounts that belong to a specific organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations organization-profile get <organization-id>` — Get an organizations profile if it exists. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organizations shares list` — Lists all organization shares.\n\n### Create Operations\n\n- `cf organizations create` — Create a new organization for a user. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations members create <organization-id>` — Create a membership that grants access to a specific Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations members-batch-create create <organization-id>` — Batch create multiple memberships that grant access to a specific Organization. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf organizations organization-profile update <organization-id>` — Modify organization profile. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organizations update <organization-id>` — Modify organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf organizations delete <organization-id>` — Delete an organization. The organization MUST be empty before deleting. It must not contain any sub-organizations, accounts, members or users. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) **Access Control:** Restricted to enterprise organizations. (supports --dry-run)\n- `cf organizations members delete <member-id>` — Delete a membership to a particular Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"origin-ca-certificates": "# origin-ca-certificates — Free Cloudflare-signed certificates installed on your origin server for Full (strict) SSL mode\n\n## Commands\n\n### Read Operations\n\n- `cf origin-ca-certificates get <certificate-id>` — Get an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n- `cf origin-ca-certificates list` — List all existing Origin CA certificates for a given zone. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n\n### Create Operations\n\n- `cf origin-ca-certificates create` — Create an Origin CA certificate. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf origin-ca-certificates delete <certificate-id>` — Revoke an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"origin-post-quantum-encryption": "# origin-post-quantum-encryption — Enable post-quantum key exchange for connections between Cloudflare and your origin server\n\n## Commands\n\n### Read Operations\n\n- `cf origin-post-quantum-encryption get` — Instructs Cloudflare to use Post-Quantum (PQ) key agreement algorithms when connecting to your origin. Preferred instructs Cloudflare to opportunistically send a Post-Quantum keyshare in the first message to the origin (for fastest connections when the origin supports and prefers PQ), supported means that PQ algorithms are advertised but only used when requested by the origin, and off means that PQ algorithms are not advertised.\n\n### Update Operations\n\n- `cf origin-post-quantum-encryption update` — Instructs Cloudflare to use Post-Quantum (PQ) key agreement algorithms when connecting to your origin. Preferred instructs Cloudflare to opportunistically send a Post-Quantum keyshare in the first message to the origin (for fastest connections when the origin supports and prefers PQ), supported means that PQ algorithms are advertised but only used when requested by the origin, and off means that PQ algorithms are not advertised. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"origin-tls-client-auth": "# origin-tls-client-auth — Authenticated Origin Pulls — require Cloudflare to present a client certificate when connecting to your origin\n\n## Commands\n\n### Read Operations\n\n- `cf origin-tls-client-auth get <certificateId>` — Retrieves details for a specific client certificate used in zone-level authenticated origin pulls.\n- `cf origin-tls-client-auth hostname-associations list` — List certificate ID - hostname associations for the given zone. Shows which hostnames are associated to which certificates for authenticated origin pulls.\n- `cf origin-tls-client-auth hostname-certificates get <certificateId>` — Get the certificate by ID to be used for client authentication on a hostname.\n- `cf origin-tls-client-auth hostname-certificates list` — Lists all client certificates configured for per-hostname authenticated origin pulls on the zone.\n- `cf origin-tls-client-auth hostnames get <hostname>` — Retrieves the client certificate authentication status for a specific hostname, showing whether authenticated origin pulls are enabled.\n- `cf origin-tls-client-auth list` — Lists all client certificates configured for zone-level authenticated origin pulls.\n- `cf origin-tls-client-auth settings get` — Get whether zone-level authenticated origin pulls is enabled or not. It is false by default.\n- `cf origin-tls-client-auth zone-certificates get <certificateId>` — Retrieves details for a specific client certificate used in zone-level authenticated origin pulls.\n- `cf origin-tls-client-auth zone-certificates list` — Lists all client certificates configured for zone-level authenticated origin pulls.\n\n### Create Operations\n\n- `cf origin-tls-client-auth create` — Upload your own certificate you want Cloudflare to use for edge-to-origin communication to override the shared certificate. Please note that it is important to keep only one certificate active. Also, make sure to enable zone-level authenticated origin pulls by making a PUT call to settings endpoint to see the uploaded certificate in use. (supports --dry-run, --body)\n- `cf origin-tls-client-auth hostname-certificates create` — Upload a certificate to be used for client authentication on a hostname. 10 hostname certificates per zone are allowed. (supports --dry-run, --body)\n- `cf origin-tls-client-auth zone-certificates create` — Upload your own certificate you want Cloudflare to use for edge-to-origin communication to override the shared certificate. Please note that it is important to keep only one certificate active. Also, make sure to enable zone-level authenticated origin pulls by making a PUT call to settings endpoint to see the uploaded certificate in use. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf origin-tls-client-auth hostnames update` — Associate a hostname to a certificate and enable, disable or invalidate the association. If disabled, client certificate will not be sent to the hostname even if activated at the zone level. 100 maximum associations on a single certificate are allowed. Note: Use a null value for parameter *enabled* to invalidate the association. (supports --dry-run, --body)\n- `cf origin-tls-client-auth settings update` — Enable or disable zone-level authenticated origin pulls. 'enabled' should be set true either before/after the certificate is uploaded to see the certificate in use. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf origin-tls-client-auth delete <certificateId>` — Removes a client certificate used for zone-level authenticated origin pulls. (supports --dry-run, --body)\n- `cf origin-tls-client-auth hostname-certificates delete <certificateId>` — Removes a client certificate used for authenticated origin pulls on a specific hostname. Note: Before deleting the certificate, you must first invalidate the hostname for client authentication by sending a PUT request with `enabled` set to null. After invalidating the association, the certificate can be safely deleted. (supports --dry-run, --body)\n- `cf origin-tls-client-auth zone-certificates delete <certificateId>` — Removes a client certificate used for zone-level authenticated origin pulls. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"page-rules": "# page-rules — Legacy URL-pattern rules that override zone settings for matching requests — prefer Rules/Transform Rules instead\n\n## Commands\n\n### Read Operations\n\n- `cf page-rules get <pageruleId>` — Fetches the details of a Page Rule.\n- `cf page-rules list` — Fetches Page Rules in a zone.\n\n### Create Operations\n\n- `cf page-rules create` — Creates a new Page Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf page-rules edit <pageruleId>` — Updates one or more fields of an existing Page Rule. (supports --dry-run, --body)\n- `cf page-rules update <pageruleId>` — Replaces the configuration of an existing Page Rule. The configuration of the updated Page Rule will exactly match the data passed in the API request. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf page-rules delete <pageruleId>` — Deletes an existing Page Rule. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"page-shield": "# page-shield — Client-side security — monitor JavaScript, connections, and cookies on your pages for supply-chain attacks\n\n## Commands\n\n### Read Operations\n\n- `cf page-shield connections get <connectionId>` — Fetches a connection detected by Page Shield by connection ID.\n- `cf page-shield connections list` — Lists all connections detected by Page Shield.\n- `cf page-shield cookies get <cookieId>` — Fetches a cookie collected by Page Shield by cookie ID.\n- `cf page-shield cookies list` — Lists all cookies collected by Page Shield.\n- `cf page-shield get` — Fetches the Page Shield settings.\n- `cf page-shield policies get <policyId>` — Fetches a Page Shield policy by ID.\n- `cf page-shield policies list` — Lists all Page Shield policies.\n- `cf page-shield scripts get <scriptId>` — Fetches a script detected by Page Shield by script ID.\n- `cf page-shield scripts list` — Lists all scripts detected by Page Shield.\n\n### Create Operations\n\n- `cf page-shield policies create` — Create a Page Shield policy. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf page-shield policies update <policyId>` — Update a Page Shield policy by ID. (supports --dry-run, --body)\n- `cf page-shield update` — Updates Page Shield settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf page-shield policies delete <policyId>` — Delete a Page Shield policy by ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"pages": "# pages — Full-stack application hosting with Git-integrated builds, preview deployments, and custom domains\n\n## Commands\n\n### Read Operations\n\n- `cf pages projects deployments get <deploymentId>` — Fetch information about a deployment.\n- `cf pages projects deployments history logs get <deploymentId>` — Fetch deployment logs for a project.\n- `cf pages projects deployments list` — Fetch a list of project deployments.\n- `cf pages projects domains get <domainName>` — Fetch a single domain.\n- `cf pages projects domains list` — Fetch a list of all domains associated with a Pages project.\n- `cf pages projects get <projectName>` — Fetch a project by name.\n- `cf pages projects list` — Fetch a list of all user projects.\n\n### Create Operations\n\n- `cf pages projects create` — Create a new project. (supports --dry-run, --body)\n- `cf pages projects deployments create <projectName>` — Start a new deployment from production. The repository and account must have already been authorized on the Cloudflare Pages dashboard. (supports --dry-run, --body)\n- `cf pages projects domains create <projectName>` — Add a new domain for the Pages project. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf pages projects domains edit <domainName>` — Retry the validation status of a single domain. (supports --dry-run)\n- `cf pages projects edit <projectName>` — Set new attributes for an existing project. Modify environment variables. To delete an environment variable, set the key to null. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf pages projects delete <projectName>` — Delete a project by name. (supports --dry-run)\n- `cf pages projects deployments delete <deploymentId>` — Delete a deployment. (supports --dry-run)\n- `cf pages projects domains delete <domainName>` — Delete a Pages project's domain. (supports --dry-run)\n\n### Other Operations\n\n- `cf pages projects deployments retry <deploymentId>` — Retry a previous deployment. (supports --dry-run)\n- `cf pages projects deployments rollback <deploymentId>` — Rollback the production deployment to a previous deployment. You can only rollback to succesful builds on production. (supports --dry-run)\n- `cf pages projects purge-build-cache <projectName>` — Purge all cached build artifacts for a Pages project (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"pipelines": "# pipelines — Ingest, transform, and route event streams into R2, analytics, or other destinations in real time\n\n## Commands\n\n### Read Operations\n\n- `cf pipelines get <pipelineName>` — [DEPRECATED] Get configuration of a pipeline. Use the new /pipelines/v1/pipelines endpoint instead.\n- `cf pipelines list` — [DEPRECATED] List, filter, and paginate pipelines in an account. Use the new /pipelines/v1/pipelines endpoint instead.\n- `cf pipelines sinks get <sinkId>` — Get Sink Details.\n- `cf pipelines sinks list` — List/Filter Sinks in Account.\n- `cf pipelines streams get <streamId>` — Get Stream Details.\n- `cf pipelines streams list` — List/Filter Streams in Account.\n\n### Create Operations\n\n- `cf pipelines create` — [DEPRECATED] Create a new pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run, --body)\n- `cf pipelines sinks create` — Create a new Sink. (supports --dry-run, --body)\n- `cf pipelines streams create` — Create a new Stream. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf pipelines streams update <streamId>` — Update a Stream. (supports --dry-run, --body)\n- `cf pipelines update <pipelineName>` — [DEPRECATED] Update an existing pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf pipelines delete <pipelineName>` — [DEPRECATED] Delete a pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run)\n- `cf pipelines sinks delete <sinkId>` — Delete Pipeline in Account. (supports --dry-run)\n- `cf pipelines streams delete <streamId>` — Delete Stream in Account. (supports --dry-run)\n\n### Other Operations\n\n- `cf pipelines create-v1` — Create a new Pipeline. (supports --dry-run, --body)\n- `cf pipelines delete-v1 <pipelineId>` — Delete Pipeline in Account. (supports --dry-run)\n- `cf pipelines get-v1 <pipelineId>` — Get Pipelines Details. (supports --dry-run)\n- `cf pipelines list-v1` — List/Filter Pipelines in Account. (supports --dry-run)\n- `cf pipelines validate-sql` — Validate Arroyo SQL. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"queues": "# queues — Reliable message queuing between Workers — produce, consume, and batch-process messages at scale\n\n## Commands\n\n### Read Operations\n\n- `cf queues consumers get <consumerId>` — Fetches the consumer for a queue by consumer id\n- `cf queues consumers list` — Returns the consumers for a Queue\n- `cf queues get <queueId>` — Get details about a specific queue.\n- `cf queues list` — Returns the queues owned by an account.\n- `cf queues purge status <queueId>` — Get details about a Queue's purge status.\n- `cf queues subscriptions get <subscriptionId>` — Get details about an existing event subscription\n- `cf queues subscriptions list` — Get a paginated list of event subscriptions with optional sorting and filtering\n\n### Create Operations\n\n- `cf queues consumers create <queueId>` — Creates a new consumer for a Queue (supports --dry-run, --body)\n- `cf queues create` — Create a new queue (supports --dry-run, --body)\n- `cf queues subscriptions create` — Create a new event subscription for a queue (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf queues consumers update <consumerId>` — Updates the consumer for a queue, or creates one if it does not exist. (supports --dry-run, --body)\n- `cf queues edit <queueId>` — Updates a Queue. (supports --dry-run, --body)\n- `cf queues subscriptions update <subscriptionId>` — Update an existing event subscription (supports --dry-run, --body)\n- `cf queues update <queueId>` — Updates a Queue. Note that this endpoint does not support partial updates. If successful, the Queue's configuration is overwritten with the supplied configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf queues consumers delete <consumerId>` — Deletes the consumer for a queue. (supports --dry-run)\n- `cf queues delete <queueId>` — Deletes a queue (supports --dry-run)\n- `cf queues subscriptions delete <subscriptionId>` — Delete an existing event subscription (supports --dry-run)\n\n### Other Operations\n\n- `cf queues messages ack <queueId>` — Acknowledge + Retry messages from a Queue (supports --dry-run, --body)\n- `cf queues messages ack-preview <queueId>` — Delete previewed messages from a Queue. Note that messages acknowledged this way aren't considered delivered, they are instantly deleted from this queue and do not affect metrics. (supports --dry-run, --body)\n- `cf queues messages bulk-push` — Push a batch of message to a Queue (supports --dry-run, --body)\n- `cf queues messages preview <queueId>` — Preview messages from a Queue without leasing them. Messages remain available for subsequent preview or pull operations. (supports --dry-run, --body)\n- `cf queues messages pull <queueId>` — Pull a batch of messages from a Queue (supports --dry-run, --body)\n- `cf queues messages push <queueId>` — Push a message to a Queue (supports --dry-run, --body)\n- `cf queues purge start <queueId>` — Deletes all messages from the Queue. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"r2": "# r2 — S3-compatible object storage with zero egress fees — buckets, lifecycle rules, event notifications, and data migration\n\n## Commands\n\n### Read Operations\n\n- `cf r2 buckets cors get <bucketName>` — Get the CORS policy for a bucket.\n- `cf r2 buckets domains custom get <domain>` — Get the configuration for a custom domain on an existing R2 bucket.\n- `cf r2 buckets domains custom list` — Gets a list of all custom domains registered with an existing R2 bucket.\n- `cf r2 buckets domains managed list` — Gets state of public access over the bucket's R2-managed (r2.dev) domain.\n- `cf r2 buckets event-notifications get <queueId>` — Get a single event notification rule.\n- `cf r2 buckets event-notifications list` — List all event notification rules for a bucket.\n- `cf r2 buckets get <bucketName>` — Gets properties of an existing R2 bucket.\n- `cf r2 buckets lifecycle get <bucketName>` — Get object lifecycle rules for a bucket.\n- `cf r2 buckets list` — Lists all R2 buckets on your account.\n- `cf r2 buckets local-uploads get <bucketName>` — Get the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region.\n- `cf r2 buckets locks get <bucketName>` — Get lock rules for a bucket.\n- `cf r2 buckets metrics list` — Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.\n- `cf r2 buckets sippy get <bucketName>` — Gets configuration for Sippy for an existing R2 bucket.\n- `cf r2 super-slurper jobs get <jobId>` — Retrieves detailed status and configuration for a specific R2 Super Slurper migration job.\n- `cf r2 super-slurper jobs list` — Lists all R2 Super Slurper migration jobs for the account with their status.\n- `cf r2 super-slurper jobs logs list` — Gets log entries for an R2 Super Slurper migration job, showing migration status changes, errors, etc.\n\n### Create Operations\n\n- `cf r2 buckets create` — Creates a new R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom create <bucketName>` — Register a new custom domain for an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 super-slurper jobs create` — Creates a new R2 Super Slurper migration job to transfer objects from a source bucket (e.g. S3, GCS, R2) to R2. (supports --dry-run, --body)\n- `cf r2 temporary-credentials create` — Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2 buckets cors update <bucketName>` — Set the CORS policy for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom update <domain>` — Edit the configuration for a custom domain on an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains managed update <bucketName>` — Updates state of public access over the bucket's R2-managed (r2.dev) domain. (supports --dry-run, --body)\n- `cf r2 buckets edit <bucketName>` — Updates properties of an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications update <queueId>` — Create event notification rule. (supports --dry-run, --body)\n- `cf r2 buckets lifecycle update <bucketName>` — Set the object lifecycle rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets local-uploads update <bucketName>` — Set the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region. (supports --dry-run, --body)\n- `cf r2 buckets locks update <bucketName>` — Set lock rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets sippy update <bucketName>` — Sets configuration for Sippy for an existing R2 bucket. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf r2 buckets cors delete <bucketName>` — Delete the CORS policy for a bucket. (supports --dry-run)\n- `cf r2 buckets delete <bucketName>` — Deletes an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets domains custom delete <domain>` — Remove custom domain registration from an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications delete <queueId>` — Delete an event notification rule. **If no body is provided, all rules for specified queue will be deleted**. (supports --dry-run, --body)\n- `cf r2 buckets sippy delete <bucketName>` — Disables Sippy on this bucket. (supports --dry-run)\n\n### Other Operations\n\n- `cf r2 super-slurper connectivity-precheck source` — Check whether tokens are valid against the source bucket (supports --dry-run, --body)\n- `cf r2 super-slurper connectivity-precheck target` — Check whether tokens are valid against the target bucket (supports --dry-run, --body)\n- `cf r2 super-slurper jobs abort <jobId>` — Cancels a specific R2 Super Slurper migration job. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs abort-all` — Cancels all running R2 Super Slurper migration jobs for the account. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs pause <jobId>` — Pauses a running R2 Super Slurper migration job. The job can be resumed later to continue transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs progress <jobId>` — Retrieves current progress metrics for an R2 Super Slurper migration job (supports --dry-run)\n- `cf r2 super-slurper jobs resume <jobId>` — Resumes a paused R2 Super Slurper migration job, continuing the transfer from where it stopped. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"r2-data-catalog": "# r2-data-catalog — Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines\n\n## Commands\n\n### Read Operations\n\n- `cf r2-data-catalog get <bucketName>` — Retrieve detailed information about a specific R2 catalog by bucket name. Returns catalog status, maintenance configuration, and credential status.\n- `cf r2-data-catalog list` — Returns a list of R2 buckets that have been enabled as Apache Iceberg catalogs for the specified account. Each catalog represents an R2 bucket configured to store Iceberg metadata and data files.\n- `cf r2-data-catalog maintenance-configs get <bucketName>` — Retrieve the maintenance configuration for a specific catalog, including compaction settings and credential status.\n- `cf r2-data-catalog namespaces list` — Returns a list of namespaces in the specified R2 catalog. Supports hierarchical filtering and pagination for efficient traversal of large namespace hierarchies.\n- `cf r2-data-catalog namespaces tables list` — Returns a list of tables in the specified namespace within an R2 catalog. Supports pagination for efficient traversal of large table collections.\n- `cf r2-data-catalog namespaces tables maintenance-configs get <tableName>` — Retrieve the maintenance configuration for a specific table, including compaction settings.\n\n### Create Operations\n\n- `cf r2-data-catalog credentials create <bucketName>` — Store authentication credentials for a catalog. These credentials are used to authenticate with R2 storage when performing catalog operations. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2-data-catalog maintenance-configs update <bucketName>` — Update the maintenance configuration for a catalog. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n- `cf r2-data-catalog namespaces tables maintenance-configs update <tableName>` — Update the maintenance configuration for a specific table. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf r2-data-catalog disable <bucketName>` — Disable an R2 bucket as a catalog. This operation deactivates the catalog but preserves existing metadata and data files. The catalog can be re-enabled later. (supports --dry-run)\n- `cf r2-data-catalog enable <bucketName>` — Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"radar": "# radar — Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights\n\n## Commands\n\n### Read Operations\n\n- `cf radar annotations list` — Retrieves the latest annotations.\n- `cf radar annotations outages get` — Retrieves the latest Internet outages and anomalies.\n- `cf radar bgp hijacks events list` — Retrieves the BGP hijack events.\n- `cf radar bgp leaks events list` — Retrieves the BGP route leak events.\n- `cf radar bgp top ases get` — Retrieves the top autonomous systems by BGP updates (announcements only).\n- `cf radar bots get <botSlug>` — Retrieves the requested bot information.\n- `cf radar bots list` — Retrieves a list of bots.\n- `cf radar ct authorities get <caSlug>` — Retrieves the requested CA information.\n- `cf radar ct authorities list` — Retrieves a list of certificate authorities.\n- `cf radar ct logs get <logSlug>` — Retrieves the requested certificate log information.\n- `cf radar ct logs list` — Retrieves a list of certificate logs.\n- `cf radar datasets get <alias>` — Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.\n- `cf radar datasets list` — Retrieves a list of datasets.\n- `cf radar email security top tlds get` — Retrieves the top TLDs by number of email messages.\n- `cf radar email security top tlds malicious get <malicious>` — Retrieves the top TLDs by emails classified as malicious or not.\n- `cf radar email security top tlds spam get <spam>` — Retrieves the top TLDs by emails classified as spam or not.\n- `cf radar email security top tlds spoof get <spoof>` — Retrieves the top TLDs by emails classified as spoof or not.\n- `cf radar entities asns get <asn>` — Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).\n- `cf radar entities asns list` — Retrieves a list of autonomous systems.\n- `cf radar entities get` — Retrieves IP address information.\n- `cf radar entities locations get <location>` — Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).\n- `cf radar entities locations list` — Retrieves a list of locations.\n- `cf radar geolocations get <geoId>` — Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar geolocations list` — Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar http ases bot-class get <botClass>` — Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.\n- `cf radar http ases browser-family get <browserFamily>` — Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.\n- `cf radar http ases device-type get <deviceType>` — Retrieves the top autonomous systems, by HTTP requests, of the requested device type.\n- `cf radar http ases get` — Retrieves the top autonomous systems by HTTP requests.\n- `cf radar http ases http-method get <httpVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.\n- `cf radar http ases http-protocol get <httpProtocol>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http ases ip-version get <ipVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.\n- `cf radar http ases os get <os>` — Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.\n- `cf radar http ases tls-version get <tlsVersion>` — Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.\n- `cf radar http locations bot-class get <botClass>` — Retrieves the top locations, by HTTP requests, of the requested bot class.\n- `cf radar http locations browser-family get <browserFamily>` — Retrieves the top locations, by HTTP requests, of the requested browser family.\n- `cf radar http locations device-type get <deviceType>` — Retrieves the top locations, by HTTP requests, of the requested device type.\n- `cf radar http locations get` — Retrieves the top locations by HTTP requests.\n- `cf radar http locations http-method get <httpVersion>` — Retrieves the top locations, by HTTP requests, of the requested HTTP version.\n- `cf radar http locations http-protocol get <httpProtocol>` — Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http locations ip-version get <ipVersion>` — Retrieves the top locations, by HTTP requests, of the requested IP version.\n- `cf radar http locations os get <os>` — Retrieves the top locations, by HTTP requests, of the requested operating system.\n- `cf radar http locations tls-version get <tlsVersion>` — Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.\n- `cf radar origins get <slug>` — Retrieves the requested origin information with its regions.\n- `cf radar origins list` — Retrieves a list of origins with their regions.\n- `cf radar ranking domain get <domain>` — Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.\n- `cf radar tlds get <tld>` — Retrieves the requested TLD information.\n- `cf radar tlds list` — Retrieves a list of TLDs.\n- `cf radar traffic-anomalies get` — Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.\n- `cf radar traffic-anomalies locations get` — Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.\n\n### Create Operations\n\n- `cf radar ai to-markdown create` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf radar agent-readiness summary <dimension>` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts. (supports --dry-run)\n- `cf radar ai bots summary user-agent` — Retrieves the distribution of traffic by AI user agent. (supports --dry-run)\n- `cf radar ai bots summary-v2 <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai bots timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai inference summary model` — Retrieves the distribution of unique accounts by model. (supports --dry-run)\n- `cf radar ai inference summary task` — Retrieves the distribution of unique accounts by task. (supports --dry-run)\n- `cf radar ai inference summary-v2 <dimension>` — Retrieves an aggregated summary of unique accounts using Workers AI inference grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary model` — Retrieves the distribution of unique accounts by model over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary task` — Retrieves the distribution of unique accounts by task over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups-v2 <dimension>` — Retrieves the distribution of unique accounts using Workers AI inference, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai markdown-for-agents summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. (supports --dry-run)\n- `cf radar ai markdown-for-agents timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. (supports --dry-run)\n- `cf radar ai timeseries-groups summary <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai timeseries-groups user-agent` — Retrieves the distribution of traffic by AI user agent over time. (supports --dry-run)\n- `cf radar annotations outages locations` — Retrieves the number of outages by location. (supports --dry-run)\n- `cf radar as112 summary dnssec` — Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 summary edns` — Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 summary ip-version` — Retrieves the distribution of DNS queries to AS112 by IP version. (supports --dry-run)\n- `cf radar as112 summary protocol` — Retrieves the distribution of DNS queries to AS112 by protocol. (supports --dry-run)\n- `cf radar as112 summary query-type` — Retrieves the distribution of DNS queries to AS112 by type. (supports --dry-run)\n- `cf radar as112 summary response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code. (supports --dry-run)\n- `cf radar as112 summary-v2 <dimension>` — Retrieves the distribution of AS112 queries by the specified dimension. (supports --dry-run)\n- `cf radar as112 timeseries` — Retrieves the AS112 DNS queries over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups dnssec` — Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups edns` — Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups ip-version` — Retrieves the distribution of AS112 DNS queries by IP version over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups protocol` — Retrieves the distribution of AS112 DNS requests classified by protocol over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups query-type` — Retrieves the distribution of AS112 DNS queries by type over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups-v2 <dimension>` — Retrieves the distribution of AS112 queries grouped by dimension over time. (supports --dry-run)\n- `cf radar as112 top dnssec <dnssec>` — Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 top edns <edns>` — Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 top ip-version <ipVersion>` — Retrieves the top locations of DNS queries to AS112 for an IP version. (supports --dry-run)\n- `cf radar as112 top locations` — Retrieves the top locations by AS112 DNS queries. (supports --dry-run)\n- `cf radar attacks layer3 summary bitrate` — Retrieves the distribution of layer 3 attacks by bitrate. (supports --dry-run)\n- `cf radar attacks layer3 summary duration` — Retrieves the distribution of layer 3 attacks by duration. (supports --dry-run)\n- `cf radar attacks layer3 summary industry` — Retrieves the distribution of layer 3 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer3 summary ip-version` — Retrieves the distribution of layer 3 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer3 summary protocol` — Retrieves the distribution of layer 3 attacks by protocol. (supports --dry-run)\n- `cf radar attacks layer3 summary vector` — Retrieves the distribution of layer 3 attacks by vector. (supports --dry-run)\n- `cf radar attacks layer3 summary vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer3 summary-v2 <dimension>` — Retrieves the distribution of layer 3 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer3 timeseries` — Retrieves layer 3 attacks over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups bitrate` — Retrieves the distribution of layer 3 attacks by bitrate over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups duration` — Retrieves the distribution of layer 3 attacks by duration over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups industry` — Retrieves the distribution of layer 3 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups ip-version` — Retrieves the distribution of layer 3 attacks by IP version over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups protocol` — Retrieves the distribution of layer 3 attacks by protocol over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vector` — Retrieves the distribution of layer 3 attacks by vector over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer3 top attacks` — Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer3 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer3 top locations origin` — Retrieves the origin locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top locations target` — Retrieves the target locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar attacks layer7 summary http-method` — Retrieves the distribution of layer 7 attacks by HTTP method. (supports --dry-run)\n- `cf radar attacks layer7 summary http-version` — Retrieves the distribution of layer 7 attacks by HTTP version. (supports --dry-run)\n- `cf radar attacks layer7 summary industry` — Retrieves the distribution of layer 7 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer7 summary ip-version` — Retrieves the distribution of layer 7 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer7 summary managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules. (supports --dry-run)\n- `cf radar attacks layer7 summary mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product. (supports --dry-run)\n- `cf radar attacks layer7 summary vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer7 summary-v2 <dimension>` — Retrieves the distribution of layer 7 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer7 timeseries` — Retrieves layer 7 attacks over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-method` — Retrieves the distribution of layer 7 attacks by HTTP method over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-version` — Retrieves the distribution of layer 7 attacks by HTTP version over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups industry` — Retrieves the distribution of layer 7 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups ip-version` — Retrieves the distribution of layer 7 attacks by IP version used over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer7 top ases origin` — Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top attacks` — Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer7 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer7 top locations origin` — Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top locations target` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. (supports --dry-run)\n- `cf radar attacks layer7 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar bgp ips timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. (supports --dry-run)\n- `cf radar bgp routes ases` — Retrieves all ASes in the current global routing tables with routing statistics. (supports --dry-run)\n- `cf radar bgp routes moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. (supports --dry-run)\n- `cf radar bgp routes pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. (supports --dry-run)\n- `cf radar bgp routes realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). (supports --dry-run)\n- `cf radar bgp routes stats` — Retrieves the BGP routing table stats. (supports --dry-run)\n- `cf radar bgp rpki aspa changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. (supports --dry-run)\n- `cf radar bgp rpki aspa snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. (supports --dry-run)\n- `cf radar bgp rpki aspa timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. (supports --dry-run)\n- `cf radar bgp timeseries` — Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. (supports --dry-run)\n- `cf radar bgp top ases prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. (supports --dry-run)\n- `cf radar bgp top prefixes` — Retrieves the top network prefixes by BGP updates. (supports --dry-run)\n- `cf radar bots summary <dimension>` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots timeseries` — Retrieves bots HTTP request volume over time. (supports --dry-run)\n- `cf radar bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar bots web-crawlers summary <dimension>` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots web-crawlers timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ct summary <dimension>` — Retrieves an aggregated summary of certificates grouped by the specified dimension. (supports --dry-run)\n- `cf radar ct timeseries` — Retrieves certificate volume over time. (supports --dry-run)\n- `cf radar ct timeseries-groups <dimension>` — Retrieves the distribution of certificates grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar datasets download` — Retrieves an URL to download a single dataset. (supports --dry-run, --body)\n- `cf radar dns summary cache-hit` — Retrieves the distribution of DNS queries by cache status. (supports --dry-run)\n- `cf radar dns summary dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar dns summary dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness. (supports --dry-run)\n- `cf radar dns summary dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status. (supports --dry-run)\n- `cf radar dns summary ip-version` — Retrieves the distribution of DNS queries by IP version. (supports --dry-run)\n- `cf radar dns summary matching-answer` — Retrieves the distribution of DNS queries by matching answers. (supports --dry-run)\n- `cf radar dns summary protocol` — Retrieves the distribution of DNS queries by DNS transport protocol. (supports --dry-run)\n- `cf radar dns summary query-type` — Retrieves the distribution of DNS queries by type. (supports --dry-run)\n- `cf radar dns summary response-code` — Retrieves the distribution of DNS queries by response code. (supports --dry-run)\n- `cf radar dns summary response-ttl` — Retrieves the distribution of DNS queries by minimum response TTL. (supports --dry-run)\n- `cf radar dns summary-v2 <dimension>` — Retrieves the distribution of DNS queries by the specified dimension. (supports --dry-run)\n- `cf radar dns timeseries` — Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. (supports --dry-run)\n- `cf radar dns timeseries-groups cache-hit` — Retrieves the distribution of DNS queries by cache status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups ip-version` — Retrieves the distribution of DNS queries by IP version over time. (supports --dry-run)\n- `cf radar dns timeseries-groups matching-answer` — Retrieves the distribution of DNS queries by matching answers over time. (supports --dry-run)\n- `cf radar dns timeseries-groups protocol` — Retrieves the distribution of DNS queries by DNS transport protocol over time. (supports --dry-run)\n- `cf radar dns timeseries-groups query-type` — Retrieves the distribution of DNS queries by type over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-code` — Retrieves the distribution of DNS queries by response code over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-ttl` — Retrieves the distribution of DNS queries by minimum answer TTL over time. (supports --dry-run)\n- `cf radar dns timeseries-groups-v2 <dimension>` — Retrieves the distribution of DNS queries grouped by dimension over time. (supports --dry-run)\n- `cf radar dns top ases` — Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar dns top locations` — Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar email routing summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email routing summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email routing summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email routing summary encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted). (supports --dry-run)\n- `cf radar email routing summary ip-version` — Retrieves the distribution of emails by IP version. (supports --dry-run)\n- `cf radar email routing summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email routing summary-v2 <dimension>` — Retrieves the distribution of email routing metrics by the specified dimension. (supports --dry-run)\n- `cf radar email routing timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted) over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups ip-version` — Retrieves the distribution of emails by IP version over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups-v2 <dimension>` — Retrieves the distribution of email routing metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar email security summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email security summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email security summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email security summary malicious` — Retrieves the distribution of emails by malicious classification. (supports --dry-run)\n- `cf radar email security summary spam` — Retrieves the proportion of emails by spam classification (spam vs. non-spam). (supports --dry-run)\n- `cf radar email security summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email security summary spoof` — Retrieves the proportion of emails by spoof classification (spoof vs. non-spoof). (supports --dry-run)\n- `cf radar email security summary threat-category` — Retrieves the distribution of emails by threat categories. (supports --dry-run)\n- `cf radar email security summary tls-version` — Retrieves the distribution of emails by TLS version. (supports --dry-run)\n- `cf radar email security summary-v2 <dimension>` — Retrieves the distribution of email security metrics by the specified dimension. (supports --dry-run)\n- `cf radar email security timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups malicious` — Retrieves the distribution of emails by malicious classification over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spam` — Retrieves the distribution of emails by spam classification (spam vs. non-spam) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spoof` — Retrieves the distribution of emails by spoof classification (spoof vs. non-spoof) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups threat-category` — Retrieves the distribution of emails by threat category over time. (supports --dry-run)\n- `cf radar email security timeseries-groups tls-version` — Retrieves the distribution of emails by TLS version over time. (supports --dry-run)\n- `cf radar email security timeseries-groups-v2 <dimension>` — Retrieves the distribution of email security metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar entities asns as-set <asn>` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. (supports --dry-run)\n- `cf radar entities asns botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. (supports --dry-run)\n- `cf radar entities asns ip` — Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). (supports --dry-run)\n- `cf radar entities asns rel <asn>` — Retrieves AS-level relationship for given networks. (supports --dry-run)\n- `cf radar http summary bot-class` — Retrieves the distribution of bot-generated HTTP requests to genuine human traffic, as classified by Cloudflare. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http summary device-type` — Retrieves the distribution of HTTP requests generated by mobile, desktop, and other types of devices. (supports --dry-run)\n- `cf radar http summary http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS). (supports --dry-run)\n- `cf radar http summary http-version` — Retrieves the distribution of HTTP requests by HTTP version. (supports --dry-run)\n- `cf radar http summary ip-version` — Retrieves the distribution of HTTP requests by IP version. (supports --dry-run)\n- `cf radar http summary os` — Retrieves the distribution of HTTP requests by operating system (Windows, macOS, Android, iOS, and others). (supports --dry-run)\n- `cf radar http summary post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support. (supports --dry-run)\n- `cf radar http summary tls-version` — Retrieves the distribution of HTTP requests by TLS version. (supports --dry-run)\n- `cf radar http summary-v2 <dimension>` — Retrieves the distribution of HTTP requests by the specified dimension. (supports --dry-run)\n- `cf radar http timeseries` — Retrieves the HTTP requests over time. (supports --dry-run)\n- `cf radar http timeseries-groups bot-class` — Retrieves the distribution of HTTP requests classified as automated or human over time. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http timeseries-groups browser` — Retrieves the distribution of HTTP requests by user agent over time. (supports --dry-run)\n- `cf radar http timeseries-groups browser-family` — Retrieves the distribution of HTTP requests by user agent family over time. (supports --dry-run)\n- `cf radar http timeseries-groups device-type` — Retrieves the distribution of HTTP requests by device type over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS) over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-version` — Retrieves the distribution of HTTP requests by HTTP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups ip-version` — Retrieves the distribution of HTTP requests by IP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups os` — Retrieves the distribution of HTTP requests by operating system over time. (supports --dry-run)\n- `cf radar http timeseries-groups post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support over time. (supports --dry-run)\n- `cf radar http timeseries-groups tls-version` — Retrieves the distribution of HTTP requests by TLS version over time. (supports --dry-run)\n- `cf radar http timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP requests grouped by dimension. (supports --dry-run)\n- `cf radar http top browser` — Retrieves the top user agents by HTTP requests. (supports --dry-run)\n- `cf radar http top browser-family` — Retrieves the top user agents, aggregated in families, by HTTP requests. (supports --dry-run)\n- `cf radar leaked-credentials summary bot-class` — Retrieves the distribution of HTTP authentication requests by bot class. (supports --dry-run)\n- `cf radar leaked-credentials summary compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status. (supports --dry-run)\n- `cf radar leaked-credentials summary-v2 <dimension>` — Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups bot-class` — Retrieves the distribution of HTTP authentication requests by bot class over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows summary` — Retrieves the distribution of network traffic (NetFlows) by HTTP vs other protocols. (supports --dry-run)\n- `cf radar netflows summary-v2 <dimension>` — Retrieves the distribution of network traffic (NetFlows) by the specified dimension. (supports --dry-run)\n- `cf radar netflows timeseries` — Retrieves network traffic (NetFlows) over time. (supports --dry-run)\n- `cf radar netflows timeseries-groups <dimension>` — Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows top ases` — Retrieves the top autonomous systems by network traffic (NetFlows). (supports --dry-run)\n- `cf radar netflows top locations` — Retrieves the top locations by network traffic (NetFlows). (supports --dry-run)\n- `cf radar origins summary <dimension>` — Retrieves an aggregated summary of origin metrics grouped by the specified dimension. (supports --dry-run)\n- `cf radar origins timeseries` — Retrieves the time series of origin metrics for the specified origin. (supports --dry-run)\n- `cf radar origins timeseries-groups <dimension>` — Retrieves the distribution of origin metrics grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar post-quantum origin summary <dimension>` — Returns a summary of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum origin timeseries-groups <dimension>` — Returns a timeseries of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum tls support` — Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm and whether it uses PQ cryptography. (supports --dry-run)\n- `cf radar quality iqi summary` — Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality iqi timeseries-groups` — Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality speed histogram` — Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. (supports --dry-run)\n- `cf radar quality speed summary` — Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top ases` — Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top locations` — Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar ranking internet-services categories` — Retrieves the list of Internet services categories. (supports --dry-run)\n- `cf radar ranking internet-services timeseries-groups` — Retrieves Internet Services rank update changes over time. (supports --dry-run)\n- `cf radar ranking internet-services top` — Retrieves top Internet services based on their rank. (supports --dry-run)\n- `cf radar ranking timeseries-groups` — Retrieves domains rank over time. (supports --dry-run)\n- `cf radar ranking top` — Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. (supports --dry-run)\n- `cf radar robots-txt top domain-categories` — Retrieves the top domain categories by the number of robots.txt files parsed. (supports --dry-run)\n- `cf radar robots-txt top user-agents directive` — Retrieves the top user agents on robots.txt files. (supports --dry-run)\n- `cf radar search global` — Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). (supports --dry-run)\n- `cf radar tcp-resets-timeouts summary` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. (supports --dry-run)\n- `cf radar tcp-resets-timeouts timeseries-groups` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. (supports --dry-run)\n- `cf radar verified-bots top bots` — Retrieves the top verified bots by HTTP requests, with owner and category. (supports --dry-run)\n- `cf radar verified-bots top categories` — Retrieves the top verified bot categories by HTTP requests, along with their corresponding percentage, over the total verified bot HTTP requests. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"rate-limits": "# rate-limits — Legacy per-zone rate limiting rules — prefer Advanced Rate Limiting in Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf rate-limits get <rateLimitId>` — Fetches the details of a rate limit.\n- `cf rate-limits list` — Fetches the rate limits for a zone.\n\n### Create Operations\n\n- `cf rate-limits create` — Creates a new rate limit for a zone. Refer to the object definition for a list of required attributes. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rate-limits edit <rateLimitId>` — Updates an existing rate limit. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rate-limits delete <rateLimitId>` — Deletes an existing rate limit. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"realtime-kit": "# realtime-kit — Real-time video and audio — meetings, livestreams, recordings, and session management via Cloudflare Calls\n\n## Commands\n\n### Read Operations\n\n- `cf realtime-kit apps get` — Fetch all apps for your account\n- `cf realtime-kit kit meetings livestream get <meetingId>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtime-kit kit sessions livestream sessions get <sessionId>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtime-kit meetings get <appId>` — Returns all meetings for the given App ID.\n- `cf realtime-kit presets get <appId>` — Fetches all the presets belonging to an App.\n\n### Create Operations\n\n- `cf realtime-kit kit meetings active-session mute create <meetingId>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit kit meetings active-session mute-all create <meetingId>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings create <appId>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtime-kit presets create <appId>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtime-kit presets update <presetId>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtime-kit presets delete <presetId>` — Deletes a preset using the provided preset ID (supports --dry-run)\n\n### Other Operations\n\n- `cf realtime-kit active-session create-poll <meetingId>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit active-session get-active-session <meetingId>` — Returns details of an ongoing active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-all-participants <meetingId>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-participants <meetingId>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit analytics get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit apps post` — Create new app for your account (supports --dry-run, --body)\n- `cf realtime-kit livestreams get-active-livestreams-for-livestream-id <livestreamId>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-all-livestreams <appId>` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-analytics-complete <appId>` — Returns livestream analytics for the specified time range. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-details-for-session-id <livestreamSessionId>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-for-livestream-id <livestreamId>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-meeting-active-livestreams <meetingId>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit livestreams get-org-analytics <appId>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit livestreams start-livestreaming-a-meeting <meetingId>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit livestreams stop-livestreaming-a-meeting <meetingId>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit meetings add-participant <meetingId>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings delete-meeting-participant <participantId>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings edit-participant <participantId>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings get-meeting-by-id <meetingId>` — Returns a meeting details in an App for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participant <participantId>` — Returns a participant details for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participants <meetingId>` — Returns all participants detail for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings refresh-participant-token <participantId>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings replace-meeting-by-id <meetingId>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings update-meeting-by-id <meetingId>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit presets get-preset-by-id <presetId>` — Fetches details of a preset using the provided preset ID (supports --dry-run)\n- `cf realtime-kit recordings get-active-recordings <meetingId>` — Returns the active recording details for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings get-one-recording <recordingId>` — Returns details of a recording for the given recording ID. (supports --dry-run)\n- `cf realtime-kit recordings get-recordings <appId>` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings pause-resume-stop-recording <recordingId>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-recordings <appId>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-track-recording <appId>` — Starts a track recording in a meeting. Track recordings consist of \"layers\". Layers are used to map audio/video tracks in a meeting to output destinations. More information about track recordings is available in the [Track Recordings Guide Page](https://docs.realtime.cloudflare.com/guides/capabilities/recording/recording-overview). (supports --dry-run, --body)\n- `cf realtime-kit sessions generate-summary-of-transcripts <sessionId>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-participant-data-from-peer-id <peerId>` — Returns details of the given peer ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-chat <sessionId>` — Returns a URL to download all chat messages of the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-session-details <sessionId>` — Returns data of the given session ID including recording details. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participant-details <participantId>` — Returns details of the given participant ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participants <sessionId>` — Returns a list of participants for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-summary <sessionId>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text. (supports --dry-run)\n- `cf realtime-kit sessions get-session-transcripts <sessionId>` — Returns a URL to download the transcript for the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-sessions <appId>` — Returns details of all sessions of an App. (supports --dry-run)\n- `cf realtime-kit webhooks create-webhook <appId>` — Adds a new webhook to an App. (supports --dry-run, --body)\n- `cf realtime-kit webhooks delete-webhook <webhookId>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks edit-webhook <webhookId>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n- `cf realtime-kit webhooks get-webhook-by-id <webhookId>` — Returns webhook details for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks get-webhooks <appId>` — Returns details of all webhooks for an App. (supports --dry-run)\n- `cf realtime-kit webhooks replace-webhook <webhookId>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"registrar": "# registrar — Domain registration and transfer management through Cloudflare Registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar registrations get <domainName>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create` — Starts a domain registration workflow. This is a billable operation — successful registration charges the account's default payment method. All successful domain registrations are non-refundable — once the workflow completes with `state: succeeded`, the charge cannot be reversed. ### Prerequisites - The account must have a billing profile with a valid default payment method. Set this up at `https://dash.cloudflare.com/{account_id}/billing/payment-info`. - The account must not already be at the maximum supported domain limit. A single account may own up to 100 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Supported extensions In this API, \"extension\" means the full registrable suffix after the domain label. For example, in `example.co.uk`, the extension is `co.uk`. Programmatic registration is currently supported for: `com`, `org`, `net`, `app`, `dev`, `cc`, `xyz`, `info`, `cloud`, `studio`, `live`, `link`, `pro`, `tech`, `fyi`, `shop`, `online`, `tools`, `run`, `games`, `build`, `systems`, `world`, `news`, `site`, `network`, `chat`, `space`, `family`, `page`, `life`, `group`, `email`, `solutions`, `day`, `blog`, `ing`, `icu`, `academy`, `today` Cloudflare Registrar supports 400+ extensions in the dashboard. Extensions not listed above can still be registered at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Express mode The only required field is `domain_name`. If `contacts` is omitted, the system uses the account's default address book entry as the registrant. If no default exists and no contact is provided, the request fails. Set up a default address book entry and accept the required agreement at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domainName>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar domain-check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar domain-search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n- `cf registrar registrations get-status <domainName>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domainName>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"origin-tls-client-auth": "# origin-tls-client-auth — Authenticated Origin Pulls — require Cloudflare to present a client certificate when connecting to your origin\n\n## Commands\n\n### Read Operations\n\n- `cf origin-tls-client-auth hostname-associations list` — List certificate ID - hostname associations for the given zone. Shows which hostnames are associated to which certificates for authenticated origin pulls.\n- `cf origin-tls-client-auth hostname-certificates get <certificate-id>` — Get the certificate by ID to be used for client authentication on a hostname.\n- `cf origin-tls-client-auth hostname-certificates list` — Lists all client certificates configured for per-hostname authenticated origin pulls on the zone.\n- `cf origin-tls-client-auth hostnames get <hostname>` — Retrieves the client certificate authentication status for a specific hostname, showing whether authenticated origin pulls are enabled.\n- `cf origin-tls-client-auth settings get` — Get whether zone-level authenticated origin pulls is enabled or not. It is false by default.\n- `cf origin-tls-client-auth zone-certificates get <certificate-id>` — Retrieves details for a specific client certificate used in zone-level authenticated origin pulls.\n- `cf origin-tls-client-auth zone-certificates list` — Lists all client certificates configured for zone-level authenticated origin pulls.\n\n### Create Operations\n\n- `cf origin-tls-client-auth hostname-certificates create` — Upload a certificate to be used for client authentication on a hostname. 10 hostname certificates per zone are allowed. (supports --dry-run, --body)\n- `cf origin-tls-client-auth zone-certificates create` — Upload your own certificate you want Cloudflare to use for edge-to-origin communication to override the shared certificate. Please note that it is important to keep only one certificate active. Also, make sure to enable zone-level authenticated origin pulls by making a PUT call to settings endpoint to see the uploaded certificate in use. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf origin-tls-client-auth hostnames update` — Associate a hostname to a certificate and enable, disable or invalidate the association. If disabled, client certificate will not be sent to the hostname even if activated at the zone level. 100 maximum associations on a single certificate are allowed. Note: Use a null value for parameter *enabled* to invalidate the association. (supports --dry-run, --body)\n- `cf origin-tls-client-auth settings update` — Enable or disable zone-level authenticated origin pulls. 'enabled' should be set true either before/after the certificate is uploaded to see the certificate in use. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf origin-tls-client-auth hostname-certificates delete <certificate-id>` — Removes a client certificate used for authenticated origin pulls on a specific hostname. Note: Before deleting the certificate, you must first invalidate the hostname for client authentication by sending a PUT request with `enabled` set to null. After invalidating the association, the certificate can be safely deleted. (supports --dry-run)\n- `cf origin-tls-client-auth zone-certificates delete <certificate-id>` — Removes a client certificate used for zone-level authenticated origin pulls. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"page-rules": "# page-rules — Legacy URL-pattern rules that override zone settings for matching requests — prefer Rules/Transform Rules instead\n\n## Commands\n\n### Read Operations\n\n- `cf page-rules get <pagerule-id>` — Fetches the details of a Page Rule.\n- `cf page-rules list` — Fetches Page Rules in a zone.\n\n### Create Operations\n\n- `cf page-rules create` — Creates a new Page Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf page-rules edit <pagerule-id>` — Updates one or more fields of an existing Page Rule. (supports --dry-run, --body)\n- `cf page-rules update <pagerule-id>` — Replaces the configuration of an existing Page Rule. The configuration of the updated Page Rule will exactly match the data passed in the API request. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf page-rules delete <pagerule-id>` — Deletes an existing Page Rule. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"page-shield": "# page-shield — Client-side security — monitor JavaScript, connections, and cookies on your pages for supply-chain attacks\n\n## Commands\n\n### Read Operations\n\n- `cf page-shield connections get <connection-id>` — Fetches a connection detected by Page Shield by connection ID.\n- `cf page-shield connections list` — Lists all connections detected by Page Shield.\n- `cf page-shield cookies get <cookie-id>` — Fetches a cookie collected by Page Shield by cookie ID.\n- `cf page-shield cookies list` — Lists all cookies collected by Page Shield.\n- `cf page-shield get` — Fetches the Page Shield settings.\n- `cf page-shield policies get <policy-id>` — Fetches a Page Shield policy by ID.\n- `cf page-shield policies list` — Lists all Page Shield policies.\n- `cf page-shield scripts get <script-id>` — Fetches a script detected by Page Shield by script ID.\n- `cf page-shield scripts list` — Lists all scripts detected by Page Shield.\n\n### Create Operations\n\n- `cf page-shield policies create` — Create a Page Shield policy. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf page-shield policies update <policy-id>` — Update a Page Shield policy by ID. (supports --dry-run, --body)\n- `cf page-shield update` — Updates Page Shield settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf page-shield policies delete <policy-id>` — Delete a Page Shield policy by ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"pages": "# pages — Full-stack application hosting with Git-integrated builds, preview deployments, and custom domains\n\n## Commands\n\n### Read Operations\n\n- `cf pages projects deployments get <deployment-id>` — Fetch information about a deployment.\n- `cf pages projects deployments history logs get <deployment-id>` — Fetch deployment logs for a project.\n- `cf pages projects deployments list` — Fetch a list of project deployments.\n- `cf pages projects domains get <domain-name>` — Fetch a single domain.\n- `cf pages projects domains list` — Fetch a list of all domains associated with a Pages project.\n- `cf pages projects get <project-name>` — Fetch a project by name.\n- `cf pages projects list` — Fetch a list of all user projects.\n\n### Create Operations\n\n- `cf pages projects create` — Create a new project. (supports --dry-run, --body)\n- `cf pages projects deployments create <project-name>` — Start a new deployment from production. The repository and account must have already been authorized on the Cloudflare Pages dashboard. (supports --dry-run, --body)\n- `cf pages projects deployments tails create <deployment-id>` — Start a tail that receives logs and exception data. (supports --dry-run, --body)\n- `cf pages projects domains create <project-name>` — Add a new domain for the Pages project. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf pages projects domains edit <domain-name>` — Retry the validation status of a single domain. (supports --dry-run)\n- `cf pages projects edit <project-name>` — Set new attributes for an existing project. Modify environment variables. To delete an environment variable, set the key to null. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf pages projects delete <project-name>` — Delete a project by name. (supports --dry-run)\n- `cf pages projects deployments delete <deployment-id>` — Delete a deployment. (supports --dry-run)\n- `cf pages projects deployments tails delete <tail-id>` — Deletes a tail from a Pages deployment. (supports --dry-run)\n- `cf pages projects domains delete <domain-name>` — Delete a Pages project's domain. (supports --dry-run)\n\n### Other Operations\n\n- `cf pages projects deployments retry <deployment-id>` — Retry a previous deployment. (supports --dry-run)\n- `cf pages projects deployments rollback <deployment-id>` — Rollback the production deployment to a previous deployment. You can only rollback to succesful builds on production. (supports --dry-run)\n- `cf pages projects get-upload-token <project-name>` — Get a short-lived JWT for Pages Direct Upload asset operations. (supports --dry-run)\n- `cf pages projects purge-build-cache <project-name>` — Purge all cached build artifacts for a Pages project (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"pipelines": "# pipelines — Ingest, transform, and route event streams into R2, analytics, or other destinations in real time\n\n## Commands\n\n### Read Operations\n\n- `cf pipelines get <pipeline-name>` — [DEPRECATED] Get configuration of a pipeline. Use the new /pipelines/v1/pipelines endpoint instead.\n- `cf pipelines list` — [DEPRECATED] List, filter, and paginate pipelines in an account. Use the new /pipelines/v1/pipelines endpoint instead.\n- `cf pipelines sinks get <sink-id>` — Get Sink Details.\n- `cf pipelines sinks list` — List/Filter Sinks in Account.\n- `cf pipelines streams get <stream-id>` — Get Stream Details.\n- `cf pipelines streams list` — List/Filter Streams in Account.\n\n### Create Operations\n\n- `cf pipelines create` — [DEPRECATED] Create a new pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run, --body)\n- `cf pipelines sinks create` — Create a new Sink. (supports --dry-run, --body)\n- `cf pipelines streams create` — Create a new Stream. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf pipelines streams update <stream-id>` — Update a Stream. (supports --dry-run, --body)\n- `cf pipelines update <pipeline-name>` — [DEPRECATED] Update an existing pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf pipelines delete <pipeline-name>` — [DEPRECATED] Delete a pipeline. Use the new /pipelines/v1/pipelines endpoint instead. (supports --dry-run)\n- `cf pipelines sinks delete <sink-id>` — Delete Pipeline in Account. (supports --dry-run)\n- `cf pipelines streams delete <stream-id>` — Delete Stream in Account. (supports --dry-run)\n\n### Other Operations\n\n- `cf pipelines create-v1` — Create a new Pipeline. (supports --dry-run, --body)\n- `cf pipelines delete-v1 <pipeline-id>` — Delete Pipeline in Account. (supports --dry-run)\n- `cf pipelines get-v1 <pipeline-id>` — Get Pipelines Details. (supports --dry-run)\n- `cf pipelines list-v1` — List/Filter Pipelines in Account. (supports --dry-run)\n- `cf pipelines validate-sql` — Validate Arroyo SQL. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"queues": "# queues — Reliable message queuing between Workers — produce, consume, and batch-process messages at scale\n\n## Commands\n\n### Read Operations\n\n- `cf queues consumers get <consumer-id>` — Fetches the consumer for a queue by consumer id\n- `cf queues consumers list` — Returns the consumers for a Queue\n- `cf queues get <queue-id>` — Get details about a specific queue.\n- `cf queues list` — Returns the queues owned by an account.\n- `cf queues purge status <queue-id>` — Get details about a Queue's purge status.\n- `cf queues subscriptions get <subscription-id>` — Get details about an existing event subscription\n- `cf queues subscriptions list` — Get a paginated list of event subscriptions with optional sorting and filtering\n\n### Create Operations\n\n- `cf queues consumers create <queue-id>` — Creates a new consumer for a Queue (supports --dry-run, --body)\n- `cf queues create` — Create a new queue (supports --dry-run, --body)\n- `cf queues subscriptions create` — Create a new event subscription for a queue (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf queues consumers update <consumer-id>` — Updates the consumer for a queue, or creates one if it does not exist. (supports --dry-run, --body)\n- `cf queues edit <queue-id>` — Updates a Queue. (supports --dry-run, --body)\n- `cf queues subscriptions update <subscription-id>` — Update an existing event subscription (supports --dry-run, --body)\n- `cf queues update <queue-id>` — Updates a Queue. Note that this endpoint does not support partial updates. If successful, the Queue's configuration is overwritten with the supplied configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf queues consumers delete <consumer-id>` — Deletes the consumer for a queue. (supports --dry-run)\n- `cf queues delete <queue-id>` — Deletes a queue (supports --dry-run)\n- `cf queues subscriptions delete <subscription-id>` — Delete an existing event subscription (supports --dry-run)\n\n### Other Operations\n\n- `cf queues messages ack <queue-id>` — Acknowledge + Retry messages from a Queue (supports --dry-run, --body)\n- `cf queues messages ack-preview <queue-id>` — Delete previewed messages from a Queue. Note that messages acknowledged this way aren't considered delivered, they are instantly deleted from this queue and do not affect metrics. (supports --dry-run, --body)\n- `cf queues messages bulk-push` — Push a batch of message to a Queue (supports --dry-run, --body)\n- `cf queues messages preview <queue-id>` — Preview messages from a Queue without leasing them. Messages remain available for subsequent preview or pull operations. (supports --dry-run, --body)\n- `cf queues messages pull <queue-id>` — Pull a batch of messages from a Queue (supports --dry-run, --body)\n- `cf queues messages push <queue-id>` — Push a message to a Queue (supports --dry-run, --body)\n- `cf queues purge start <queue-id>` — Deletes all messages from the Queue. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"r2": "# r2 — S3-compatible object storage with zero egress fees — buckets, lifecycle rules, event notifications, and data migration\n\n## Commands\n\n### Read Operations\n\n- `cf r2 buckets cors get <bucket-name>` — Get the CORS policy for a bucket.\n- `cf r2 buckets domains custom get <domain>` — Get the configuration for a custom domain on an existing R2 bucket.\n- `cf r2 buckets domains custom list` — Gets a list of all custom domains registered with an existing R2 bucket.\n- `cf r2 buckets domains managed list` — Gets state of public access over the bucket's R2-managed (r2.dev) domain.\n- `cf r2 buckets event-notifications get <queue-id>` — Get a single event notification rule.\n- `cf r2 buckets event-notifications list` — List all event notification rules for a bucket.\n- `cf r2 buckets get <bucket-name>` — Gets properties of an existing R2 bucket.\n- `cf r2 buckets lifecycle get <bucket-name>` — Get object lifecycle rules for a bucket.\n- `cf r2 buckets list` — Lists all R2 buckets on your account.\n- `cf r2 buckets local-uploads get <bucket-name>` — Get the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region.\n- `cf r2 buckets locks get <bucket-name>` — Get lock rules for a bucket.\n- `cf r2 buckets metrics list` — Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.\n- `cf r2 buckets sippy get <bucket-name>` — Gets configuration for Sippy for an existing R2 bucket.\n- `cf r2 super-slurper jobs get <job-id>` — Retrieves detailed status and configuration for a specific R2 Super Slurper migration job.\n- `cf r2 super-slurper jobs list` — Lists all R2 Super Slurper migration jobs for the account with their status.\n- `cf r2 super-slurper jobs logs list` — Gets log entries for an R2 Super Slurper migration job, showing migration status changes, errors, etc.\n\n### Create Operations\n\n- `cf r2 buckets create` — Creates a new R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom create <bucket-name>` — Register a new custom domain for an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 super-slurper jobs create` — Creates a new R2 Super Slurper migration job to transfer objects from a source bucket (e.g. S3, GCS, R2) to R2. (supports --dry-run, --body)\n- `cf r2 temporary-credentials create` — Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2 buckets cors update <bucket-name>` — Set the CORS policy for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom update <domain>` — Edit the configuration for a custom domain on an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains managed update <bucket-name>` — Updates state of public access over the bucket's R2-managed (r2.dev) domain. (supports --dry-run, --body)\n- `cf r2 buckets edit <bucket-name>` — Updates properties of an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications update <queue-id>` — Create event notification rule. (supports --dry-run, --body)\n- `cf r2 buckets lifecycle update <bucket-name>` — Set the object lifecycle rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets local-uploads update <bucket-name>` — Set the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region. (supports --dry-run, --body)\n- `cf r2 buckets locks update <bucket-name>` — Set lock rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets sippy update <bucket-name>` — Sets configuration for Sippy for an existing R2 bucket. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf r2 buckets cors delete <bucket-name>` — Delete the CORS policy for a bucket. (supports --dry-run)\n- `cf r2 buckets delete <bucket-name>` — Deletes an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets domains custom delete <domain>` — Remove custom domain registration from an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications delete <queue-id>` — Delete an event notification rule. **If no body is provided, all rules for specified queue will be deleted**. (supports --dry-run, --body)\n- `cf r2 buckets sippy delete <bucket-name>` — Disables Sippy on this bucket. (supports --dry-run)\n\n### Other Operations\n\n- `cf r2 super-slurper connectivity-precheck source` — Check whether tokens are valid against the source bucket (supports --dry-run, --body)\n- `cf r2 super-slurper connectivity-precheck target` — Check whether tokens are valid against the target bucket (supports --dry-run, --body)\n- `cf r2 super-slurper jobs abort <job-id>` — Cancels a specific R2 Super Slurper migration job. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs abort-all` — Cancels all running R2 Super Slurper migration jobs for the account. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs pause <job-id>` — Pauses a running R2 Super Slurper migration job. The job can be resumed later to continue transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs progress <job-id>` — Retrieves current progress metrics for an R2 Super Slurper migration job (supports --dry-run)\n- `cf r2 super-slurper jobs resume <job-id>` — Resumes a paused R2 Super Slurper migration job, continuing the transfer from where it stopped. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"r2-data-catalog": "# r2-data-catalog — Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines\n\n## Commands\n\n### Read Operations\n\n- `cf r2-data-catalog get <bucket-name>` — Retrieve detailed information about a specific R2 catalog by bucket name. Returns catalog status, maintenance configuration, and credential status.\n- `cf r2-data-catalog list` — Returns a list of R2 buckets that have been enabled as Apache Iceberg catalogs for the specified account. Each catalog represents an R2 bucket configured to store Iceberg metadata and data files.\n- `cf r2-data-catalog maintenance-configs get <bucket-name>` — Retrieve the maintenance configuration for a specific catalog, including compaction settings and credential status.\n- `cf r2-data-catalog namespaces list` — Returns a list of namespaces in the specified R2 catalog. Supports hierarchical filtering and pagination for efficient traversal of large namespace hierarchies.\n- `cf r2-data-catalog namespaces tables list` — Returns a list of tables in the specified namespace within an R2 catalog. Supports pagination for efficient traversal of large table collections.\n- `cf r2-data-catalog namespaces tables maintenance-configs get <table-name>` — Retrieve the maintenance configuration for a specific table, including compaction settings.\n\n### Create Operations\n\n- `cf r2-data-catalog credentials create <bucket-name>` — Store authentication credentials for a catalog. These credentials are used to authenticate with R2 storage when performing catalog operations. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2-data-catalog maintenance-configs update <bucket-name>` — Update the maintenance configuration for a catalog. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n- `cf r2-data-catalog namespaces tables maintenance-configs update <table-name>` — Update the maintenance configuration for a specific table. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf r2-data-catalog disable <bucket-name>` — Disable an R2 bucket as a catalog. This operation deactivates the catalog but preserves existing metadata and data files. The catalog can be re-enabled later. (supports --dry-run)\n- `cf r2-data-catalog enable <bucket-name>` — Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"radar": "# radar — Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights\n\n## Commands\n\n### Read Operations\n\n- `cf radar annotations list` — Retrieves the latest annotations.\n- `cf radar annotations outages get` — Retrieves the latest Internet outages and anomalies.\n- `cf radar bgp hijacks events list` — Retrieves the BGP hijack events.\n- `cf radar bgp leaks events list` — Retrieves the BGP route leak events.\n- `cf radar bgp top ases get` — Retrieves the top autonomous systems by BGP updates (announcements only).\n- `cf radar bots get <bot-slug>` — Retrieves the requested bot information.\n- `cf radar bots list` — Retrieves a list of bots.\n- `cf radar ct authorities get <ca-slug>` — Retrieves the requested CA information.\n- `cf radar ct authorities list` — Retrieves a list of certificate authorities.\n- `cf radar ct logs get <log-slug>` — Retrieves the requested certificate log information.\n- `cf radar ct logs list` — Retrieves a list of certificate logs.\n- `cf radar datasets get <alias>` — Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.\n- `cf radar datasets list` — Retrieves a list of datasets.\n- `cf radar email security top tlds get` — Retrieves the top TLDs by number of email messages.\n- `cf radar email security top tlds malicious get <malicious>` — Retrieves the top TLDs by emails classified as malicious or not.\n- `cf radar email security top tlds spam get <spam>` — Retrieves the top TLDs by emails classified as spam or not.\n- `cf radar email security top tlds spoof get <spoof>` — Retrieves the top TLDs by emails classified as spoof or not.\n- `cf radar entities asns get <asn>` — Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).\n- `cf radar entities asns list` — Retrieves a list of autonomous systems.\n- `cf radar entities get` — Retrieves IP address information.\n- `cf radar entities locations get <location>` — Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).\n- `cf radar entities locations list` — Retrieves a list of locations.\n- `cf radar geolocations get <geo-id>` — Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar geolocations list` — Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar http ases bot-class get <bot-class>` — Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.\n- `cf radar http ases browser-family get <browser-family>` — Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.\n- `cf radar http ases device-type get <device-type>` — Retrieves the top autonomous systems, by HTTP requests, of the requested device type.\n- `cf radar http ases get` — Retrieves the top autonomous systems by HTTP requests.\n- `cf radar http ases http-method get <http-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.\n- `cf radar http ases http-protocol get <http-protocol>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http ases ip-version get <ip-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.\n- `cf radar http ases os get <os>` — Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.\n- `cf radar http ases tls-version get <tls-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.\n- `cf radar http locations bot-class get <bot-class>` — Retrieves the top locations, by HTTP requests, of the requested bot class.\n- `cf radar http locations browser-family get <browser-family>` — Retrieves the top locations, by HTTP requests, of the requested browser family.\n- `cf radar http locations device-type get <device-type>` — Retrieves the top locations, by HTTP requests, of the requested device type.\n- `cf radar http locations get` — Retrieves the top locations by HTTP requests.\n- `cf radar http locations http-method get <http-version>` — Retrieves the top locations, by HTTP requests, of the requested HTTP version.\n- `cf radar http locations http-protocol get <http-protocol>` — Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http locations ip-version get <ip-version>` — Retrieves the top locations, by HTTP requests, of the requested IP version.\n- `cf radar http locations os get <os>` — Retrieves the top locations, by HTTP requests, of the requested operating system.\n- `cf radar http locations tls-version get <tls-version>` — Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.\n- `cf radar origins get <slug>` — Retrieves the requested origin information with its regions.\n- `cf radar origins list` — Retrieves a list of origins with their regions.\n- `cf radar ranking domain get <domain>` — Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.\n- `cf radar tlds get <tld>` — Retrieves the requested TLD information.\n- `cf radar tlds list` — Retrieves a list of TLDs.\n- `cf radar traffic-anomalies get` — Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.\n- `cf radar traffic-anomalies locations get` — Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.\n\n### Other Operations\n\n- `cf radar agent-readiness summary <dimension>` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts. (supports --dry-run)\n- `cf radar ai bots summary user-agent` — Retrieves the distribution of traffic by AI user agent. (supports --dry-run)\n- `cf radar ai bots summary-v2 <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference summary model` — Retrieves the distribution of the number of inferences by model. (supports --dry-run)\n- `cf radar ai inference summary task` — Retrieves the distribution of the number of inferences by task. (supports --dry-run)\n- `cf radar ai inference summary-v2 <dimension>` — Retrieves an aggregated summary of the number of inferences run on Workers AI, grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary model` — Retrieves the distribution of the number of inferences by model over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups summary task` — Retrieves the distribution of the number of inferences by task over time. (supports --dry-run)\n- `cf radar ai inference timeseries-groups-v2 <dimension>` — Retrieves the distribution of the number of inferences run on Workers AI, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai markdown-for-agents summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. (supports --dry-run)\n- `cf radar ai markdown-for-agents timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai timeseries-groups timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai timeseries-groups user-agent` — Retrieves the distribution of traffic by AI user agent over time. (supports --dry-run)\n- `cf radar annotations outages locations` — Retrieves the number of outages by location. (supports --dry-run)\n- `cf radar as112 summary dnssec` — Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 summary edns` — Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 summary ip-version` — Retrieves the distribution of DNS queries to AS112 by IP version. (supports --dry-run)\n- `cf radar as112 summary protocol` — Retrieves the distribution of DNS queries to AS112 by protocol. (supports --dry-run)\n- `cf radar as112 summary query-type` — Retrieves the distribution of DNS queries to AS112 by type. (supports --dry-run)\n- `cf radar as112 summary response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code. (supports --dry-run)\n- `cf radar as112 summary-v2 <dimension>` — Retrieves the distribution of AS112 queries by the specified dimension. (supports --dry-run)\n- `cf radar as112 timeseries` — Retrieves the AS112 DNS queries over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups dnssec` — Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups edns` — Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS) support over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups ip-version` — Retrieves the distribution of AS112 DNS queries by IP version over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups protocol` — Retrieves the distribution of AS112 DNS requests classified by protocol over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups query-type` — Retrieves the distribution of AS112 DNS queries by type over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups-v2 <dimension>` — Retrieves the distribution of AS112 queries grouped by dimension over time. (supports --dry-run)\n- `cf radar as112 top dnssec <dnssec>` — Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 top edns <edns>` — Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 top ip-version <ip-version>` — Retrieves the top locations of DNS queries to AS112 for an IP version. (supports --dry-run)\n- `cf radar as112 top locations` — Retrieves the top locations by AS112 DNS queries. (supports --dry-run)\n- `cf radar attacks layer3 summary bitrate` — Retrieves the distribution of layer 3 attacks by bitrate. (supports --dry-run)\n- `cf radar attacks layer3 summary duration` — Retrieves the distribution of layer 3 attacks by duration. (supports --dry-run)\n- `cf radar attacks layer3 summary industry` — Retrieves the distribution of layer 3 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer3 summary ip-version` — Retrieves the distribution of layer 3 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer3 summary protocol` — Retrieves the distribution of layer 3 attacks by protocol. (supports --dry-run)\n- `cf radar attacks layer3 summary vector` — Retrieves the distribution of layer 3 attacks by vector. (supports --dry-run)\n- `cf radar attacks layer3 summary vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer3 summary-v2 <dimension>` — Retrieves the distribution of layer 3 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer3 timeseries` — Retrieves layer 3 attacks over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups bitrate` — Retrieves the distribution of layer 3 attacks by bitrate over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups duration` — Retrieves the distribution of layer 3 attacks by duration over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups industry` — Retrieves the distribution of layer 3 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups ip-version` — Retrieves the distribution of layer 3 attacks by IP version over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups protocol` — Retrieves the distribution of layer 3 attacks by protocol over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vector` — Retrieves the distribution of layer 3 attacks by vector over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer3 top attacks` — Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer3 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer3 top locations origin` — Retrieves the origin locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top locations target` — Retrieves the target locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar attacks layer7 summary http-method` — Retrieves the distribution of layer 7 attacks by HTTP method. (supports --dry-run)\n- `cf radar attacks layer7 summary http-version` — Retrieves the distribution of layer 7 attacks by HTTP version. (supports --dry-run)\n- `cf radar attacks layer7 summary industry` — Retrieves the distribution of layer 7 attacks by targeted industry. (supports --dry-run)\n- `cf radar attacks layer7 summary ip-version` — Retrieves the distribution of layer 7 attacks by IP version. (supports --dry-run)\n- `cf radar attacks layer7 summary managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules. (supports --dry-run)\n- `cf radar attacks layer7 summary mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product. (supports --dry-run)\n- `cf radar attacks layer7 summary vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical. (supports --dry-run)\n- `cf radar attacks layer7 summary-v2 <dimension>` — Retrieves the distribution of layer 7 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer7 timeseries` — Retrieves layer 7 attacks over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-method` — Retrieves the distribution of layer 7 attacks by HTTP method over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups http-version` — Retrieves the distribution of layer 7 attacks by HTTP version over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups industry` — Retrieves the distribution of layer 7 attacks by targeted industry over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups ip-version` — Retrieves the distribution of layer 7 attacks by IP version used over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer7 top ases origin` — Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top attacks` — Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer7 top industry` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. (supports --dry-run)\n- `cf radar attacks layer7 top locations origin` — Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top locations target` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. (supports --dry-run)\n- `cf radar attacks layer7 top vertical` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. (supports --dry-run)\n- `cf radar bgp ips timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. (supports --dry-run)\n- `cf radar bgp routes ases` — Retrieves all ASes in the current global routing tables with routing statistics. (supports --dry-run)\n- `cf radar bgp routes moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. (supports --dry-run)\n- `cf radar bgp routes pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. (supports --dry-run)\n- `cf radar bgp routes realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). (supports --dry-run)\n- `cf radar bgp routes stats` — Retrieves the BGP routing table stats. (supports --dry-run)\n- `cf radar bgp rpki aspa changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. (supports --dry-run)\n- `cf radar bgp rpki aspa snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. (supports --dry-run)\n- `cf radar bgp rpki aspa timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. (supports --dry-run)\n- `cf radar bgp timeseries` — Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. (supports --dry-run)\n- `cf radar bgp top ases prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. (supports --dry-run)\n- `cf radar bgp top prefixes` — Retrieves the top network prefixes by BGP updates. (supports --dry-run)\n- `cf radar bots summary <dimension>` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots timeseries` — Retrieves bots HTTP request volume over time. (supports --dry-run)\n- `cf radar bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar bots web-crawlers summary <dimension>` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots web-crawlers timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ct summary <dimension>` — Retrieves an aggregated summary of certificates grouped by the specified dimension. (supports --dry-run)\n- `cf radar ct timeseries` — Retrieves certificate volume over time. (supports --dry-run)\n- `cf radar ct timeseries-groups <dimension>` — Retrieves the distribution of certificates grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar datasets download` — Retrieves an URL to download a single dataset. (supports --dry-run, --body)\n- `cf radar dns summary cache-hit` — Retrieves the distribution of DNS queries by cache status. (supports --dry-run)\n- `cf radar dns summary dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar dns summary dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness. (supports --dry-run)\n- `cf radar dns summary dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status. (supports --dry-run)\n- `cf radar dns summary ip-version` — Retrieves the distribution of DNS queries by IP version. (supports --dry-run)\n- `cf radar dns summary matching-answer` — Retrieves the distribution of DNS queries by matching answers. (supports --dry-run)\n- `cf radar dns summary protocol` — Retrieves the distribution of DNS queries by DNS transport protocol. (supports --dry-run)\n- `cf radar dns summary query-type` — Retrieves the distribution of DNS queries by type. (supports --dry-run)\n- `cf radar dns summary response-code` — Retrieves the distribution of DNS queries by response code. (supports --dry-run)\n- `cf radar dns summary response-ttl` — Retrieves the distribution of DNS queries by minimum response TTL. (supports --dry-run)\n- `cf radar dns summary-v2 <dimension>` — Retrieves the distribution of DNS queries by the specified dimension. (supports --dry-run)\n- `cf radar dns timeseries` — Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. (supports --dry-run)\n- `cf radar dns timeseries-groups cache-hit` — Retrieves the distribution of DNS queries by cache status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec` — Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-aware` — Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time. (supports --dry-run)\n- `cf radar dns timeseries-groups dnssec-e2e` — Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time. (supports --dry-run)\n- `cf radar dns timeseries-groups ip-version` — Retrieves the distribution of DNS queries by IP version over time. (supports --dry-run)\n- `cf radar dns timeseries-groups matching-answer` — Retrieves the distribution of DNS queries by matching answers over time. (supports --dry-run)\n- `cf radar dns timeseries-groups protocol` — Retrieves the distribution of DNS queries by DNS transport protocol over time. (supports --dry-run)\n- `cf radar dns timeseries-groups query-type` — Retrieves the distribution of DNS queries by type over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-code` — Retrieves the distribution of DNS queries by response code over time. (supports --dry-run)\n- `cf radar dns timeseries-groups response-ttl` — Retrieves the distribution of DNS queries by minimum answer TTL over time. (supports --dry-run)\n- `cf radar dns timeseries-groups-v2 <dimension>` — Retrieves the distribution of DNS queries grouped by dimension over time. (supports --dry-run)\n- `cf radar dns top ases` — Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar dns top locations` — Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar email routing summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email routing summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email routing summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email routing summary encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted). (supports --dry-run)\n- `cf radar email routing summary ip-version` — Retrieves the distribution of emails by IP version. (supports --dry-run)\n- `cf radar email routing summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email routing summary-v2 <dimension>` — Retrieves the distribution of email routing metrics by the specified dimension. (supports --dry-run)\n- `cf radar email routing timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups encrypted` — Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted) over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups ip-version` — Retrieves the distribution of emails by IP version over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email routing timeseries-groups-v2 <dimension>` — Retrieves the distribution of email routing metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar email security summary arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation. (supports --dry-run)\n- `cf radar email security summary dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation. (supports --dry-run)\n- `cf radar email security summary dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation. (supports --dry-run)\n- `cf radar email security summary malicious` — Retrieves the distribution of emails by malicious classification. (supports --dry-run)\n- `cf radar email security summary spam` — Retrieves the proportion of emails by spam classification (spam vs. non-spam). (supports --dry-run)\n- `cf radar email security summary spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation. (supports --dry-run)\n- `cf radar email security summary spoof` — Retrieves the proportion of emails by spoof classification (spoof vs. non-spoof). (supports --dry-run)\n- `cf radar email security summary threat-category` — Retrieves the distribution of emails by threat categories. (supports --dry-run)\n- `cf radar email security summary tls-version` — Retrieves the distribution of emails by TLS version. (supports --dry-run)\n- `cf radar email security summary-v2 <dimension>` — Retrieves the distribution of email security metrics by the specified dimension. (supports --dry-run)\n- `cf radar email security timeseries-groups arc` — Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dkim` — Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups dmarc` — Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups malicious` — Retrieves the distribution of emails by malicious classification over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spam` — Retrieves the distribution of emails by spam classification (spam vs. non-spam) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spf` — Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time. (supports --dry-run)\n- `cf radar email security timeseries-groups spoof` — Retrieves the distribution of emails by spoof classification (spoof vs. non-spoof) over time. (supports --dry-run)\n- `cf radar email security timeseries-groups threat-category` — Retrieves the distribution of emails by threat category over time. (supports --dry-run)\n- `cf radar email security timeseries-groups tls-version` — Retrieves the distribution of emails by TLS version over time. (supports --dry-run)\n- `cf radar email security timeseries-groups-v2 <dimension>` — Retrieves the distribution of email security metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar entities asns as-set <asn>` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. (supports --dry-run)\n- `cf radar entities asns botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. (supports --dry-run)\n- `cf radar entities asns ip` — Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). (supports --dry-run)\n- `cf radar entities asns rel <asn>` — Retrieves AS-level relationship for given networks. (supports --dry-run)\n- `cf radar http summary bot-class` — Retrieves the distribution of bot-generated HTTP requests to genuine human traffic, as classified by Cloudflare. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http summary device-type` — Retrieves the distribution of HTTP requests generated by mobile, desktop, and other types of devices. (supports --dry-run)\n- `cf radar http summary http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS). (supports --dry-run)\n- `cf radar http summary http-version` — Retrieves the distribution of HTTP requests by HTTP version. (supports --dry-run)\n- `cf radar http summary ip-version` — Retrieves the distribution of HTTP requests by IP version. (supports --dry-run)\n- `cf radar http summary os` — Retrieves the distribution of HTTP requests by operating system (Windows, macOS, Android, iOS, and others). (supports --dry-run)\n- `cf radar http summary post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support. (supports --dry-run)\n- `cf radar http summary tls-version` — Retrieves the distribution of HTTP requests by TLS version. (supports --dry-run)\n- `cf radar http summary-v2 <dimension>` — Retrieves the distribution of HTTP requests by the specified dimension. (supports --dry-run)\n- `cf radar http timeseries` — Retrieves the HTTP requests over time. (supports --dry-run)\n- `cf radar http timeseries-groups bot-class` — Retrieves the distribution of HTTP requests classified as automated or human over time. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information. (supports --dry-run)\n- `cf radar http timeseries-groups browser` — Retrieves the distribution of HTTP requests by user agent over time. (supports --dry-run)\n- `cf radar http timeseries-groups browser-family` — Retrieves the distribution of HTTP requests by user agent family over time. (supports --dry-run)\n- `cf radar http timeseries-groups device-type` — Retrieves the distribution of HTTP requests by device type over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-protocol` — Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS) over time. (supports --dry-run)\n- `cf radar http timeseries-groups http-version` — Retrieves the distribution of HTTP requests by HTTP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups ip-version` — Retrieves the distribution of HTTP requests by IP version over time. (supports --dry-run)\n- `cf radar http timeseries-groups os` — Retrieves the distribution of HTTP requests by operating system over time. (supports --dry-run)\n- `cf radar http timeseries-groups post-quantum` — Retrieves the distribution of HTTP requests by post-quantum support over time. (supports --dry-run)\n- `cf radar http timeseries-groups tls-version` — Retrieves the distribution of HTTP requests by TLS version over time. (supports --dry-run)\n- `cf radar http timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP requests grouped by dimension. (supports --dry-run)\n- `cf radar http top browser` — Retrieves the top user agents by HTTP requests. (supports --dry-run)\n- `cf radar http top browser-family` — Retrieves the top user agents, aggregated in families, by HTTP requests. (supports --dry-run)\n- `cf radar leaked-credentials summary bot-class` — Retrieves the distribution of HTTP authentication requests by bot class. (supports --dry-run)\n- `cf radar leaked-credentials summary compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status. (supports --dry-run)\n- `cf radar leaked-credentials summary-v2 <dimension>` — Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups bot-class` — Retrieves the distribution of HTTP authentication requests by bot class over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups compromised` — Retrieves the distribution of HTTP authentication requests by compromised credential status over time. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows summary` — Retrieves the distribution of network traffic (NetFlows) by HTTP vs other protocols. (supports --dry-run)\n- `cf radar netflows summary-v2 <dimension>` — Retrieves the distribution of network traffic (NetFlows) by the specified dimension. (supports --dry-run)\n- `cf radar netflows timeseries` — Retrieves network traffic (NetFlows) over time. (supports --dry-run)\n- `cf radar netflows timeseries-groups <dimension>` — Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows top ases` — Retrieves the top autonomous systems by network traffic (NetFlows). (supports --dry-run)\n- `cf radar netflows top locations` — Retrieves the top locations by network traffic (NetFlows). (supports --dry-run)\n- `cf radar origins summary <dimension>` — Retrieves an aggregated summary of origin metrics grouped by the specified dimension. (supports --dry-run)\n- `cf radar origins timeseries` — Retrieves the time series of origin metrics for the specified origin. (supports --dry-run)\n- `cf radar origins timeseries-groups <dimension>` — Retrieves the distribution of origin metrics grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar post-quantum origin summary <dimension>` — Returns a summary of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum origin timeseries-groups <dimension>` — Returns a timeseries of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum tls support` — Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm, whether it uses PQ cryptography, and any detected TLS implementation bugs (Split ClientHello, HRR failure, etc.). (supports --dry-run)\n- `cf radar quality iqi summary` — Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality iqi timeseries-groups` — Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality speed histogram` — Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. (supports --dry-run)\n- `cf radar quality speed summary` — Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top ases` — Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top locations` — Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar ranking internet-services categories` — Retrieves the list of Internet services categories. (supports --dry-run)\n- `cf radar ranking internet-services timeseries-groups` — Retrieves Internet Services rank update changes over time. (supports --dry-run)\n- `cf radar ranking internet-services top` — Retrieves top Internet services based on their rank. (supports --dry-run)\n- `cf radar ranking timeseries-groups` — Retrieves domains rank over time. (supports --dry-run)\n- `cf radar ranking top` — Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. (supports --dry-run)\n- `cf radar robots-txt top domain-categories` — Retrieves the top domain categories by the number of robots.txt files parsed. (supports --dry-run)\n- `cf radar robots-txt top user-agents directive` — Retrieves the top user agents on robots.txt files. (supports --dry-run)\n- `cf radar search global` — Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). (supports --dry-run)\n- `cf radar tcp-resets-timeouts summary` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. (supports --dry-run)\n- `cf radar tcp-resets-timeouts timeseries-groups` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. (supports --dry-run)\n- `cf radar verified-bots top bots` — Retrieves the top verified bots by HTTP requests, with owner and category. (supports --dry-run)\n- `cf radar verified-bots top categories` — Retrieves the top verified bot categories by HTTP requests, along with their corresponding percentage, over the total verified bot HTTP requests. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"rate-limits": "# rate-limits — Legacy per-zone rate limiting rules — prefer Advanced Rate Limiting in Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf rate-limits get <rate-limit-id>` — Fetches the details of a rate limit.\n- `cf rate-limits list` — Fetches the rate limits for a zone.\n\n### Create Operations\n\n- `cf rate-limits create` — Creates a new rate limit for a zone. Refer to the object definition for a list of required attributes. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rate-limits edit <rate-limit-id>` — Updates an existing rate limit. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rate-limits delete <rate-limit-id>` — Deletes an existing rate limit. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"realtime-kit": "# realtime-kit — Real-time video and audio — meetings, livestreams, recordings, and session management via Cloudflare Calls\n\n## Commands\n\n### Read Operations\n\n- `cf realtime-kit apps get` — Fetch all apps for your account\n- `cf realtime-kit kit meetings livestream get <meeting-id>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtime-kit kit sessions livestream sessions get <session-id>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtime-kit meetings get <app-id>` — Returns all meetings for the given App ID.\n- `cf realtime-kit presets get <app-id>` — Fetches all the presets belonging to an App.\n\n### Create Operations\n\n- `cf realtime-kit kit meetings active-session mute create <meeting-id>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit kit meetings active-session mute-all create <meeting-id>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings create <app-id>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtime-kit presets create <app-id>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtime-kit presets update <preset-id>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtime-kit presets delete <preset-id>` — Deletes a preset using the provided preset ID (supports --dry-run)\n\n### Other Operations\n\n- `cf realtime-kit active-session create-poll <meeting-id>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit active-session get-active-session <meeting-id>` — Returns details of an ongoing active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-all-participants <meeting-id>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit active-session kick-participants <meeting-id>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtime-kit analytics get-org-analytics <app-id>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date. (supports --dry-run)\n- `cf realtime-kit apps post` — Create new app for your account (supports --dry-run, --body)\n- `cf realtime-kit livestreams get-active-livestreams-for-livestream-id <livestream-id>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-all-livestreams <app-id>` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-analytics-complete <app-id>` — Returns livestream analytics for the specified time range. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-details-for-session-id <livestream-session-id>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-livestream-session-for-livestream-id <livestream-id>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtime-kit livestreams get-meeting-active-livestreams <meeting-id>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit livestreams start-livestreaming-a-meeting <meeting-id>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtime-kit livestreams stop-livestreaming-a-meeting <meeting-id>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run)\n- `cf realtime-kit meetings add-participant <meeting-id>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings delete-meeting-participant <participant-id>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings edit-participant <participant-id>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings get-meeting-by-id <meeting-id>` — Returns a meeting details in an App for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participant <participant-id>` — Returns a participant details for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings get-meeting-participants <meeting-id>` — Returns all participants detail for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit meetings refresh-participant-token <participant-id>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtime-kit meetings replace-meeting-by-id <meeting-id>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit meetings update-meeting-by-id <meeting-id>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtime-kit presets get-preset-by-id <preset-id>` — Fetches details of a preset using the provided preset ID (supports --dry-run)\n- `cf realtime-kit recordings get-active-recordings <meeting-id>` — Returns the active recording details for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings get-one-recording <recording-id>` — Returns details of a recording for the given recording ID. (supports --dry-run)\n- `cf realtime-kit recordings get-recordings <app-id>` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID. (supports --dry-run)\n- `cf realtime-kit recordings pause-resume-stop-recording <recording-id>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-recordings <app-id>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtime-kit recordings start-track-recording <app-id>` — Starts track recording for a meeting. Track recording currently records separate participant audio tracks as WebM files in the RealtimeKit bucket. Video track recording is in development. For more information, refer to [Track recording](/realtime/realtimekit/recording-guide/track-recording/). (supports --dry-run, --body)\n- `cf realtime-kit sessions generate-summary-of-transcripts <session-id>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-participant-data-from-peer-id <peer-id>` — Returns participant details for the given peer ID along with call statistics. (supports --dry-run)\n- `cf realtime-kit sessions get-session-chat <session-id>` — Returns a URL to download all chat messages of the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-session-details <session-id>` — Returns data of the given session ID including recording details. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participant-details <participant-id>` — Returns details of the given participant ID along with call statistics for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-participants <session-id>` — Returns a list of participants for the given session ID. (supports --dry-run)\n- `cf realtime-kit sessions get-session-summary <session-id>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text. (supports --dry-run)\n- `cf realtime-kit sessions get-session-transcripts <session-id>` — Returns a URL to download the transcript for the session ID in CSV format. (supports --dry-run)\n- `cf realtime-kit sessions get-sessions <app-id>` — Returns details of all sessions of an App. (supports --dry-run)\n- `cf realtime-kit webhooks create-webhook <app-id>` — Adds a new webhook to an App. (supports --dry-run, --body)\n- `cf realtime-kit webhooks delete-webhook <webhook-id>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks edit-webhook <webhook-id>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n- `cf realtime-kit webhooks get-webhook-by-id <webhook-id>` — Returns webhook details for the given webhook ID. (supports --dry-run)\n- `cf realtime-kit webhooks get-webhooks <app-id>` — Returns details of all webhooks for an App. (supports --dry-run)\n- `cf realtime-kit webhooks replace-webhook <webhook-id>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"registrar": "# registrar — Domain registration and transfer management through Cloudflare Registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar registrations get <domain-name>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create` — Starts a domain registration workflow. This is a billable operation — successful registration charges the account's default payment method. All successful domain registrations are non-refundable — once the workflow completes with `state: succeeded`, the charge cannot be reversed. ### Prerequisites - The account must have a billing profile with a valid default payment method. Set this up at `https://dash.cloudflare.com/{account_id}/billing/payment-info`. - The account must not already be at the maximum supported domain limit. A single account may own up to 100 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Express mode The only required field is `domain_name`. If `contacts` is omitted, the system uses the account's default address book entry as the registrant. If no default exists and no contact is provided, the request fails. Set up a default address book entry and accept the required agreement at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domain-name>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar domain-check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar domain-search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n- `cf registrar registrations get-status <domain-name>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domain-name>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"request-tracers": "# request-tracers — Trace how a request would be processed through Cloudflare's rules and configuration pipeline\n\n## Commands\n\n### Create Operations\n\n- `cf request-tracers traces create` — Traces a simulated HTTP request through Cloudflare's edge to analyze how rules, settings, and configurations would process the request. Useful for debugging firewall rules, page rules, and other request transformations without sending actual traffic. Supports custom headers, cookies, body content, and geolocation context. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"resource-sharing": "# resource-sharing — Share Cloudflare resources (zones, accounts) across organizations with granular access controls\n\n## Commands\n\n### Read Operations\n\n- `cf resource-sharing get <shareId>` — Fetches share by ID.\n- `cf resource-sharing list` — Lists all account shares.\n- `cf resource-sharing recipients get <recipientId>` — Get share recipient by ID.\n- `cf resource-sharing recipients list` — List share recipients by share ID.\n- `cf resource-sharing resources get <resourceId>` — Get share resource by ID.\n- `cf resource-sharing resources list` — List share resources by share ID.\n\n### Create Operations\n\n- `cf resource-sharing create` — Creates a new resource share for sharing Cloudflare resources with other accounts or organizations. (supports --dry-run, --body)\n- `cf resource-sharing recipients create <shareId>` — Adds a recipient to a resource share, granting them access to the shared resources. (supports --dry-run, --body)\n- `cf resource-sharing resources create <shareId>` — Adds a resource to an existing share, making it available to share recipients. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf resource-sharing recipients update <shareId>` — Changes a share's recipients to match the given list. Returns an error if the share targets an organization. (supports --dry-run, --body)\n- `cf resource-sharing resources update <resourceId>` — Update is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run, --body)\n- `cf resource-sharing update <shareId>` — Updating is not immediate, an updated share object with a new status will be returned. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf resource-sharing delete <shareId>` — Deletion is not immediate, an updated share object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing recipients delete <recipientId>` — Deletion is not immediate, an updated share recipient object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing resources delete <resourceId>` — Deletion is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"resource-sharing": "# resource-sharing — Share Cloudflare resources (zones, accounts) across organizations with granular access controls\n\n## Commands\n\n### Read Operations\n\n- `cf resource-sharing get <share-id>` — Fetches share by ID.\n- `cf resource-sharing list` — Lists all account shares.\n- `cf resource-sharing recipients get <recipient-id>` — Get share recipient by ID.\n- `cf resource-sharing recipients list` — List share recipients by share ID.\n- `cf resource-sharing resources get <share-resource-id>` — Get share resource by ID.\n- `cf resource-sharing resources list` — List share resources by share ID.\n\n### Create Operations\n\n- `cf resource-sharing create` — Creates a new resource share for sharing Cloudflare resources with other accounts or organizations. (supports --dry-run, --body)\n- `cf resource-sharing recipients create <share-id>` — Adds a recipient to a resource share, granting them access to the shared resources. (supports --dry-run, --body)\n- `cf resource-sharing resources create <share-id>` — Adds a resource to an existing share, making it available to share recipients. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf resource-sharing recipients update <share-id>` — Changes a share's recipients to match the given list. Returns an error if the share targets an organization. (supports --dry-run, --body)\n- `cf resource-sharing resources update <share-resource-id>` — Update is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run, --body)\n- `cf resource-sharing update <share-id>` — Updating is not immediate, an updated share object with a new status will be returned. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf resource-sharing delete <share-id>` — Deletion is not immediate, an updated share object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing recipients delete <recipient-id>` — Deletion is not immediate, an updated share recipient object with a new status will be returned. (supports --dry-run)\n- `cf resource-sharing resources delete <share-resource-id>` — Deletion is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"resource-tagging": "# resource-tagging — Tag accounts and zones with key-value metadata for organization, filtering, and policy targeting\n\n## Commands\n\n### Read Operations\n\n- `cf resource-tagging account-tags get` — Retrieves tags for a specific account-level resource.\n- `cf resource-tagging keys list` — Lists all distinct tag keys used across resources in an account.\n- `cf resource-tagging list` — Lists all tagged resources for an account.\n- `cf resource-tagging values list` — Lists all distinct values for a given tag key, optionally filtered by resource type.\n- `cf resource-tagging zone-tags get` — Retrieves tags for a specific zone-level resource.\n\n### Update Operations\n\n- `cf resource-tagging account-tags update` — Creates or updates tags for a specific account-level resource. (supports --dry-run, --body)\n- `cf resource-tagging zone-tags update` — Creates or updates tags for a specific zone-level resource. Replaces all existing tags for the resource. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf resource-tagging account-tags delete` — Removes all tags from a specific account-level resource. (supports --dry-run, --body)\n- `cf resource-tagging zone-tags delete` — Removes all tags from a specific zone-level resource. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"rules": "# rules — Account-level IP lists, hostname lists, and other reusable lists referenced by firewall rules and rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rules lists bulk-operations get <operationId>` — Gets the current status of an asynchronous operation on a list. The `status` property can have one of the following values: `pending`, `running`, `completed`, or `failed`. If the status is `failed`, the `error` property will contain a message describing the error.\n- `cf rules lists get <listId>` — Fetches the details of a list.\n- `cf rules lists items get <itemId>` — Fetches a list item in the list.\n- `cf rules lists items list` — Fetches all the items in the list.\n- `cf rules lists list` — Fetches all lists in the account.\n\n### Create Operations\n\n- `cf rules lists create` — Creates a new list of the specified kind. (supports --dry-run, --body)\n- `cf rules lists items create <listId>` — Appends new items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rules lists items update <listId>` — Removes all existing items from the list and adds the provided items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n- `cf rules lists update <listId>` — Updates the description of a list. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rules lists delete <listId>` — Deletes a specific list and all its items. (supports --dry-run, --body)\n- `cf rules lists items delete <listId>` — Removes one or more items from a list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"rulesets": "# rulesets — Versioned collections of rules that control how Cloudflare processes traffic — WAF, transform, redirect, and more\n\n## Commands\n\n### Read Operations\n\n- `cf rulesets account-rulesets get <rulesetId>` — Fetches the latest version of an account ruleset.\n- `cf rulesets account-rulesets list` — Fetches all rulesets at the account level.\n- `cf rulesets account-rulesets phases get <rulesetPhase>` — Fetches the latest version of the account entry point ruleset for a given phase.\n- `cf rulesets account-rulesets phases versions get <rulesetVersion>` — Fetches a specific version of an account entry point ruleset.\n- `cf rulesets account-rulesets phases versions list` — Fetches the versions of an account entry point ruleset.\n- `cf rulesets account-rulesets versions get <rulesetVersion>` — Fetches a specific version of an account ruleset.\n- `cf rulesets account-rulesets versions list` — Fetches the versions of an account ruleset.\n- `cf rulesets get <rulesetId>` — Fetches the latest version of a zone ruleset.\n- `cf rulesets list` — Fetches all rulesets at the zone level.\n- `cf rulesets phases get <rulesetPhase>` — Fetches the latest version of the zone entry point ruleset for a given phase.\n- `cf rulesets phases versions get <rulesetVersion>` — Fetches a specific version of a zone entry point ruleset.\n- `cf rulesets phases versions list` — Fetches the versions of a zone entry point ruleset.\n- `cf rulesets versions get <rulesetVersion>` — Fetches a specific version of a zone ruleset.\n- `cf rulesets versions list` — Fetches the versions of a zone ruleset.\n\n### Create Operations\n\n- `cf rulesets account-rulesets create` — Creates a ruleset at the account level. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules create <rulesetId>` — Adds a new rule to an account ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n- `cf rulesets create` — Creates a ruleset at the zone level. (supports --dry-run, --body)\n- `cf rulesets rules create <rulesetId>` — Adds a new rule to a zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rulesets account-rulesets phases update <rulesetPhase>` — Updates an account entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules update <ruleId>` — Updates an existing rule in an account ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets update <rulesetId>` — Updates an account ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets phases update <rulesetPhase>` — Updates a zone entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets rules edit <ruleId>` — Updates an existing rule in a zone ruleset. (supports --dry-run, --body)\n- `cf rulesets update <rulesetId>` — Updates a zone ruleset, creating a new version. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rulesets account-rulesets delete <rulesetId>` — Deletes all versions of an existing account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets rules delete <ruleId>` — Deletes an existing rule from an account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets versions delete <rulesetVersion>` — Deletes an existing version of an account ruleset. (supports --dry-run)\n- `cf rulesets delete <rulesetId>` — Deletes all versions of an existing zone ruleset. (supports --dry-run)\n- `cf rulesets rules delete <ruleId>` — Deletes an existing rule from a zone ruleset. (supports --dry-run)\n- `cf rulesets versions delete <rulesetVersion>` — Deletes an existing version of a zone ruleset. (supports --dry-run)\n\n### Other Operations\n\n- `cf rulesets account-rulesets versions by-tag tag <ruleTag>` — Fetches the rules of a managed account ruleset version for a given tag. (supports --dry-run)\n- `cf rulesets account-rulesets versions zone-by-tag tag <ruleTag>` — Fetches the rules of a managed zone ruleset version for a given tag. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"rum": "# rum — Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics\n\n## Commands\n\n### Read Operations\n\n- `cf rum rules list` — Lists all the rules in a Web Analytics ruleset.\n- `cf rum site-info get <siteId>` — Retrieves a Web Analytics site.\n- `cf rum site-info list` — Lists all Web Analytics sites of an account.\n\n### Create Operations\n\n- `cf rum rules create <rulesetId>` — Creates a new rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info create` — Creates a new Web Analytics site. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rum rules update <ruleId>` — Updates a rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info update <siteId>` — Updates an existing Web Analytics site. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rum rules delete <ruleId>` — Deletes an existing rule from a Web Analytics ruleset. (supports --dry-run)\n- `cf rum site-info delete <siteId>` — Deletes an existing Web Analytics site. (supports --dry-run)\n\n### Other Operations\n\n- `cf rum rules bulk-create` — Modifies one or more rules in a Web Analytics ruleset with a single request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"schema-validation": "# schema-validation — API schema validation settings — enforce request/response schemas and configure validation behavior\n\n## Commands\n\n### Read Operations\n\n- `cf schema-validation schemas get <schemaId>` — Gets the contents and metadata of a specific OpenAPI schema uploaded to API Shield.\n- `cf schema-validation schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone.\n- `cf schema-validation schemas list` — Lists all OpenAPI schemas uploaded to API Shield with pagination support.\n- `cf schema-validation schemas operations get <schemaId>` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n- `cf schema-validation settings get` — Retrieves the current global schema validation settings for a zone.\n- `cf schema-validation settings operations get <operationId>` — Retrieves the schema validation settings configured for a specific API operation.\n- `cf schema-validation settings operations list` — Lists all per-operation schema validation settings configured for the zone.\n\n### Create Operations\n\n- `cf schema-validation schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf schema-validation schemas edit <schemaId>` — Modifies an existing OpenAPI schema in API Shield, updating the validation rules for associated API operations. (supports --dry-run, --body)\n- `cf schema-validation settings edit` — Partially updates global schema validation settings for a zone using PATCH semantics. (supports --dry-run, --body)\n- `cf schema-validation settings operations update <operationId>` — Fully updates schema validation settings for a specific API operation. (supports --dry-run, --body)\n- `cf schema-validation settings update` — Fully updates global schema validation settings for a zone, replacing existing configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf schema-validation schemas delete <schemaId>` — Permanently removes an uploaded OpenAPI schema from API Shield. Operations using this schema will lose their validation rules. (supports --dry-run)\n- `cf schema-validation settings operations delete <operationId>` — Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults. (supports --dry-run)\n\n### Other Operations\n\n- `cf schema-validation settings operations bulk-edit` — Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"scim": "# scim — SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account\n\n## Commands\n\n### Read Operations\n\n- `cf scim groups get <groupId>` — Retrieves a single SCIM Group resource by group ID.\n- `cf scim groups list` — Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.\n- `cf scim resource-types get <resourceTypeId>` — Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.\n- `cf scim resource-types list` — Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.\n- `cf scim schemas get <schemaId>` — Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.\n- `cf scim schemas list` — Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.\n- `cf scim service-provider-config get` — Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.\n- `cf scim users get <userId>` — Retrieves a single account member as a SCIM User resource by user tag.\n- `cf scim users list` — Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq \"user@example.com\"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.\n\n### Create Operations\n\n- `cf scim groups create` — Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups). (supports --dry-run, --body)\n- `cf scim users create` — Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf scim groups edit <groupId>` — Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported. (supports --dry-run, --body)\n- `cf scim users edit <userId>` — Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq \"work\"].value` is also accepted as an alias for `userName`. (supports --dry-run, --body)\n- `cf scim users update <userId>` — Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf scim groups delete <groupId>` — Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"scm": "# scm — Source code management connections — link Git providers, browse repos, create pull requests, and manage grants\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"secrets-store": "# secrets-store — Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products\n\n## Commands\n\n### Read Operations\n\n- `cf secrets-store quota get` — Lists the number of secrets used in the account.\n- `cf secrets-store secrets get <secretId>` — Returns details of a single secret\n- `cf secrets-store secrets list` — Lists all store secrets\n- `cf secrets-store stores list` — Lists all the stores in an account\n- `cf secrets-store system-stores list` — Lists all stores in an account that are managed by the calling service. Only returns stores where managed_by matches the authenticated service.\n- `cf secrets-store system-stores secrets get <secretId>` — Returns details of a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n- `cf secrets-store system-stores secrets list` — Lists all secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n\n### Create Operations\n\n- `cf secrets-store secrets bulk create <storeId>` — Creates a secret in the account (supports --dry-run, --body)\n- `cf secrets-store stores create` — Creates a store in the account (supports --dry-run, --body)\n- `cf secrets-store system-stores create <accountTag>` — Creates a store in the account on behalf of the calling service. The store will be marked as managed by the authenticated service. Requires account_id in the request body. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets create <storeId>` — Creates one or more secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets duplicate create <secretId>` — Duplicates a secret in a store managed by the calling service, keeping the value. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf secrets-store secrets edit <secretId>` — Updates a single secret (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets edit <secretId>` — Updates a single secret in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf secrets-store secrets bulk delete <storeId>` — Deletes one or more secrets (supports --dry-run, --body)\n- `cf secrets-store secrets delete <secretId>` — Deletes a single secret (supports --dry-run)\n- `cf secrets-store stores delete <storeId>` — Deletes a single store (supports --dry-run)\n- `cf secrets-store system-stores delete <storeId>` — Deletes a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n\n### Other Operations\n\n- `cf secrets-store secrets duplicate <secretId>` — Duplicates the secret, keeping the value (supports --dry-run, --body)\n- `cf secrets-store system-stores get by id <storeId>` — Returns details of a single store (supports --dry-run)\n- `cf secrets-store system-stores get v2 <storeId>` — Returns details of a single store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete by id <secretId>` — Deletes a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete system bulk` — Deletes one or more secrets from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"security-center": "# security-center — Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-center insights class get` — Retrieves Security Center insight counts aggregated by classification class.\n- `cf security-center insights list` — Lists all Security Center insights for the account, showing security findings and recommendations.\n- `cf security-center insights severity get` — Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).\n- `cf security-center insights type get` — Retrieves Security Center insight counts aggregated by insight type.\n- `cf security-center zone-insights class get` — Retrieves zone-specific Security Center insight counts aggregated by classification class.\n- `cf security-center zone-insights context get <issueId>` — Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.\n- `cf security-center zone-insights get` — Lists Security Center insights for a specific zone, showing zone-level security findings.\n- `cf security-center zone-insights severity get` — Retrieves zone-specific Security Center insight counts aggregated by severity level.\n- `cf security-center zone-insights type get` — Retrieves zone-specific Security Center insight counts aggregated by insight type.\n\n### Update Operations\n\n- `cf security-center zone-insights dismiss update <issueId>` — Archives a zone-specific Security Center insight, removing it from the active zone insights while preserving historical data. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf security-center insights dismiss <issueId>` — Archives a Security Center insight for an account, removing it from the active insights list while preserving historical data. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"rules": "# rules — Account-level IP lists, hostname lists, and other reusable lists referenced by firewall rules and rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rules lists bulk-operations get <operation-id>` — Gets the current status of an asynchronous operation on a list. The `status` property can have one of the following values: `pending`, `running`, `completed`, or `failed`. If the status is `failed`, the `error` property will contain a message describing the error.\n- `cf rules lists get <list-id>` — Fetches the details of a list.\n- `cf rules lists items get <item-id>` — Fetches a list item in the list.\n- `cf rules lists items list` — Fetches all the items in the list.\n- `cf rules lists list` — Fetches all lists in the account.\n\n### Create Operations\n\n- `cf rules lists create` — Creates a new list of the specified kind. (supports --dry-run, --body)\n- `cf rules lists items create <list-id>` — Appends new items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rules lists items update <list-id>` — Removes all existing items from the list and adds the provided items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n- `cf rules lists update <list-id>` — Updates the description of a list. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rules lists delete <list-id>` — Deletes a specific list and all its items. (supports --dry-run)\n- `cf rules lists items delete <list-id>` — Removes one or more items from a list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"rulesets": "# rulesets — Versioned collections of rules that control how Cloudflare processes traffic — WAF, transform, redirect, and more\n\n## Commands\n\n### Read Operations\n\n- `cf rulesets account-rulesets get <ruleset-id>` — Fetches the latest version of an account ruleset.\n- `cf rulesets account-rulesets list` — Fetches all rulesets at the account level.\n- `cf rulesets account-rulesets phases get <ruleset-phase>` — Fetches the latest version of the account entry point ruleset for a given phase.\n- `cf rulesets account-rulesets phases versions get <ruleset-version>` — Fetches a specific version of an account entry point ruleset.\n- `cf rulesets account-rulesets phases versions list` — Fetches the versions of an account entry point ruleset.\n- `cf rulesets account-rulesets versions get <ruleset-version>` — Fetches a specific version of an account ruleset.\n- `cf rulesets account-rulesets versions list` — Fetches the versions of an account ruleset.\n- `cf rulesets get <ruleset-id>` — Fetches the latest version of a zone ruleset.\n- `cf rulesets list` — Fetches all rulesets at the zone level.\n- `cf rulesets phases get <ruleset-phase>` — Fetches the latest version of the zone entry point ruleset for a given phase.\n- `cf rulesets phases versions get <ruleset-version>` — Fetches a specific version of a zone entry point ruleset.\n- `cf rulesets phases versions list` — Fetches the versions of a zone entry point ruleset.\n- `cf rulesets versions get <ruleset-version>` — Fetches a specific version of a zone ruleset.\n- `cf rulesets versions list` — Fetches the versions of a zone ruleset.\n\n### Create Operations\n\n- `cf rulesets account-rulesets create` — Creates a ruleset at the account level. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules create <ruleset-id>` — Adds a new rule to an account ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n- `cf rulesets create` — Creates a ruleset at the zone level. (supports --dry-run, --body)\n- `cf rulesets rules create <ruleset-id>` — Adds a new rule to a zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rulesets account-rulesets phases update <ruleset-phase>` — Updates an account entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules update <rule-id>` — Updates an existing rule in an account ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets update <ruleset-id>` — Updates an account ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets phases update <ruleset-phase>` — Updates a zone entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets rules edit <rule-id>` — Updates an existing rule in a zone ruleset. (supports --dry-run, --body)\n- `cf rulesets update <ruleset-id>` — Updates a zone ruleset, creating a new version. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rulesets account-rulesets delete <ruleset-id>` — Deletes all versions of an existing account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets rules delete <rule-id>` — Deletes an existing rule from an account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets versions delete <ruleset-version>` — Deletes an existing version of an account ruleset. (supports --dry-run)\n- `cf rulesets delete <ruleset-id>` — Deletes all versions of an existing zone ruleset. (supports --dry-run)\n- `cf rulesets rules delete <rule-id>` — Deletes an existing rule from a zone ruleset. (supports --dry-run)\n- `cf rulesets versions delete <ruleset-version>` — Deletes an existing version of a zone ruleset. (supports --dry-run)\n\n### Other Operations\n\n- `cf rulesets account-rulesets versions by-tag tag <rule-tag>` — Fetches the rules of a managed account ruleset version for a given tag. (supports --dry-run)\n- `cf rulesets account-rulesets versions zone-by-tag tag <rule-tag>` — Fetches the rules of a managed zone ruleset version for a given tag. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"rum": "# rum — Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics\n\n## Commands\n\n### Read Operations\n\n- `cf rum rules list` — Lists all the rules in a Web Analytics ruleset.\n- `cf rum site-info get <site-id>` — Retrieves a Web Analytics site.\n- `cf rum site-info list` — Lists all Web Analytics sites of an account.\n\n### Create Operations\n\n- `cf rum rules create <ruleset-id>` — Creates a new rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info create` — Creates a new Web Analytics site. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rum rules update <rule-id>` — Updates a rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info update <site-id>` — Updates an existing Web Analytics site. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rum rules delete <rule-id>` — Deletes an existing rule from a Web Analytics ruleset. (supports --dry-run)\n- `cf rum site-info delete <site-id>` — Deletes an existing Web Analytics site. (supports --dry-run)\n\n### Other Operations\n\n- `cf rum rules bulk-create` — Modifies one or more rules in a Web Analytics ruleset with a single request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"schema-validation": "# schema-validation — API schema validation settings — enforce request/response schemas and configure validation behavior\n\n## Commands\n\n### Read Operations\n\n- `cf schema-validation schemas get <schema-id>` — Gets the contents and metadata of a specific OpenAPI schema uploaded to API Shield.\n- `cf schema-validation schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone.\n- `cf schema-validation schemas list` — Lists all OpenAPI schemas uploaded to API Shield with pagination support.\n- `cf schema-validation schemas operations get <schema-id>` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n- `cf schema-validation settings get` — Retrieves the current global schema validation settings for a zone.\n- `cf schema-validation settings operations get <operation-id>` — Retrieves the schema validation settings configured for a specific API operation.\n- `cf schema-validation settings operations list` — Lists all per-operation schema validation settings configured for the zone.\n\n### Create Operations\n\n- `cf schema-validation schemas create` — Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf schema-validation schemas edit <schema-id>` — Modifies an existing OpenAPI schema in API Shield, updating the validation rules for associated API operations. (supports --dry-run, --body)\n- `cf schema-validation settings edit` — Partially updates global schema validation settings for a zone using PATCH semantics. (supports --dry-run, --body)\n- `cf schema-validation settings operations update <operation-id>` — Fully updates schema validation settings for a specific API operation. (supports --dry-run, --body)\n- `cf schema-validation settings update` — Fully updates global schema validation settings for a zone, replacing existing configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf schema-validation schemas delete <schema-id>` — Permanently removes an uploaded OpenAPI schema from API Shield. Operations using this schema will lose their validation rules. (supports --dry-run)\n- `cf schema-validation settings operations delete <operation-id>` — Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults. (supports --dry-run)\n\n### Other Operations\n\n- `cf schema-validation settings operations bulk-edit` — Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"scim": "# scim — SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account\n\n## Commands\n\n### Read Operations\n\n- `cf scim groups get <group-id>` — Retrieves a single SCIM Group resource by group ID.\n- `cf scim groups list` — Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.\n- `cf scim resource-types get <resource-type-id>` — Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.\n- `cf scim resource-types list` — Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.\n- `cf scim schemas get <schema-id>` — Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.\n- `cf scim schemas list` — Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.\n- `cf scim service-provider-config get` — Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.\n- `cf scim users get <user-id>` — Retrieves a single account member as a SCIM User resource by user tag.\n- `cf scim users list` — Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq \"user@example.com\"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.\n\n### Create Operations\n\n- `cf scim groups create` — Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups). (supports --dry-run, --body)\n- `cf scim users create` — Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf scim groups edit <group-id>` — Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported. (supports --dry-run, --body)\n- `cf scim users edit <user-id>` — Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq \"work\"].value` is also accepted as an alias for `userName`. (supports --dry-run, --body)\n- `cf scim users update <user-id>` — Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf scim groups delete <group-id>` — Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"secrets-store": "# secrets-store — Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products\n\n## Commands\n\n### Read Operations\n\n- `cf secrets-store quota get` — Lists the number of secrets used in the account.\n- `cf secrets-store secrets get <secret-id>` — Returns details of a single secret\n- `cf secrets-store secrets list` — Lists all store secrets\n- `cf secrets-store stores list` — Lists all the stores in an account\n- `cf secrets-store system-stores list` — Lists all stores in an account that are managed by the calling service. Only returns stores where managed_by matches the authenticated service.\n- `cf secrets-store system-stores secrets get <secret-id>` — Returns details of a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n- `cf secrets-store system-stores secrets list` — Lists all secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service.\n\n### Create Operations\n\n- `cf secrets-store secrets bulk create <store-id>` — Creates a secret in the account (supports --dry-run, --body)\n- `cf secrets-store stores create` — Creates a store in the account (supports --dry-run, --body)\n- `cf secrets-store system-stores create <account-tag>` — Creates a store in the account on behalf of the calling service. The store will be marked as managed by the authenticated service. Requires account_id in the request body. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets create <store-id>` — Creates one or more secrets in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets duplicate create <secret-id>` — Duplicates a secret in a store managed by the calling service, keeping the value. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf secrets-store secrets edit <secret-id>` — Updates a single secret (supports --dry-run, --body)\n- `cf secrets-store system-stores secrets edit <secret-id>` — Updates a single secret in a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf secrets-store secrets bulk delete <store-id>` — Deletes one or more secrets (supports --dry-run, --body)\n- `cf secrets-store secrets delete <secret-id>` — Deletes a single secret (supports --dry-run)\n- `cf secrets-store stores delete <store-id>` — Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the \"store_not_empty\" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter. (supports --dry-run)\n- `cf secrets-store system-stores delete <store-id>` — Deletes a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the \"store_not_empty\" error. Pass `force=true` to cascade-delete all secrets in the store. (supports --dry-run)\n\n### Other Operations\n\n- `cf secrets-store secrets duplicate <secret-id>` — Duplicates the secret, keeping the value (supports --dry-run, --body)\n- `cf secrets-store system-stores get by id <store-id>` — Returns details of a single store (supports --dry-run)\n- `cf secrets-store system-stores get v2 <store-id>` — Returns details of a single store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete by id <secret-id>` — Deletes a single secret from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run)\n- `cf secrets-store system-stores secrets delete system bulk` — Deletes one or more secrets from a store managed by the calling service. Returns 404 if the store doesn't exist or is not managed by the authenticated service. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"security-center": "# security-center — Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-center insights class get` — Retrieves Security Center insight counts aggregated by classification class.\n- `cf security-center insights list` — Lists all Security Center insights for the account, showing security findings and recommendations.\n- `cf security-center insights severity get` — Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).\n- `cf security-center insights type get` — Retrieves Security Center insight counts aggregated by insight type.\n- `cf security-center zone-insights class get` — Retrieves zone-specific Security Center insight counts aggregated by classification class.\n- `cf security-center zone-insights context get <issue-id>` — Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.\n- `cf security-center zone-insights get` — Lists Security Center insights for a specific zone, showing zone-level security findings.\n- `cf security-center zone-insights severity get` — Retrieves zone-specific Security Center insight counts aggregated by severity level.\n- `cf security-center zone-insights type get` — Retrieves zone-specific Security Center insight counts aggregated by insight type.\n\n### Update Operations\n\n- `cf security-center zone-insights dismiss update <issue-id>` — Archives a zone-specific Security Center insight, removing it from the active zone insights while preserving historical data. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf security-center insights dismiss <issue-id>` — Archives a Security Center insight for an account, removing it from the active insights list while preserving historical data. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"security-txt": "# security-txt — Manage the /.well-known/security.txt file that tells security researchers how to report vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-txt get` — Retrieves the current security.txt file configuration for a zone, used for security vulnerability reporting.\n\n### Update Operations\n\n- `cf security-txt update` — Updates the security.txt file configuration for a zone, which provides security researchers with vulnerability reporting information. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf security-txt delete` — Removes the security.txt file configuration for a zone. The /.well-known/security.txt endpoint will no longer be served. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"smart-shield": "# smart-shield — Smart Shield settings, health checks, and cache reserve management\n\n## Commands\n\n### Read Operations\n\n- `cf smart-shield cache-reserve-clear status` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.\n- `cf smart-shield get` — Retrieve Smart Shield Settings.\n- `cf smart-shield health-checks get <healthcheckId>` — Fetch a single configured health check.\n- `cf smart-shield health-checks list` — List configured health checks.\n\n### Create Operations\n\n- `cf smart-shield health-checks create` — Create a new health check. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf smart-shield health-checks edit <healthcheckId>` — Patch a configured health check. (supports --dry-run, --body)\n- `cf smart-shield health-checks update <healthcheckId>` — Update a configured health check. (supports --dry-run, --body)\n- `cf smart-shield update` — Set Smart Shield Settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf smart-shield health-checks delete <healthcheckId>` — Delete a health check. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf smart-shield cache-reserve-clear clear` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"snippets": "# snippets — Lightweight JavaScript snippets that run on requests before Workers — for quick header modifications and redirects\n\n## Commands\n\n### Read Operations\n\n- `cf snippets content get <snippetName>` — Fetches the content of a snippet belonging to the zone.\n- `cf snippets get <snippetName>` — Fetches a snippet belonging to the zone.\n- `cf snippets list` — Fetches all snippets belonging to the zone.\n- `cf snippets rules list` — Fetches all snippet rules belonging to the zone.\n\n### Update Operations\n\n- `cf snippets rules update` — Updates all snippet rules belonging to the zone. (supports --dry-run, --body)\n- `cf snippets update <snippetName>` — Creates or updates a snippet belonging to the zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf snippets delete <snippetName>` — Deletes a snippet belonging to the zone. (supports --dry-run)\n- `cf snippets rules delete` — Deletes all snippet rules belonging to the zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"spectrum": "# spectrum — Proxy and protect arbitrary TCP/UDP applications through Cloudflare's network with DDoS mitigation\n\n## Commands\n\n### Read Operations\n\n- `cf spectrum analytics aggregates currents get` — Retrieves analytics aggregated from the last minute of usage on Spectrum applications underneath a given zone.\n- `cf spectrum analytics events bytimes get` — Retrieves a list of aggregate metrics grouped by time interval.\n- `cf spectrum analytics events summaries get` — Retrieves a list of summarised aggregate metrics over a given time period.\n- `cf spectrum apps get <appId>` — Gets the application configuration of a specific application inside a zone.\n- `cf spectrum apps list` — Retrieves a list of currently existing Spectrum applications inside a zone.\n\n### Create Operations\n\n- `cf spectrum apps create` — Creates a new Spectrum application from a configuration using a name for the origin. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf spectrum apps update <appId>` — Updates a previously existing application's configuration that uses a name for the origin. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf spectrum apps delete <appId>` — Deletes a previously existing application. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"speed": "# speed — Observatory speed tests — run Lighthouse audits, track performance trends, and schedule recurring tests\n\n## Commands\n\n### Read Operations\n\n- `cf speed availabilities list` — Retrieves quota for all plans, as well as the current zone quota.\n- `cf speed pages list` — Lists all webpages which have been tested.\n- `cf speed pages tests get <testId>` — Retrieves the result of a specific test.\n- `cf speed pages tests list` — Test history (list of tests) for a specific webpage.\n- `cf speed schedule get <url>` — Retrieves the test schedule for a page in a specific region.\n\n### Create Operations\n\n- `cf speed pages tests create <url>` — Starts a test for a specific webpage, in a specific region. (supports --dry-run, --body)\n- `cf speed schedule create <url>` — Creates a scheduled test for a page. (supports --dry-run)\n\n### Delete Operations\n\n- `cf speed pages tests delete <url>` — Deletes all tests for a specific webpage from a specific region. Deleted tests are still counted as part of the quota. (supports --dry-run)\n- `cf speed schedule delete <url>` — Deletes a scheduled test for a page. (supports --dry-run)\n\n### Other Operations\n\n- `cf speed pages trend <url>` — Lists the core web vital metrics trend over time for a specific page. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"ssl": "# ssl — SSL/TLS certificate management — certificate packs, Universal SSL, verification, and TLS mode recommendations\n\n## Commands\n\n### Read Operations\n\n- `cf ssl automatic-upgrader get` — If the system is enabled, the response will include next_scheduled_scan, representing the next time this zone will be scanned and the zone's ssl/tls encryption mode is potentially upgraded by the system. If the system is disabled, next_scheduled_scan will not be present in the response body.\n- `cf ssl certificate-packs get <certificatePackId>` — For a given zone, get a certificate pack.\n- `cf ssl certificate-packs list` — For a given zone, list all active certificate packs.\n- `cf ssl certificate-packs quota get` — For a given zone, list certificate pack quotas.\n- `cf ssl recommendations get` — Retrieve the SSL/TLS Recommender's recommendation for a zone.\n- `cf ssl universal settings get` — Get Universal SSL Settings for a Zone.\n- `cf ssl verification get` — Get SSL Verification Info for a Zone.\n\n### Create Operations\n\n- `cf ssl analyze create` — Returns the set of hostnames, the signature algorithm, and the expiration date of the certificate. (supports --dry-run, --body)\n- `cf ssl certificate-packs create` — For a given zone, order an advanced certificate pack. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ssl automatic-upgrader patch` — The automatic system is enabled when this endpoint is hit with value in the request body is set to \"auto\", and disabled when the request body value is set to \"custom\". (supports --dry-run, --body)\n- `cf ssl certificate-packs edit <certificatePackId>` — For a given zone, restart validation or add cloudflare branding for an advanced certificate pack. The former is only a validation operation for a Certificate Pack in a validation_timed_out status. (supports --dry-run, --body)\n- `cf ssl universal settings edit` — Patch Universal SSL Settings for a Zone. (supports --dry-run, --body)\n- `cf ssl verification edit <certificatePackId>` — Edit SSL validation method for a certificate pack. A PATCH request will request an immediate validation check on any certificate, and return the updated status. If a validation method is provided, the validation will be immediately attempted using that method. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ssl certificate-packs delete <certificatePackId>` — For a given zone, delete an advanced certificate pack. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"stream": "# stream — Video encoding, storage, and delivery — upload, live-stream, clip, caption, and embed video at scale\n\n## Commands\n\n### Read Operations\n\n- `cf stream audio-tracks get <identifier>` — Lists additional audio tracks on a video. Note this API will not return information for audio attached to the video upload.\n- `cf stream captions get <identifier>` — Lists the available captions or subtitles for a specific video.\n- `cf stream captions language get <language>` — Lists the captions or subtitles for provided language.\n- `cf stream captions language vtt get <language>` — Return WebVTT captions for a provided language.\n- `cf stream downloads get <identifier>` — Lists the downloads created for a video.\n- `cf stream embed get <identifier>` — Fetches an HTML code snippet to embed a video in a web page delivered through Cloudflare. On success, returns an HTML fragment for use on web pages to display a video. On failure, returns a JSON response body.\n- `cf stream get <identifier>` — Fetches details for a single video.\n- `cf stream keys get` — Lists the video ID and creation date and time when a signing key was created.\n- `cf stream list` — Lists up to 1000 videos from a single request. For a specific range, refer to the optional parameters.\n- `cf stream live-inputs get <liveInputIdentifier>` — Retrieves details of an existing live input.\n- `cf stream live-inputs list` — Lists the live inputs created for an account. To get the credentials needed to stream to a specific live input, request a single live input.\n- `cf stream live-inputs outputs list` — Retrieves all outputs associated with a specified live input.\n- `cf stream watermarks get <identifier>` — Retrieves details for a single watermark profile.\n- `cf stream watermarks list` — Lists all watermark profiles for an account.\n- `cf stream webhooks get` — Retrieves a list of webhooks.\n\n### Create Operations\n\n- `cf stream captions language create <language>` — Generate captions or subtitles for provided language via AI. (supports --dry-run)\n- `cf stream clip create` — Clips a video based on the specified start and end times provided in seconds. (supports --dry-run, --body)\n- `cf stream copy create` — Uploads a video to Stream from a provided URL. (supports --dry-run, --body)\n- `cf stream create` — Initiates a video upload using the TUS protocol. On success, the server responds with a status code 201 (created) and includes a `location` header to indicate where the content should be uploaded. Refer to https://tus.io for protocol details. (supports --dry-run)\n- `cf stream direct-upload create` — Creates a direct upload that allows video uploads without an API key. (supports --dry-run, --body)\n- `cf stream downloads create <identifier>` — Creates a download for a video when a video is ready to view. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys create` — Creates an RSA private key in PEM and JWK formats. Key files are only displayed once after creation. Keys are created, used, and deleted independently of videos, and every key can sign any video. (supports --dry-run, --body)\n- `cf stream live-inputs create` — Creates a live input, and returns credentials that you or your users can use to stream live video to Cloudflare Stream. (supports --dry-run, --body)\n- `cf stream live-inputs disable create <liveInputIdentifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls until enabled. (supports --dry-run)\n- `cf stream live-inputs enable create <liveInputIdentifier>` — Allows a live input to be streamed to and makes the live input accessible to any future API calls. (supports --dry-run)\n- `cf stream live-inputs outputs create <liveInputIdentifier>` — Creates a new output that can be used to simulcast or restream live video to other RTMP or SRT destinations. Outputs are always linked to a specific live input — one live input can have many outputs. (supports --dry-run, --body)\n- `cf stream token create <identifier>` — Creates a signed URL token for a video. If a body is not provided in the request, a token is created with default values. (supports --dry-run, --body)\n- `cf stream typed-downloads create <downloadType>` — Creates a download for a video of specified type. For backwards-compatibility, POST requests to /downloads will enable the default download. (supports --dry-run)\n- `cf stream watermarks create` — Creates watermark profiles using a single `HTTP POST multipart/form-data` request. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf stream audio-tracks edit <audioIdentifier>` — Edits additional audio tracks on a video. Editing the default status of an audio track to `true` will mark all other audio tracks on the video default status to `false`. (supports --dry-run, --body)\n- `cf stream captions language update <language>` — Uploads the caption or subtitle file to the endpoint for a specific BCP47 language. One caption or subtitle file per language is allowed. (supports --dry-run, --body)\n- `cf stream edit <identifier>` — Edit details for a single video. (supports --dry-run, --body)\n- `cf stream live-inputs outputs update <outputIdentifier>` — Updates the state of an output. (supports --dry-run, --body)\n- `cf stream live-inputs update <liveInputIdentifier>` — Updates a specified live input. (supports --dry-run, --body)\n- `cf stream webhooks update` — Creates a webhook notification. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf stream audio-tracks delete <audioIdentifier>` — Deletes additional audio tracks on a video. Deleting a default audio track is not allowed. You must assign another audio track as default prior to deletion. (supports --dry-run)\n- `cf stream captions language delete <language>` — Removes the captions or subtitles from a video. (supports --dry-run)\n- `cf stream delete <identifier>` — Deletes a video and its copies from Cloudflare Stream. (supports --dry-run)\n- `cf stream downloads delete <identifier>` — Delete the downloads for a video. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys delete <identifier>` — Deletes signing keys and revokes all signed URLs generated with the key. (supports --dry-run, --body)\n- `cf stream live-inputs delete <liveInputIdentifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls. (supports --dry-run, --body)\n- `cf stream live-inputs outputs delete <outputIdentifier>` — Deletes an output and removes it from the associated live input. (supports --dry-run, --body)\n- `cf stream typed-downloads delete <downloadType>` — Delete specific type of download. For backwards-compatibility, DELETE requests to /downloads will delete the default download. (supports --dry-run)\n- `cf stream watermarks delete <identifier>` — Deletes a watermark profile. (supports --dry-run)\n- `cf stream webhooks delete` — Deletes a webhook. (supports --dry-run)\n\n### Other Operations\n\n- `cf stream audio-tracks copy <identifier>` — Adds an additional audio track to a video using the provided audio track URL. (supports --dry-run, --body)\n- `cf stream videos storage-usage` — Returns information about an account's storage use. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"tenants": "# tenants — Multi-tenant account management — manage tenant accounts, entitlements, and memberships\n\n## Commands\n\n### Read Operations\n\n- `cf tenants account-types get <tenantId>` — List of account types available for the Tenant to provision accounts.\n- `cf tenants accounts list` — List of accounts for the Tenant.\n- `cf tenants entitlements list` — List of innate entitlements available for the Tenant.\n- `cf tenants get <tenantId>` — Retrieves a Tenant by Tenant ID.\n- `cf tenants memberships list` — List of active members (Cloudflare users) for the Tenant.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"token-validation": "# token-validation — Validate JWT tokens at the edge — configure token sources, signing keys, and validation rules\n\n## Commands\n\n### Read Operations\n\n- `cf token-validation configuration get <configId>` — Get a single Token Configuration\n- `cf token-validation configuration list` — Lists all token validation configurations for this zone\n- `cf token-validation rules get <ruleId>` — Get a zone token validation rule.\n- `cf token-validation rules list` — List token validation rules\n\n### Create Operations\n\n- `cf token-validation configuration create` — Create a new Token Validation configuration (supports --dry-run, --body)\n- `cf token-validation rules create` — Create a token validation rule. (supports --dry-run, --body)\n- `cf token-validation rules preview create` — Preview operations covered by a Token Validation rule. The API will return all operations on a zone annotated with an additional `state` field. Operations with an `included` `state` will be covered by a Token Validation Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf token-validation configuration credentials update <configId>` — Update Token Configuration credentials (supports --dry-run, --body)\n- `cf token-validation configuration edit <configId>` — Edit fields of an existing Token Configuration (supports --dry-run, --body)\n- `cf token-validation rules edit <ruleId>` — Edit a zone token validation rule. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf token-validation configuration delete <configId>` — Delete Token Configuration (supports --dry-run)\n- `cf token-validation rules delete <ruleId>` — Delete a zone token validation rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf token-validation rules bulk-create` — Create zone token validation rules. A request can create multiple Token Validation Rules. (supports --dry-run, --body)\n- `cf token-validation rules bulk-edit` — Edit token validation rules. A request can update multiple Token Validation Rules. Rules can be re-ordered using the `position` field. Returns all updated rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"smart-shield": "# smart-shield — Smart Shield settings, health checks, and cache reserve management\n\n## Commands\n\n### Read Operations\n\n- `cf smart-shield cache-reserve-clear status` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.\n- `cf smart-shield get` — Retrieve Smart Shield Settings.\n- `cf smart-shield health-checks get <healthcheck-id>` — Fetch a single configured health check.\n- `cf smart-shield health-checks list` — List configured health checks.\n\n### Create Operations\n\n- `cf smart-shield health-checks create` — Create a new health check. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf smart-shield health-checks edit <healthcheck-id>` — Patch a configured health check. (supports --dry-run, --body)\n- `cf smart-shield health-checks update <healthcheck-id>` — Update a configured health check. (supports --dry-run, --body)\n- `cf smart-shield update` — Set Smart Shield Settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf smart-shield health-checks delete <healthcheck-id>` — Delete a health check. (supports --dry-run)\n\n### Other Operations\n\n- `cf smart-shield cache-reserve-clear clear` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"snippets": "# snippets — Lightweight JavaScript snippets that run on requests before Workers — for quick header modifications and redirects\n\n## Commands\n\n### Read Operations\n\n- `cf snippets content get <snippet-name>` — Fetches the content of a snippet belonging to the zone.\n- `cf snippets get <snippet-name>` — Fetches a snippet belonging to the zone.\n- `cf snippets list` — Fetches all snippets belonging to the zone.\n- `cf snippets rules list` — Fetches all snippet rules belonging to the zone.\n\n### Update Operations\n\n- `cf snippets rules update` — Updates all snippet rules belonging to the zone. (supports --dry-run, --body)\n- `cf snippets update <snippet-name>` — Creates or updates a snippet belonging to the zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf snippets delete <snippet-name>` — Deletes a snippet belonging to the zone. (supports --dry-run)\n- `cf snippets rules delete` — Deletes all snippet rules belonging to the zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"spectrum": "# spectrum — Proxy and protect arbitrary TCP/UDP applications through Cloudflare's network with DDoS mitigation\n\n## Commands\n\n### Read Operations\n\n- `cf spectrum analytics aggregates currents get` — Retrieves analytics aggregated from the last minute of usage on Spectrum applications underneath a given zone.\n- `cf spectrum analytics events bytimes get` — Retrieves a list of aggregate metrics grouped by time interval.\n- `cf spectrum analytics events summaries get` — Retrieves a list of summarised aggregate metrics over a given time period.\n- `cf spectrum apps get <app-id>` — Gets the application configuration of a specific application inside a zone.\n- `cf spectrum apps list` — Retrieves a list of currently existing Spectrum applications inside a zone.\n\n### Create Operations\n\n- `cf spectrum apps create` — Creates a new Spectrum application from a configuration using a name for the origin. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf spectrum apps update <app-id>` — Updates a previously existing application's configuration that uses a name for the origin. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf spectrum apps delete <app-id>` — Deletes a previously existing application. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"speed": "# speed — Observatory speed tests — run Lighthouse audits, track performance trends, and schedule recurring tests\n\n## Commands\n\n### Read Operations\n\n- `cf speed availabilities list` — Retrieves quota for all plans, as well as the current zone quota.\n- `cf speed pages list` — Lists all webpages which have been tested.\n- `cf speed pages tests get <test-id>` — Retrieves the result of a specific test.\n- `cf speed pages tests list` — Test history (list of tests) for a specific webpage.\n- `cf speed schedule get <url>` — Retrieves the test schedule for a page in a specific region.\n\n### Create Operations\n\n- `cf speed pages tests create <url>` — Starts a test for a specific webpage, in a specific region. (supports --dry-run, --body)\n- `cf speed schedule create <url>` — Creates a scheduled test for a page. (supports --dry-run)\n\n### Delete Operations\n\n- `cf speed pages tests delete <url>` — Deletes all tests for a specific webpage from a specific region. Deleted tests are still counted as part of the quota. (supports --dry-run)\n- `cf speed schedule delete <url>` — Deletes a scheduled test for a page. (supports --dry-run)\n\n### Other Operations\n\n- `cf speed pages trend <url>` — Lists the core web vital metrics trend over time for a specific page. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"ssl": "# ssl — SSL/TLS certificate management — certificate packs, Universal SSL, verification, and TLS mode recommendations\n\n## Commands\n\n### Read Operations\n\n- `cf ssl automatic-upgrader get` — If the system is enabled, the response will include next_scheduled_scan, representing the next time this zone will be scanned and the zone's ssl/tls encryption mode is potentially upgraded by the system. If the system is disabled, next_scheduled_scan will not be present in the response body.\n- `cf ssl certificate-packs get <certificate-pack-id>` — For a given zone, get a certificate pack.\n- `cf ssl certificate-packs list` — For a given zone, list all active certificate packs.\n- `cf ssl certificate-packs quota get` — For a given zone, list certificate pack quotas.\n- `cf ssl universal settings get` — Get Universal SSL Settings for a Zone.\n- `cf ssl verification get` — Get SSL Verification Info for a Zone.\n\n### Create Operations\n\n- `cf ssl analyze create` — Returns the set of hostnames, the signature algorithm, and the expiration date of the certificate. (supports --dry-run, --body)\n- `cf ssl certificate-packs create` — For a given zone, order an advanced certificate pack. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ssl automatic-upgrader patch` — The automatic system is enabled when this endpoint is hit with value in the request body is set to \"auto\", and disabled when the request body value is set to \"custom\". (supports --dry-run, --body)\n- `cf ssl certificate-packs edit <certificate-pack-id>` — For a given zone, restart validation or add cloudflare branding for an advanced certificate pack. The former is only a validation operation for a Certificate Pack in a validation_timed_out status. (supports --dry-run, --body)\n- `cf ssl universal settings edit` — Patch Universal SSL Settings for a Zone. (supports --dry-run, --body)\n- `cf ssl verification edit <certificate-pack-id>` — Edit SSL validation method for a certificate pack. A PATCH request will request an immediate validation check on any certificate, and return the updated status. If a validation method is provided, the validation will be immediately attempted using that method. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ssl certificate-packs delete <certificate-pack-id>` — For a given zone, delete an advanced certificate pack. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"stream": "# stream — Video encoding, storage, and delivery — upload, live-stream, clip, caption, and embed video at scale\n\n## Commands\n\n### Read Operations\n\n- `cf stream audio-tracks get <identifier>` — Lists additional audio tracks on a video. Note this API will not return information for audio attached to the video upload.\n- `cf stream captions get <identifier>` — Lists the available captions or subtitles for a specific video.\n- `cf stream captions language get <language>` — Lists the captions or subtitles for provided language.\n- `cf stream captions language vtt get <language>` — Return WebVTT captions for a provided language.\n- `cf stream downloads get <identifier>` — Lists the downloads created for a video.\n- `cf stream embed get <identifier>` — Fetches an HTML code snippet to embed a video in a web page delivered through Cloudflare. On success, returns an HTML fragment for use on web pages to display a video. On failure, returns a JSON response body.\n- `cf stream get <identifier>` — Fetches details for a single video.\n- `cf stream keys get` — Lists the video ID and creation date and time when a signing key was created.\n- `cf stream list` — Lists up to 1000 videos from a single request. For a specific range, refer to the optional parameters.\n- `cf stream live-inputs get <live-input-identifier>` — Retrieves details of an existing live input.\n- `cf stream live-inputs list` — Lists the live inputs created for an account. To get the credentials needed to stream to a specific live input, request a single live input.\n- `cf stream live-inputs outputs list` — Retrieves all outputs associated with a specified live input.\n- `cf stream watermarks get <identifier>` — Retrieves details for a single watermark profile.\n- `cf stream watermarks list` — Lists all watermark profiles for an account.\n- `cf stream webhooks get` — Retrieves a list of webhooks.\n\n### Create Operations\n\n- `cf stream captions language create <language>` — Generate captions or subtitles for provided language via AI. (supports --dry-run)\n- `cf stream clip create` — Clips a video based on the specified start and end times provided in seconds. (supports --dry-run, --body)\n- `cf stream copy create` — Uploads a video to Stream from a provided URL. (supports --dry-run, --body)\n- `cf stream create` — Initiates a video upload using the TUS protocol. On success, the server responds with a status code 201 (created) and includes a `location` header to indicate where the content should be uploaded. Refer to https://tus.io for protocol details. (supports --dry-run)\n- `cf stream direct-upload create` — Creates a direct upload that allows video uploads without an API key. (supports --dry-run, --body)\n- `cf stream downloads create <identifier>` — Creates a download for a video when a video is ready to view. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys create` — Creates an RSA private key in PEM and JWK formats. Key files are only displayed once after creation. Keys are created, used, and deleted independently of videos, and every key can sign any video. (supports --dry-run)\n- `cf stream live-inputs create` — Creates a live input, and returns credentials that you or your users can use to stream live video to Cloudflare Stream. (supports --dry-run, --body)\n- `cf stream live-inputs disable create <live-input-identifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls until enabled. (supports --dry-run)\n- `cf stream live-inputs enable create <live-input-identifier>` — Allows a live input to be streamed to and makes the live input accessible to any future API calls. (supports --dry-run)\n- `cf stream live-inputs outputs create <live-input-identifier>` — Creates a new output that can be used to simulcast or restream live video to other RTMP or SRT destinations. Outputs are always linked to a specific live input — one live input can have many outputs. (supports --dry-run, --body)\n- `cf stream token create <identifier>` — Creates a signed URL token for a video. If a body is not provided in the request, a token is created with default values. (supports --dry-run, --body)\n- `cf stream typed-downloads create <download-type>` — Creates a download for a video of specified type. For backwards-compatibility, POST requests to /downloads will enable the default download. (supports --dry-run)\n- `cf stream watermarks create` — Creates watermark profiles using a single `HTTP POST multipart/form-data` request. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf stream audio-tracks edit <audio-identifier>` — Edits additional audio tracks on a video. Editing the default status of an audio track to `true` will mark all other audio tracks on the video default status to `false`. (supports --dry-run, --body)\n- `cf stream captions language update <language>` — Uploads the caption or subtitle file to the endpoint for a specific BCP47 language. One caption or subtitle file per language is allowed. (supports --dry-run, --body)\n- `cf stream edit <identifier>` — Edit details for a single video. (supports --dry-run, --body)\n- `cf stream live-inputs outputs update <output-identifier>` — Updates the state of an output. (supports --dry-run, --body)\n- `cf stream live-inputs rotate update <live-input-identifier>` — Rotates the credentials for a live input without changing its identifier. Old credentials are revoked, broadcasts using stale credentials are automatically disconnected shortly after rotation, and the response returns refreshed credentials. (supports --dry-run)\n- `cf stream live-inputs update <live-input-identifier>` — Updates a specified live input. (supports --dry-run, --body)\n- `cf stream webhooks update` — Creates a webhook notification. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf stream audio-tracks delete <audio-identifier>` — Deletes additional audio tracks on a video. Deleting a default audio track is not allowed. You must assign another audio track as default prior to deletion. (supports --dry-run)\n- `cf stream captions language delete <language>` — Removes the captions or subtitles from a video. (supports --dry-run)\n- `cf stream delete <identifier>` — Deletes a video and its copies from Cloudflare Stream. (supports --dry-run)\n- `cf stream downloads delete <identifier>` — Delete the downloads for a video. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`. (supports --dry-run)\n- `cf stream keys delete <identifier>` — Deletes signing keys and revokes all signed URLs generated with the key. (supports --dry-run)\n- `cf stream live-inputs delete <live-input-identifier>` — Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls. (supports --dry-run)\n- `cf stream live-inputs outputs delete <output-identifier>` — Deletes an output and removes it from the associated live input. (supports --dry-run)\n- `cf stream typed-downloads delete <download-type>` — Delete specific type of download. For backwards-compatibility, DELETE requests to /downloads will delete the default download. (supports --dry-run)\n- `cf stream watermarks delete <identifier>` — Deletes a watermark profile. (supports --dry-run)\n- `cf stream webhooks delete` — Deletes a webhook. (supports --dry-run)\n\n### Other Operations\n\n- `cf stream audio-tracks copy <identifier>` — Adds an additional audio track to a video using the provided audio track URL. (supports --dry-run, --body)\n- `cf stream videos storage-usage` — Returns information about an account's storage use. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"tenants": "# tenants — Multi-tenant account management — manage tenant accounts, entitlements, and memberships\n\n## Commands\n\n### Read Operations\n\n- `cf tenants account-types get <tenant-id>` — List of account types available for the Tenant to provision accounts.\n- `cf tenants accounts list` — List of accounts for the Tenant.\n- `cf tenants entitlements list` — List of innate entitlements available for the Tenant.\n- `cf tenants get <tenant-id>` — Retrieves a Tenant by Tenant ID.\n- `cf tenants memberships list` — List of active members (Cloudflare users) for the Tenant.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"token-validation": "# token-validation — Validate JWT tokens at the edge — configure token sources, signing keys, and validation rules\n\n## Commands\n\n### Read Operations\n\n- `cf token-validation configuration get <config-id>` — Get a single Token Configuration\n- `cf token-validation configuration list` — Lists all token validation configurations for this zone\n- `cf token-validation rules get <rule-id>` — Get a zone token validation rule.\n- `cf token-validation rules list` — List token validation rules\n\n### Create Operations\n\n- `cf token-validation configuration create` — Create a new Token Validation configuration (supports --dry-run, --body)\n- `cf token-validation rules create` — Create a token validation rule. (supports --dry-run, --body)\n- `cf token-validation rules preview create` — Preview operations covered by a Token Validation rule. The API will return all operations on a zone annotated with an additional `state` field. Operations with an `included` `state` will be covered by a Token Validation Rule. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf token-validation configuration credentials update <config-id>` — Update Token Configuration credentials (supports --dry-run, --body)\n- `cf token-validation configuration edit <config-id>` — Edit fields of an existing Token Configuration (supports --dry-run, --body)\n- `cf token-validation rules edit <rule-id>` — Edit a zone token validation rule. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf token-validation configuration delete <config-id>` — Delete Token Configuration (supports --dry-run)\n- `cf token-validation rules delete <rule-id>` — Delete a zone token validation rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf token-validation rules bulk-create` — Create zone token validation rules. A request can create multiple Token Validation Rules. (supports --dry-run, --body)\n- `cf token-validation rules bulk-edit` — Edit token validation rules. A request can update multiple Token Validation Rules. Rules can be re-ordered using the `position` field. Returns all updated rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"turnstile": "# turnstile — CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience\n\n## Commands\n\n### Read Operations\n\n- `cf turnstile widgets get <sitekey>` — Show a single challenge widget configuration.\n- `cf turnstile widgets list` — Lists all turnstile widgets of an account.\n\n### Create Operations\n\n- `cf turnstile widgets create` — Lists challenge widgets. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf turnstile widgets update <sitekey>` — Update the configuration of a widget. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf turnstile widgets delete <sitekey>` — Destroy a Turnstile Widget. (supports --dry-run)\n\n### Other Operations\n\n- `cf turnstile widgets rotate-secret <sitekey>` — Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-normalization": "# url-normalization — Normalize incoming request URLs to a consistent format before rule evaluation and caching\n\n## Commands\n\n### Read Operations\n\n- `cf url-normalization get` — Fetches the current URL Normalization settings.\n\n### Update Operations\n\n- `cf url-normalization update` — Updates the URL Normalization settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf url-normalization delete` — Deletes the URL Normalization settings. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"url-scanner": "# url-scanner — Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results\n\n## Commands\n\n### Read Operations\n\n- `cf url-scanner responses get <responseId>` — Returns the raw response of the network request. Find the `response_id` in the `data.requests.response.hash`.\n- `cf url-scanner scans get <scanId>` — Get URL scan by uuid\n- `cf url-scanner scans list` — Use a subset of ElasticSearch Query syntax to filter scans. Some example queries:<br/> <br/>- 'path:\"/bundles/jquery.js\"': Searches for scans who requested resources with the given path.<br/>- 'page.asn:AS24940 AND hash:xxx': Websites hosted in AS24940 where a resource with the given hash was downloaded.<br/>- 'page.domain:microsoft* AND verdicts.malicious:true AND NOT page.domain:microsoft.com': malicious scans whose hostname starts with \"microsoft\".<br/>- 'apikey:me AND date:[2025-01 TO 2025-02]': my scans from 2025 January to 2025 February.\n\n### Create Operations\n\n- `cf url-scanner scans create` — Submit a URL to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf url-scanner scans bulk-create` — Submit URLs to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/ and take into account scans submitted in bulk have lower priority and may take longer to finish. (supports --dry-run, --body)\n- `cf url-scanner scans dom <scanId>` — Returns a plain text response, with the scan's DOM content as rendered by Chrome. (supports --dry-run)\n- `cf url-scanner scans har <scanId>` — Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/. (supports --dry-run)\n- `cf url-scanner scans screenshot <scanId>` — Get scan's screenshot by resolution (desktop/mobile/tablet). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"user": "# user — Your Cloudflare user profile, invitations, organizations, billing, and personal API tokens\n\n## Commands\n\n### Read Operations\n\n- `cf user audit-logs list` — Gets a list of audit logs for a user account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n- `cf user billing history list` — Accesses your billing history object.\n- `cf user billing profile get` — Accesses your billing profile object.\n- `cf user firewall access-rules list` — Fetches IP Access rules of the user. You can filter the results using several optional parameters.\n- `cf user get` — Get current user details\n- `cf user load-balancers monitors get <monitorId>` — List a single configured monitor for a user.\n- `cf user load-balancers monitors list` — List configured monitors for a user.\n- `cf user load-balancers monitors references list` — Get the list of resources that reference the provided monitor.\n- `cf user load-balancers pools get <poolId>` — Fetch a single configured pool.\n- `cf user load-balancers pools health get <poolId>` — Fetch the latest pool health status for a single pool.\n- `cf user load-balancers pools list` — List configured pools.\n- `cf user load-balancers pools references list` — Get the list of resources that reference the provided pool.\n- `cf user load-balancers preview get <previewId>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf user load-balancing-analytics events list` — List origin health changes.\n- `cf user subscriptions get` — Lists all of a user's subscriptions.\n- `cf user tenants list` — Retrieves list of tenants the authenticated user / method has access to.\n- `cf user tokens get <tokenId>` — Get information about a specific token.\n- `cf user tokens list` — List all access tokens you created.\n- `cf user tokens permission-groups list` — Find all available permission groups for API Tokens.\n\n### Create Operations\n\n- `cf user firewall access-rules create` — Creates a new IP Access rule for all zones owned by the current user. Note: To create an IP Access rule that applies to a specific zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf user load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers monitors preview create <monitorId>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf user load-balancers pools preview create <poolId>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user tokens create` — Create a new access token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf user edit` — Edit part of your user details. (supports --dry-run, --body)\n- `cf user firewall access-rules edit <ruleId>` — Updates an IP Access rule defined at the user level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n- `cf user load-balancers monitors edit <monitorId>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers monitors update <monitorId>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers pools update <poolId>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf user subscriptions update <identifier>` — Updates a user's subscriptions. (supports --dry-run, --body)\n- `cf user tokens update <tokenId>` — Update an existing token. (supports --dry-run, --body)\n- `cf user tokens value update <tokenId>` — Roll the token secret. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf user firewall access-rules delete <ruleId>` — Deletes an IP Access rule at the user level. Note: Deleting a user-level rule will affect all zones owned by the user. (supports --dry-run, --body)\n- `cf user load-balancers monitors delete <monitorId>` — Delete a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers pools delete <poolId>` — Delete a configured pool. (supports --dry-run, --body)\n- `cf user subscriptions delete <identifier>` — Deletes a user's subscription. (supports --dry-run, --body)\n- `cf user tokens delete <tokenId>` — Destroy a token. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf user load-balancers pools edit pools pool <poolId>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers pools edit pools pools` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n- `cf user tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"vectorize": "# vectorize — Globally distributed vector database for building semantic search, recommendations, and RAG applications on Workers\n\n## Commands\n\n### Read Operations\n\n- `cf vectorize get <indexName>` — Returns the specified Vectorize Index.\n- `cf vectorize info <indexName>` — Get information about a vectorize index.\n- `cf vectorize list` — Returns a list of Vectorize Indexes\n- `cf vectorize metadata-index list` — List Metadata Indexes for the specified Vectorize Index.\n\n### Create Operations\n\n- `cf vectorize create` — Creates and returns a new Vectorize Index. (supports --dry-run, --body)\n- `cf vectorize metadata-index create <indexName>` — Enable metadata filtering based on metadata property. Limited to 10 properties. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf vectorize delete <indexName>` — Deletes the specified Vectorize Index. (supports --dry-run)\n- `cf vectorize metadata-index delete <indexName>` — Allow Vectorize to delete the specified metadata index. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf vectorize delete-by-ids <indexName>` — Delete a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize get-by-ids <indexName>` — Get a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize insert <indexName>` — Inserts vectors into the specified index and returns a mutation id corresponding to the vectors enqueued for insertion. (supports --dry-run, --body)\n- `cf vectorize list-vectors <indexName>` — Returns a paginated list of vector identifiers from the specified index. (supports --dry-run)\n- `cf vectorize query <indexName>` — Finds vectors closest to a given vector in an index. (supports --dry-run, --body)\n- `cf vectorize upsert <indexName>` — Upserts vectors into the specified index, creating them if they do not exist and returns a mutation id corresponding to the vectors enqueued for upsertion. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"vuln-scanner": "# vuln-scanner — Vulnerability scanning for web applications — manage scans, credential sets, and scan reports\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"waiting-rooms": "# waiting-rooms — Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages\n\n## Commands\n\n### Read Operations\n\n- `cf waiting-rooms account-waiting-rooms list` — Lists waiting rooms for account.\n- `cf waiting-rooms events details get <eventId>` — Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.\n- `cf waiting-rooms events get <eventId>` — Fetches a single configured event for a waiting room.\n- `cf waiting-rooms events list` — Lists events for a waiting room.\n- `cf waiting-rooms get <waitingRoomId>` — Fetches a single configured waiting room.\n- `cf waiting-rooms list` — Lists waiting rooms for zone.\n- `cf waiting-rooms rules get <waitingRoomId>` — Lists rules for a waiting room.\n- `cf waiting-rooms settings get` — Gets the zone-level Waiting Room settings that apply as defaults to all waiting rooms on the zone.\n- `cf waiting-rooms statuses get <waitingRoomId>` — Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.\n\n### Create Operations\n\n- `cf waiting-rooms create` — Creates a new waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events create <waitingRoomId>` — Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time. (supports --dry-run, --body)\n- `cf waiting-rooms rules create <waitingRoomId>` — Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf waiting-rooms edit <waitingRoomId>` — Patches a configured waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events edit <eventId>` — Patches a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events update <eventId>` — Updates a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules edit <ruleId>` — Patches a rule for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules update <waitingRoomId>` — Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms settings edit` — Partially updates zone-level Waiting Room settings using PATCH semantics. (supports --dry-run, --body)\n- `cf waiting-rooms settings update` — Fully updates zone-level Waiting Room settings, replacing the existing configuration. (supports --dry-run, --body)\n- `cf waiting-rooms update <waitingRoomId>` — Updates a configured waiting room. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf waiting-rooms delete <waitingRoomId>` — Deletes a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events delete <eventId>` — Deletes an event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules delete <ruleId>` — Deletes a rule for a waiting room. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf waiting-rooms page preview` — Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \\\"Welcome\\\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"web3": "# web3 — Web3 gateways — serve IPFS and Ethereum content through custom hostnames on Cloudflare\n\n## Commands\n\n### Read Operations\n\n- `cf web3 hostnames get <identifier>` — Get Web3 hostname details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries get <contentListEntryIdentifier>` — Get IPFS content list entry details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries list` — List IPFS content list entries\n- `cf web3 hostnames ipfs-universal-paths content-lists get <identifier>` — Get IPFS content list details\n- `cf web3 hostnames list` — List Web3 hostnames\n\n### Create Operations\n\n- `cf web3 hostnames create` — Create a Web3 hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries create <identifier>` — Create an IPFS content list entry (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web3 hostnames edit <identifier>` — Edit a Web3 hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries update <contentListEntryIdentifier>` — Edit an IPFS content list entry (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists update <identifier>` — Update IPFS content list (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web3 hostnames delete <identifier>` — Delete a Web3 hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries delete <contentListEntryIdentifier>` — Delete an IPFS content list entry (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"workers": "# workers — Deploy and manage serverless JavaScript/WASM applications on Cloudflare's global network\n\n## Commands\n\n### Read Operations\n\n- `cf workers account-settings get` — Fetches Worker account settings for an account.\n- `cf workers applications list` — Lists all the container applications that are associated with your account.\n- `cf workers beta workers get <workerId>` — Get details about a specific Worker.\n- `cf workers beta workers list` — List all Workers for an account.\n- `cf workers beta workers versions get <versionId>` — Get details about a specific version.\n- `cf workers beta workers versions list` — List all versions for a Worker.\n- `cf workers configuration get` — Gets the pay-per-crawl config for a zone including the bot configuration.\n- `cf workers crawler stripe get` — Gets the stripe config for a crawler.\n- `cf workers deployments get <deploymentId>` — Get information about a Worker Deployment.\n- `cf workers deployments list` — List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.\n- `cf workers domains get <domainId>` — Gets information about a domain.\n- `cf workers domains list` — Lists all domains for an account.\n- `cf workers observability destinations list` — List your Workers Observability Telemetry Destinations.\n- `cf workers observability queries get <queryId>` — Retrieve a saved query.\n- `cf workers observability queries list` — List saved queries.\n- `cf workers placement regions list` — Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.\n- `cf workers publisher stripe get` — Gets the stripe config for a publisher.\n- `cf workers routes get <routeId>` — Returns information about a route, including URL pattern and Worker.\n- `cf workers routes list` — Returns routes for a zone.\n- `cf workers scripts content get` — Fetch script content only.\n- `cf workers scripts get` — Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.\n- `cf workers scripts list` — Fetch a list of uploaded workers.\n- `cf workers scripts schedules get` — Fetches Cron Triggers for a Worker.\n- `cf workers scripts script-and-version-settings get` — Get metadata and config, such as bindings or usage model.\n- `cf workers scripts settings get` — Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.\n- `cf workers scripts subdomain get` — Get if the Worker is available on the workers.dev subdomain.\n- `cf workers scripts usage-model get` — Fetches the Usage Model for a given Worker.\n- `cf workers secrets get <secretName>` — Get a given secret binding (value omitted) on a script.\n- `cf workers secrets list` — List secrets bound to a script.\n- `cf workers services environments content get <environmentName>` — Get script content from a worker with an environment.\n- `cf workers services environments settings get <environmentName>` — Get script settings from a worker with an environment.\n- `cf workers subdomains get` — Returns a Workers subdomain for an account.\n- `cf workers versions get <versionId>` — Retrieves detailed information about a specific version of a Workers script.\n- `cf workers versions list` — List of Worker Versions. The first version in the list is the latest version.\n\n### Create Operations\n\n- `cf workers assets upload create` — Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers beta workers create` — Create a new Worker. (supports --dry-run, --body)\n- `cf workers beta workers versions create <workerId>` — Create a new version. (supports --dry-run, --body)\n- `cf workers configuration create` — Creates the pay-per-crawl config for a zone. (supports --dry-run, --body)\n- `cf workers crawler stripe create` — Creates the stripe config for a crawler. (supports --dry-run)\n- `cf workers deployments create` — Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker. (supports --dry-run, --body)\n- `cf workers observability destinations create` — Create a new Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf workers observability queries create` — Persist query for later use. (supports --dry-run, --body)\n- `cf workers publisher stripe create` — Creates the stripe config for a publisher. (supports --dry-run)\n- `cf workers routes create` — Creates a route that maps a URL pattern to a Worker. (supports --dry-run, --body)\n- `cf workers scripts assets upload create` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers scripts subdomain create` — Enable or disable the Worker on the workers.dev subdomain. (supports --dry-run, --body)\n- `cf workers scripts tail create` — Starts a tail that receives logs and exception from a Worker. (supports --dry-run, --body)\n- `cf workers versions create` — Upload a Worker Version without deploying to Cloudflare's network. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers zones-can-be-enabled query create` — Provided a list of pay-per-crawl configured zones this method will return whether they can enable PPC or not. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers account-settings update` — Creates Worker account settings for an account. (supports --dry-run, --body)\n- `cf workers beta workers edit <workerId>` — Perform a partial update on a Worker, where omitted properties are left unchanged from their current values. (supports --dry-run, --body)\n- `cf workers beta workers update <workerId>` — Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint. (supports --dry-run, --body)\n- `cf workers configuration edit` — Changes the pay-per-crawl config for a zone. (supports --dry-run, --body)\n- `cf workers domains update` — Attaches a domain that routes traffic to a Worker. (supports --dry-run, --body)\n- `cf workers observability destinations update <slug>` — Update an existing Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf workers observability queries edit <queryId>` — Update saved query. (supports --dry-run, --body)\n- `cf workers routes update <routeId>` — Updates the URL pattern or Worker associated with a route. (supports --dry-run, --body)\n- `cf workers scripts content update` — Put script content without touching config or metadata. (supports --dry-run, --body)\n- `cf workers scripts schedules update` — Updates Cron Triggers for a Worker. (supports --dry-run, --body)\n- `cf workers scripts script-and-version-settings edit` — Patch metadata or config, such as bindings or usage model. (supports --dry-run, --body)\n- `cf workers scripts settings edit` — Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers. (supports --dry-run, --body)\n- `cf workers scripts update` — Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers scripts usage-model update` — Updates the Usage Model for a given Worker. Requires a Workers Paid subscription. (supports --dry-run, --body)\n- `cf workers secrets update <name>` — Add a secret to a script. (supports --dry-run, --body)\n- `cf workers services environments content update <environmentName>` — Put script content from a worker with an environment. (supports --dry-run, --body)\n- `cf workers services environments settings edit <environmentName>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf workers subdomains update` — Creates a Workers subdomain for an account. (supports --dry-run, --body)\n- `cf workers zones-can-be-enabled edit` — Allows an account admin to set the can_be_enabled setting on a list of zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers beta workers delete <workerId>` — Delete a Worker and all its associated resources (versions, deployments, etc.). (supports --dry-run)\n- `cf workers beta workers versions delete <versionId>` — Delete a version. (supports --dry-run)\n- `cf workers crawler stripe delete` — Deletes the stripe config for a crawler. (supports --dry-run)\n- `cf workers deployments delete <deploymentId>` — Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted. (supports --dry-run)\n- `cf workers domains delete <domainId>` — Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain. (supports --dry-run)\n- `cf workers observability destinations delete <slug>` — Delete a Workers Observability Telemetry Destination. (supports --dry-run)\n- `cf workers observability queries delete <queryId>` — Delete a saved query. (supports --dry-run)\n- `cf workers publisher stripe delete` — Deletes the stripe config for a publisher. (supports --dry-run)\n- `cf workers routes delete <routeId>` — Deletes a route. (supports --dry-run)\n- `cf workers scripts delete` — Delete your worker. This call has no response body on a successful delete. (supports --dry-run, --body)\n- `cf workers scripts subdomain delete` — Disable all workers.dev subdomains for a Worker. (supports --dry-run)\n- `cf workers scripts tail delete <id>` — Deletes a tail from a Worker. (supports --dry-run, --body)\n- `cf workers secrets delete <secretName>` — Remove a secret from a script. (supports --dry-run)\n- `cf workers subdomains delete` — Deletes a Workers subdomain for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers observability telemetry keys` — List all the keys in your telemetry events. (supports --dry-run, --body)\n- `cf workers observability telemetry query` — Run a temporary or saved query. (supports --dry-run, --body)\n- `cf workers observability telemetry values` — List unique values found in your events. (supports --dry-run, --body)\n- `cf workers registries credentials generate <domain>` — Generates temporary credentials for accessing Cloudflare's container image registry. Used for pulling and pushing container images. (supports --dry-run, --body)\n- `cf workers scripts search` — Search for Workers in an account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"workers-builds": "# workers-builds — Automated build and deployment pipeline for Workers — track builds, logs, and repo connections\n\n## Commands\n\n### Read Operations\n\n- `cf workers-builds builds get <buildUuid>` — Retrieve detailed information about a specific build\n- `cf workers-builds builds list` — Get all builds for a specific worker script with pagination\n- `cf workers-builds builds logs get <buildUuid>` — Retrieve logs for a specific build with cursor-based pagination\n- `cf workers-builds repos config-autofill get <repoId>` — Analyze repository for automatic configuration detection\n- `cf workers-builds tokens list` — Get all build tokens with pagination\n- `cf workers-builds triggers environment-variables list` — Get all environment variables for a trigger\n- `cf workers-builds triggers list` — Get all triggers for a specific worker script\n\n### Create Operations\n\n- `cf workers-builds tokens create` — Create a new build authentication token (supports --dry-run, --body)\n- `cf workers-builds triggers create` — Create a new CI/CD trigger (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers-builds triggers update <triggerUuid>` — Update an existing CI/CD trigger (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers-builds repos connections delete <repoConnectionUuid>` — Remove a repository connection (supports --dry-run)\n- `cf workers-builds tokens delete <buildTokenUuid>` — Remove a build authentication token (supports --dry-run)\n- `cf workers-builds triggers delete <triggerUuid>` — Remove a CI/CD trigger (supports --dry-run)\n- `cf workers-builds triggers environment-variables delete <environmentVariableKey>` — Remove a specific environment variable from a trigger (supports --dry-run)\n\n### Other Operations\n\n- `cf workers-builds builds cancel <buildUuid>` — Cancel a running or queued build (supports --dry-run)\n- `cf workers-builds get-account-limits` — Retrieve account limits and usage information (supports --dry-run)\n- `cf workers-builds get-builds-by-version` — Retrieve builds for specific version IDs (supports --dry-run)\n- `cf workers-builds get-latest-builds` — Retrieve the most recent builds for multiple worker scripts (supports --dry-run)\n- `cf workers-builds repos connections upsert` — Upsert a repository connection for CI/CD integration (supports --dry-run, --body)\n- `cf workers-builds triggers create-build <triggerUuid>` — Trigger a manual build for a specific trigger (supports --dry-run, --body)\n- `cf workers-builds triggers environment-variables upsert <triggerUuid>` — Create or update environment variables for a trigger (supports --dry-run, --body)\n- `cf workers-builds triggers purge-cache <triggerUuid>` — Clear the build cache for a specific trigger (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"workflows": "# workflows — Durable, multi-step workflows that run on Workers with automatic retries and state persistence\n\n## Commands\n\n### Read Operations\n\n- `cf workflows get <workflowName>` — Retrieves configuration and metadata for a specific workflow.\n- `cf workflows instances get <instanceId>` — Retrieves logs and execution status for a specific workflow instance.\n- `cf workflows instances list` — Lists all instances of a workflow with their execution status.\n- `cf workflows list` — Lists all workflows configured for the account.\n- `cf workflows versions get <versionId>` — Retrieves details for a specific deployed workflow version.\n- `cf workflows versions list` — Lists all deployed versions of a workflow.\n\n### Create Operations\n\n- `cf workflows instances create <workflowName>` — Creates a new instance of a workflow, starting its execution. (supports --dry-run, --body)\n- `cf workflows instances events create <eventType>` — Sends an event to a running workflow instance to trigger state transitions. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workflows instances status edit <instanceId>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows update <workflowName>` — Creates a new workflow or updates an existing workflow definition. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workflows delete <workflowName>` — Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it. (supports --dry-run)\n\n### Other Operations\n\n- `cf workflows instances batch-terminate <workflowName>` — Terminates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances bulk` — Creates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances status-terminate <workflowName>` — Gets the status of a bulk workflow instance termination job. (supports --dry-run)\n- `cf workflows versions dag <versionId>` — Retrieves the directed acyclic graph (DAG) representation of a workflow version. (supports --dry-run)\n- `cf workflows versions graph <versionId>` — Retrieves the graph visualization of a workflow version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"url-scanner": "# url-scanner — Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results\n\n## Commands\n\n### Read Operations\n\n- `cf url-scanner responses get <response-id>` — Returns the raw response of the network request. Find the `response_id` in the `data.requests.response.hash`.\n- `cf url-scanner scans get <scan-id>` — Get URL scan by uuid\n- `cf url-scanner scans list` — Use a subset of ElasticSearch Query syntax to filter scans. Some example queries:<br/> <br/>- 'path:\"/bundles/jquery.js\"': Searches for scans who requested resources with the given path.<br/>- 'page.asn:AS24940 AND hash:xxx': Websites hosted in AS24940 where a resource with the given hash was downloaded.<br/>- 'page.domain:microsoft* AND verdicts.malicious:true AND NOT page.domain:microsoft.com': malicious scans whose hostname starts with \"microsoft\".<br/>- 'apikey:me AND date:[2025-01 TO 2025-02]': my scans from 2025 January to 2025 February.\n\n### Create Operations\n\n- `cf url-scanner scans create` — Submit a URL to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf url-scanner scans bulk-create` — Submit URLs to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/ and take into account scans submitted in bulk have lower priority and may take longer to finish. (supports --dry-run, --body)\n- `cf url-scanner scans dom <scan-id>` — Returns a plain text response, with the scan's DOM content as rendered by Chrome. (supports --dry-run)\n- `cf url-scanner scans har <scan-id>` — Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/. (supports --dry-run)\n- `cf url-scanner scans screenshot <scan-id>` — Get scan's screenshot by resolution (desktop/mobile/tablet). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"user": "# user — Your Cloudflare user profile, invitations, organizations, billing, and personal API tokens\n\n## Commands\n\n### Read Operations\n\n- `cf user audit-logs list` — Gets a list of audit logs for a user account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n- `cf user billing history list` — Accesses your billing history object.\n- `cf user billing profile get` — Accesses your billing profile object.\n- `cf user firewall access-rules list` — Fetches IP Access rules of the user. You can filter the results using several optional parameters.\n- `cf user get` — Retrieves detailed information about the currently authenticated user, including email, name, and account memberships.\n- `cf user load-balancers monitors get <monitor-id>` — List a single configured monitor for a user.\n- `cf user load-balancers monitors list` — List configured monitors for a user.\n- `cf user load-balancers monitors references list` — Get the list of resources that reference the provided monitor.\n- `cf user load-balancers pools get <pool-id>` — Fetch a single configured pool.\n- `cf user load-balancers pools health get <pool-id>` — Fetch the latest pool health status for a single pool.\n- `cf user load-balancers pools list` — List configured pools.\n- `cf user load-balancers pools references list` — Get the list of resources that reference the provided pool.\n- `cf user load-balancers preview get <preview-id>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf user load-balancing-analytics events list` — List origin health changes.\n- `cf user subscriptions get` — Lists all of a user's subscriptions.\n- `cf user tenants list` — Retrieves list of tenants the authenticated user / method has access to.\n- `cf user tokens get <token-id>` — Get information about a specific token.\n- `cf user tokens list` — List all access tokens you created.\n- `cf user tokens permission-groups list` — Find all available permission groups for API Tokens.\n\n### Create Operations\n\n- `cf user firewall access-rules create` — Creates a new IP Access rule for all zones owned by the current user. Note: To create an IP Access rule that applies to a specific zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf user load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers monitors preview create <monitor-id>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf user load-balancers pools preview create <pool-id>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf user tokens create` — Create a new access token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf user edit` — Edit part of your user details. (supports --dry-run, --body)\n- `cf user firewall access-rules edit <rule-id>` — Updates an IP Access rule defined at the user level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n- `cf user load-balancers monitors edit <monitor-id>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers monitors update <monitor-id>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf user load-balancers pools update <pool-id>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf user subscriptions update <identifier>` — Updates a user's subscriptions. (supports --dry-run, --body)\n- `cf user tokens update <token-id>` — Update an existing token. (supports --dry-run, --body)\n- `cf user tokens value update <token-id>` — Roll the token secret. (supports --dry-run)\n\n### Delete Operations\n\n- `cf user firewall access-rules delete <rule-id>` — Deletes an IP Access rule at the user level. Note: Deleting a user-level rule will affect all zones owned by the user. (supports --dry-run)\n- `cf user load-balancers monitors delete <monitor-id>` — Delete a configured monitor. (supports --dry-run)\n- `cf user load-balancers pools delete <pool-id>` — Delete a configured pool. (supports --dry-run)\n- `cf user subscriptions delete <identifier>` — Deletes a user's subscription. (supports --dry-run)\n- `cf user tokens delete <token-id>` — Destroy a token. (supports --dry-run)\n\n### Other Operations\n\n- `cf user load-balancers pools edit pools pool <pool-id>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf user load-balancers pools edit pools pools` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n- `cf user tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"vectorize": "# vectorize — Globally distributed vector database for building semantic search, recommendations, and RAG applications on Workers\n\n## Commands\n\n### Read Operations\n\n- `cf vectorize get <index-name>` — Returns the specified Vectorize Index.\n- `cf vectorize info <index-name>` — Get information about a vectorize index.\n- `cf vectorize list` — Returns a list of Vectorize Indexes\n- `cf vectorize metadata-index list` — List Metadata Indexes for the specified Vectorize Index.\n\n### Create Operations\n\n- `cf vectorize create` — Creates and returns a new Vectorize Index. (supports --dry-run, --body)\n- `cf vectorize metadata-index create <index-name>` — Enable metadata filtering based on metadata property. Limited to 10 properties. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf vectorize delete <index-name>` — Deletes the specified Vectorize Index. (supports --dry-run)\n- `cf vectorize metadata-index delete <index-name>` — Allow Vectorize to delete the specified metadata index. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf vectorize delete-by-ids <index-name>` — Delete a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize get-by-ids <index-name>` — Get a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize insert <index-name>` — Inserts vectors into the specified index and returns a mutation id corresponding to the vectors enqueued for insertion. (supports --dry-run, --body)\n- `cf vectorize list-vectors <index-name>` — Returns a paginated list of vector identifiers from the specified index. (supports --dry-run)\n- `cf vectorize query <index-name>` — Finds vectors closest to a given vector in an index. (supports --dry-run, --body)\n- `cf vectorize upsert <index-name>` — Upserts vectors into the specified index, creating them if they do not exist and returns a mutation id corresponding to the vectors enqueued for upsertion. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"waiting-rooms": "# waiting-rooms — Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages\n\n## Commands\n\n### Read Operations\n\n- `cf waiting-rooms account-waiting-rooms list` — Lists waiting rooms for account.\n- `cf waiting-rooms events details get <event-id>` — Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.\n- `cf waiting-rooms events get <event-id>` — Fetches a single configured event for a waiting room.\n- `cf waiting-rooms events list` — Lists events for a waiting room.\n- `cf waiting-rooms get <waiting-room-id>` — Fetches a single configured waiting room.\n- `cf waiting-rooms list` — Lists waiting rooms for zone.\n- `cf waiting-rooms rules get <waiting-room-id>` — Lists rules for a waiting room.\n- `cf waiting-rooms settings get` — Gets the zone-level Waiting Room settings that apply as defaults to all waiting rooms on the zone.\n- `cf waiting-rooms statuses get <waiting-room-id>` — Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.\n\n### Create Operations\n\n- `cf waiting-rooms create` — Creates a new waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time. (supports --dry-run, --body)\n- `cf waiting-rooms rules create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf waiting-rooms edit <waiting-room-id>` — Patches a configured waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events edit <event-id>` — Patches a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events update <event-id>` — Updates a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules edit <rule-id>` — Patches a rule for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules update <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms settings edit` — Partially updates zone-level Waiting Room settings using PATCH semantics. (supports --dry-run, --body)\n- `cf waiting-rooms settings update` — Fully updates zone-level Waiting Room settings, replacing the existing configuration. (supports --dry-run, --body)\n- `cf waiting-rooms update <waiting-room-id>` — Updates a configured waiting room. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf waiting-rooms delete <waiting-room-id>` — Deletes a waiting room. (supports --dry-run)\n- `cf waiting-rooms events delete <event-id>` — Deletes an event for a waiting room. (supports --dry-run)\n- `cf waiting-rooms rules delete <rule-id>` — Deletes a rule for a waiting room. (supports --dry-run)\n\n### Other Operations\n\n- `cf waiting-rooms page preview` — Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \\\"Welcome\\\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"web3": "# web3 — Web3 gateways — serve IPFS and Ethereum content through custom hostnames on Cloudflare\n\n## Commands\n\n### Read Operations\n\n- `cf web3 hostnames get <identifier>` — Web3 Hostname Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries get <content-list-entry-identifier>` — IPFS Universal Path Gateway Content List Entry Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries list` — List IPFS Universal Path Gateway Content List Entries\n- `cf web3 hostnames ipfs-universal-paths content-lists get <identifier>` — IPFS Universal Path Gateway Content List Details\n- `cf web3 hostnames list` — List Web3 Hostnames\n\n### Create Operations\n\n- `cf web3 hostnames create` — Create Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries create <identifier>` — Create IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web3 hostnames edit <identifier>` — Edit Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries update <content-list-entry-identifier>` — Edit IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists update <identifier>` — Update IPFS Universal Path Gateway Content List (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web3 hostnames delete <identifier>` — Delete Web3 Hostname (supports --dry-run)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries delete <content-list-entry-identifier>` — Delete IPFS Universal Path Gateway Content List Entry (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"workers": "# workers — Deploy and manage serverless JavaScript/WASM applications on Cloudflare's global network\n\n## Commands\n\n### Read Operations\n\n- `cf workers account-settings get` — Fetches Worker account settings for an account.\n- `cf workers beta workers get <worker-id>` — Get details about a specific Worker.\n- `cf workers beta workers list` — List all Workers for an account.\n- `cf workers beta workers versions get <version-id>` — Get details about a specific version.\n- `cf workers beta workers versions list` — List all versions for a Worker.\n- `cf workers configuration get` — Gets the pay-per-crawl config for a zone including the bot configuration.\n- `cf workers crawler stripe get` — Gets the stripe config for a crawler.\n- `cf workers deployments get <deployment-id>` — Get information about a Worker Deployment.\n- `cf workers deployments list` — List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.\n- `cf workers domains get <domain-id>` — Gets information about a domain.\n- `cf workers domains list` — Lists all domains for an account.\n- `cf workers placement regions list` — Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.\n- `cf workers publisher stripe get` — Gets the stripe config for a publisher.\n- `cf workers routes get <route-id>` — Returns information about a route, including URL pattern and Worker.\n- `cf workers routes list` — Returns routes for a zone.\n- `cf workers scripts content get` — Fetch script content only.\n- `cf workers scripts get` — Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.\n- `cf workers scripts list` — Fetch a list of uploaded workers.\n- `cf workers scripts schedules get` — Fetches Cron Triggers for a Worker.\n- `cf workers scripts script-and-version-settings get` — Get metadata and config, such as bindings or usage model.\n- `cf workers scripts settings get` — Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.\n- `cf workers scripts subdomain get` — Get if the Worker is available on the workers.dev subdomain.\n- `cf workers scripts usage-model get` — Fetches the Usage Model for a given Worker.\n- `cf workers secrets get <secret-name>` — Get a given secret binding (value omitted) on a script.\n- `cf workers secrets list` — List secrets bound to a script.\n- `cf workers services environments content get <environment-name>` — Get script content from a worker with an environment.\n- `cf workers services environments settings get <environment-name>` — Get script settings from a worker with an environment.\n- `cf workers subdomains get` — Returns a Workers subdomain for an account.\n- `cf workers versions get <version-id>` — Retrieves detailed information about a specific version of a Workers script.\n- `cf workers versions list` — List of Worker Versions. The first version in the list is the latest version.\n\n### Create Operations\n\n- `cf workers assets upload create` — Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers beta workers create` — Create a new Worker. (supports --dry-run, --body)\n- `cf workers beta workers versions create <worker-id>` — Create a new version. (supports --dry-run, --body)\n- `cf workers configuration create` — Creates the pay-per-crawl config for a zone. (supports --dry-run, --body)\n- `cf workers crawler stripe create` — Creates the stripe config for a crawler. (supports --dry-run)\n- `cf workers deployments create` — Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker. (supports --dry-run, --body)\n- `cf workers publisher stripe create` — Creates the stripe config for a publisher. (supports --dry-run)\n- `cf workers routes create` — Creates a route that maps a URL pattern to a Worker. (supports --dry-run, --body)\n- `cf workers scripts assets upload create` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers scripts subdomain create` — Enable or disable the Worker on the workers.dev subdomain. (supports --dry-run, --body)\n- `cf workers scripts tail create` — Starts a tail that receives logs and exception from a Worker. (supports --dry-run)\n- `cf workers versions create` — Upload a Worker Version without deploying to Cloudflare's network. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers zones-can-be-enabled query create` — Provided a list of pay-per-crawl configured zones this method will return whether they can enable PPC or not. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers account-settings update` — Creates Worker account settings for an account. (supports --dry-run, --body)\n- `cf workers beta workers edit <worker-id>` — Perform a partial update on a Worker, where omitted properties are left unchanged from their current values. (supports --dry-run, --body)\n- `cf workers beta workers update <worker-id>` — Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint. (supports --dry-run, --body)\n- `cf workers configuration edit` — Changes the pay-per-crawl config for a zone. (supports --dry-run, --body)\n- `cf workers domains update` — Attaches a domain that routes traffic to a Worker. (supports --dry-run, --body)\n- `cf workers routes update <route-id>` — Updates the URL pattern or Worker associated with a route. (supports --dry-run, --body)\n- `cf workers scripts content update` — Put script content without touching config or metadata. (supports --dry-run, --body)\n- `cf workers scripts schedules update` — Updates Cron Triggers for a Worker. (supports --dry-run, --body)\n- `cf workers scripts script-and-version-settings edit` — Patch metadata or config, such as bindings or usage model. (supports --dry-run, --body)\n- `cf workers scripts settings edit` — Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers. (supports --dry-run, --body)\n- `cf workers scripts update` — Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers scripts usage-model update` — Updates the Usage Model for a given Worker. Requires a Workers Paid subscription. (supports --dry-run, --body)\n- `cf workers secrets update <name>` — Add a secret to a script. (supports --dry-run, --body)\n- `cf workers services environments content update <environment-name>` — Put script content from a worker with an environment. (supports --dry-run, --body)\n- `cf workers services environments settings edit <environment-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf workers subdomains update` — Creates a Workers subdomain for an account. (supports --dry-run, --body)\n- `cf workers zones-can-be-enabled edit` — Allows an account admin to set the can_be_enabled setting on a list of zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers beta workers delete <worker-id>` — Delete a Worker and all its associated resources (versions, deployments, etc.). (supports --dry-run)\n- `cf workers beta workers versions delete <version-id>` — Delete a version. (supports --dry-run)\n- `cf workers crawler stripe delete` — Deletes the stripe config for a crawler. (supports --dry-run)\n- `cf workers deployments delete <deployment-id>` — Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted. (supports --dry-run)\n- `cf workers domains delete <domain-id>` — Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain. (supports --dry-run)\n- `cf workers publisher stripe delete` — Deletes the stripe config for a publisher. (supports --dry-run)\n- `cf workers routes delete <route-id>` — Deletes a route. (supports --dry-run)\n- `cf workers scripts delete` — Delete your worker. This call has no response body on a successful delete. (supports --dry-run)\n- `cf workers scripts subdomain delete` — Disable all workers.dev subdomains for a Worker. (supports --dry-run)\n- `cf workers scripts tail delete <id>` — Deletes a tail from a Worker. (supports --dry-run)\n- `cf workers secrets delete <secret-name>` — Remove a secret from a script. (supports --dry-run)\n- `cf workers subdomains delete` — Deletes a Workers subdomain for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers registries credentials generate <domain>` — Generates temporary credentials for accessing Cloudflare's container image registry. Used for pulling and pushing container images. (supports --dry-run, --body)\n- `cf workers scripts search` — Search for Workers in an account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"workers-builds": "# workers-builds — Automated build and deployment pipeline for Workers — track builds, logs, and repo connections\n\n## Commands\n\n### Read Operations\n\n- `cf workers-builds builds get <build-uuid>` — Retrieve detailed information about a specific build\n- `cf workers-builds builds list` — Get all builds for a specific worker script with pagination\n- `cf workers-builds builds logs get <build-uuid>` — Retrieve logs for a specific build with cursor-based pagination\n- `cf workers-builds repos config-autofill get <repo-id>` — Analyze repository for automatic configuration detection\n- `cf workers-builds tokens list` — Get all build tokens with pagination\n- `cf workers-builds triggers environment-variables list` — Get all environment variables for a trigger\n- `cf workers-builds triggers list` — Get all triggers for a specific worker script\n\n### Create Operations\n\n- `cf workers-builds tokens create` — Create a new build authentication token (supports --dry-run, --body)\n- `cf workers-builds triggers create` — Create a new CI/CD trigger (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers-builds triggers update <trigger-uuid>` — Update an existing CI/CD trigger (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers-builds repos connections delete <repo-connection-uuid>` — Remove a repository connection (supports --dry-run)\n- `cf workers-builds tokens delete <build-token-uuid>` — Remove a build authentication token (supports --dry-run)\n- `cf workers-builds triggers delete <trigger-uuid>` — Remove a CI/CD trigger (supports --dry-run)\n- `cf workers-builds triggers environment-variables delete <environment-variable-key>` — Remove a specific environment variable from a trigger (supports --dry-run)\n\n### Other Operations\n\n- `cf workers-builds builds cancel <build-uuid>` — Cancel a running or queued build (supports --dry-run)\n- `cf workers-builds get-account-limits` — Retrieve account limits and usage information (supports --dry-run)\n- `cf workers-builds get-builds-by-version` — Retrieve builds for specific version IDs (supports --dry-run)\n- `cf workers-builds get-latest-builds` — Retrieve the most recent builds for multiple worker scripts (supports --dry-run)\n- `cf workers-builds repos connections upsert` — Upsert a repository connection for CI/CD integration (supports --dry-run, --body)\n- `cf workers-builds triggers create-build <trigger-uuid>` — Trigger a manual build for a specific trigger (supports --dry-run, --body)\n- `cf workers-builds triggers environment-variables upsert <trigger-uuid>` — Create or update environment variables for a trigger (supports --dry-run, --body)\n- `cf workers-builds triggers purge-cache <trigger-uuid>` — Clear the build cache for a specific trigger (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"workflows": "# workflows — Durable, multi-step workflows that run on Workers with automatic retries and state persistence\n\n## Commands\n\n### Read Operations\n\n- `cf workflows get <workflow-name>` — Retrieves configuration and metadata for a specific workflow.\n- `cf workflows instances get <instance-id>` — Retrieves logs and execution status for a specific workflow instance.\n- `cf workflows instances list` — Lists all instances of a workflow with their execution status.\n- `cf workflows list` — Lists all workflows configured for the account.\n- `cf workflows versions get <version-id>` — Retrieves details for a specific deployed workflow version.\n- `cf workflows versions list` — Lists all deployed versions of a workflow.\n\n### Create Operations\n\n- `cf workflows instances create <workflow-name>` — Creates a new instance of a workflow, starting its execution. (supports --dry-run, --body)\n- `cf workflows instances events create <event-type>` — Sends an event to a running workflow instance to trigger state transitions. (supports --dry-run)\n\n### Update Operations\n\n- `cf workflows instances status edit <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows update <workflow-name>` — Creates a new workflow or updates an existing workflow definition. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workflows delete <workflow-name>` — Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it. (supports --dry-run)\n\n### Other Operations\n\n- `cf workflows instances batch-terminate <workflow-name>` — Terminates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances bulk` — Creates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances status-terminate <workflow-name>` — Gets the status of a bulk workflow instance termination job. (supports --dry-run)\n- `cf workflows versions dag <version-id>` — Retrieves the directed acyclic graph (DAG) representation of a workflow version. (supports --dry-run)\n- `cf workflows versions graph <version-id>` — Retrieves the graph visualization of a workflow version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zaraz": "# zaraz — Server-side tag manager — load third-party tools (analytics, pixels, etc.) from Cloudflare's edge without client-side JS\n\n## Commands\n\n### Read Operations\n\n- `cf zaraz config get` — Gets latest Zaraz configuration for a zone. It can be preview or published configuration, whichever was the last updated. Secret variables values will not be included.\n- `cf zaraz default get` — Gets default Zaraz configuration for a zone.\n- `cf zaraz export get` — Exports full current published Zaraz configuration for a zone, secret variables included.\n- `cf zaraz history configs get` — Gets a history of published Zaraz configurations by ID(s) for a zone.\n- `cf zaraz history list` — Lists a history of published Zaraz configuration records for a zone.\n- `cf zaraz workflow get` — Gets Zaraz workflow for a zone.\n\n### Create Operations\n\n- `cf zaraz publish create` — Publish current Zaraz preview configuration for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zaraz config update` — Updates Zaraz configuration for a zone. (supports --dry-run, --body)\n- `cf zaraz history update` — Restores a historical published Zaraz configuration by ID for a zone. (supports --dry-run, --body)\n- `cf zaraz update` — Updates Zaraz workflow for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"zero-trust": "# zero-trust — Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation\n\n## Commands\n\n### Read Operations\n\n- `cf zero-trust access ai-controls mcp portals list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access ai-controls mcp servers list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access applications cas get <appId>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust access applications cas list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust access applications get <appId>` — Fetches information about an Access application.\n- `cf zero-trust access applications list` — Lists all Access applications in an account.\n- `cf zero-trust access applications policies get <policyId>` — Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.\n- `cf zero-trust access applications policies list` — Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.\n- `cf zero-trust access applications policy-tests get <policyTestId>` — Fetches the current status of a given Access policy test.\n- `cf zero-trust access applications policy-tests users list` — Fetches a single page of user results from an Access policy test.\n- `cf zero-trust access applications user-policy-checks list` — Tests if a specific user has permission to access an application.\n- `cf zero-trust access bookmarks get <bookmarkId>` — Fetches a single Bookmark application.\n- `cf zero-trust access bookmarks list` — Lists Bookmark applications.\n- `cf zero-trust access certificates get <certificateId>` — Fetches a single mTLS certificate.\n- `cf zero-trust access certificates list` — Lists all mTLS root certificates.\n- `cf zero-trust access certificates settings get` — List all mTLS hostname settings for this account.\n- `cf zero-trust access custom-pages get <customPageId>` — Fetches a custom page and also returns its HTML.\n- `cf zero-trust access custom-pages list` — List custom pages\n- `cf zero-trust access gateway-ca list` — Lists SSH Certificate Authorities (CA).\n- `cf zero-trust access groups get <groupId>` — Fetches a single Access group.\n- `cf zero-trust access groups list` — Lists all Access groups.\n- `cf zero-trust access infrastructure targets get <targetId>` — Retrieves details for a specific infrastructure access target, including its hostname, IP, and access configuration.\n- `cf zero-trust access infrastructure targets list` — Lists and sorts an account’s targets. Filters are optional and are ANDed together.\n- `cf zero-trust access keys get` — Gets the Access key rotation settings for an account.\n- `cf zero-trust access logs access-requests list` — Gets a list of Access authentication audit logs for an account.\n- `cf zero-trust access logs scim updates list` — Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust access policies get <policyId>` — Fetches a single Access reusable policy.\n- `cf zero-trust access policies list` — Lists Access reusable policies.\n- `cf zero-trust access service-tokens get <serviceTokenId>` — Fetches a single service token.\n- `cf zero-trust access service-tokens list` — Lists all service tokens.\n- `cf zero-trust access tags get <tagName>` — Get a tag\n- `cf zero-trust access tags list` — List tags\n- `cf zero-trust access users active-sessions get <nonce>` — Get an active session for a single user.\n- `cf zero-trust access users active-sessions list` — Get active sessions for a single user.\n- `cf zero-trust access users failed-logins list` — Get all failed login attempts for a single user.\n- `cf zero-trust access users get <userId>` — Gets a specific user for an account.\n- `cf zero-trust access users last-seen-identity get <userId>` — Get last seen identity for a single user.\n- `cf zero-trust access users list` — Gets a list of users for an account.\n- `cf zero-trust apps ca get <appId>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust apps ca list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust apps get <appId>` — Fetches information about an Access application.\n- `cf zero-trust apps list` — List all Access Applications in a zone.\n- `cf zero-trust apps policies get <policyId>` — Fetches a single Access policy.\n- `cf zero-trust apps policies list` — Lists Access policies configured for an application.\n- `cf zero-trust apps review status list` — Retrieve the statuses of your applications.\n- `cf zero-trust apps user policy checks get <appId>` — Tests if a specific user has permission to access an application.\n- `cf zero-trust certificates get <certificateId>` — Fetches a single mTLS certificate.\n- `cf zero-trust certificates list` — Lists all mTLS certificates.\n- `cf zero-trust certificates settings list` — List all mTLS hostname settings for this zone.\n- `cf zero-trust connectivity-settings get` — Gets the Zero Trust Connectivity Settings for the given account.\n- `cf zero-trust devices client target environments list` — Retrieves a list of all available target environments with their display names. This endpoint is in Beta.\n- `cf zero-trust devices client versions list` — Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups get <groupId>` — Fetches a single deployment group by its ID. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups list` — Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.\n- `cf zero-trust devices devices get <deviceId>` — Fetches a single WARP device.\n- `cf zero-trust devices devices list` — Lists WARP devices.\n- `cf zero-trust devices dex-tests get <dexTestId>` — Fetch a single DEX test.\n- `cf zero-trust devices dex-tests list` — Fetch all DEX tests\n- `cf zero-trust devices fleet-status get <deviceId>` — Get the live status of a latest device given device_id from the device_state table\n- `cf zero-trust devices get <deviceId>` — Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}\n- `cf zero-trust devices ip-profiles get <profileId>` — Fetches a single WARP Device IP profile.\n- `cf zero-trust devices ip-profiles list` — Lists WARP Device IP profiles.\n- `cf zero-trust devices list` — List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations\n- `cf zero-trust devices networks get <networkId>` — Fetches details for a single managed network.\n- `cf zero-trust devices networks list` — Fetches a list of managed networks for an account.\n- `cf zero-trust devices override-codes get <registrationId>` — Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.\n- `cf zero-trust devices override-codes list` — Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.\n- `cf zero-trust devices policies custom excludes get <policyId>` — Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom fallback-domains get <policyId>` — Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies custom get <policyId>` — Fetches a device settings profile by ID.\n- `cf zero-trust devices policies custom includes get <policyId>` — Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom list` — Fetches a list of the device settings profiles for an account.\n- `cf zero-trust devices policies default certificates get` — Fetches device certificate provisioning.\n- `cf zero-trust devices policies default excludes get` — Fetches the list of routes excluded from the WARP client's tunnel.\n- `cf zero-trust devices policies default fallback-domains get` — Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies default get` — Fetches the default device settings profile for an account.\n- `cf zero-trust devices policies default includes get` — Fetches the list of routes included in the WARP client's tunnel.\n- `cf zero-trust devices posture get <ruleId>` — Fetches a single device posture rule.\n- `cf zero-trust devices posture integrations get <integrationId>` — Fetches details for a single device posture integration.\n- `cf zero-trust devices posture integrations list` — Fetches the list of device posture integrations for an account.\n- `cf zero-trust devices posture list` — Fetches device posture rules for a Zero Trust account.\n- `cf zero-trust devices registrations get <registrationId>` — Fetches a single WARP registration.\n- `cf zero-trust devices registrations list` — Lists WARP registrations.\n- `cf zero-trust devices resilience global-warp-override get` — Fetch the Global WARP override state.\n- `cf zero-trust devices settings get` — Describes the current device settings for a Zero Trust account.\n- `cf zero-trust dex colos list` — List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.\n- `cf zero-trust dex commands devices list` — List devices with WARP client support for remote captures which have been connected in the last 1 hour.\n- `cf zero-trust dex commands downloads get <filename>` — Downloads artifacts for an executed command. Bulk downloads are not supported\n- `cf zero-trust dex commands list` — Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters\n- `cf zero-trust dex commands quota get` — Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset\n- `cf zero-trust dex fleet-status devices list` — List details for devices using WARP\n- `cf zero-trust dex http-tests get <testId>` — Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex http-tests percentiles get <testId>` — Get percentiles for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex rules get <ruleId>` — Get details for a DEX Rule\n- `cf zero-trust dex rules list` — List DEX Rules\n- `cf zero-trust dex tests list` — List DEX tests with overview metrics\n- `cf zero-trust dex tests unique-devices list` — Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.\n- `cf zero-trust dex traceroute-test-results network-path get <testResultId>` — Get a breakdown of hops and performance metrics for a specific traceroute test run\n- `cf zero-trust dex traceroute-tests get <testId>` — Get test details and aggregate performance metrics for an traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex warp-change-events get` — List WARP configuration and enablement toggle change events by device.\n- `cf zero-trust dlp datasets get <datasetId>` — Retrieves detailed information about a specific DLP dataset, including its type, status, and entry count.\n- `cf zero-trust dlp datasets list` — Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.\n- `cf zero-trust dlp email account-mapping get` — Retrieves the email provider mapping configuration for DLP email scanning.\n- `cf zero-trust dlp email rules get <ruleId>` — Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.\n- `cf zero-trust dlp email rules list` — Lists all email scanner rules for an account.\n- `cf zero-trust dlp entries custom get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries custom list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries integration get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries integration list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp entries predefined get <entryId>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries predefined list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp limits list` — Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.\n- `cf zero-trust dlp payload-logs get` — Gets the current payload logging configuration for DLP, showing whether matched content is being logged.\n- `cf zero-trust dlp profiles custom get <profileId>` — Fetches a custom DLP profile by id.\n- `cf zero-trust dlp profiles get <profileId>` — Fetches a DLP profile by ID.\n- `cf zero-trust dlp profiles list` — Lists all DLP profiles in an account.\n- `cf zero-trust dlp profiles predefined get <profileId>` — This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.\n- `cf zero-trust gateway app-types list` — List all application and application type mappings.\n- `cf zero-trust gateway audit-ssh-settings get` — Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.\n- `cf zero-trust gateway categories list` — List all categories.\n- `cf zero-trust gateway certificates get <certificateId>` — Get a single Zero Trust certificate.\n- `cf zero-trust gateway certificates list` — List all Zero Trust certificates for an account.\n- `cf zero-trust gateway configurations custom-certificate get` — Retrieve the current Zero Trust certificate configuration.\n- `cf zero-trust gateway configurations get` — Retrieve the current Zero Trust account configuration.\n- `cf zero-trust gateway list` — Retrieve information about the current Zero Trust account.\n- `cf zero-trust gateway lists get <listId>` — Fetch a single Zero Trust list.\n- `cf zero-trust gateway lists items list` — Fetch all items in a single Zero Trust list.\n- `cf zero-trust gateway lists list` — Fetch all Zero Trust lists for an account.\n- `cf zero-trust gateway locations get <locationId>` — Get a single Zero Trust Gateway location.\n- `cf zero-trust gateway locations list` — List Zero Trust Gateway locations for an account.\n- `cf zero-trust gateway logging get` — Retrieve the current logging settings for the Zero Trust account.\n- `cf zero-trust gateway pacfiles get <pacfileId>` — Get a single Zero Trust Gateway PAC file.\n- `cf zero-trust gateway pacfiles list` — List all Zero Trust Gateway PAC files for an account.\n- `cf zero-trust gateway proxy-endpoints get <proxyEndpointId>` — Get a single Zero Trust Gateway proxy endpoint.\n- `cf zero-trust gateway proxy-endpoints list` — List all Zero Trust Gateway proxy endpoints for an account.\n- `cf zero-trust gateway rules get <ruleId>` — Get a single Zero Trust Gateway rule.\n- `cf zero-trust gateway rules list` — List Zero Trust Gateway rules for an account.\n- `cf zero-trust groups get <groupId>` — Fetches a single Access group.\n- `cf zero-trust groups list` — Lists all Access groups.\n- `cf zero-trust identity-providers get <identityProviderId>` — Fetches a configured identity provider.\n- `cf zero-trust identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust identity-providers scim groups list` — Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust identity-providers scim users list` — Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust networks hostname-routes get <hostnameRouteId>` — Get a hostname route.\n- `cf zero-trust networks hostname-routes list` — Lists and filters hostname routes in an account.\n- `cf zero-trust networks routes get <routeId>` — Get a private network route in an account.\n- `cf zero-trust networks routes ips get <ip>` — Fetches routes that contain the given IP address.\n- `cf zero-trust networks routes list` — Lists and filters private network routes in an account.\n- `cf zero-trust networks subnets list` — Lists and filters subnets in an account.\n- `cf zero-trust networks subnets warp get <subnetId>` — Get a WARP IP assignment subnet.\n- `cf zero-trust networks virtual-networks get <virtualNetworkId>` — Get a virtual network. (supports --body)\n- `cf zero-trust networks virtual-networks list` — Lists and filters virtual networks in an account.\n- `cf zero-trust organizations doh get` — Returns the DoH settings for your Zero Trust organization.\n- `cf zero-trust organizations list` — Returns the configuration for your Zero Trust organization.\n- `cf zero-trust profiles custom list` — Lists all DLP custom profiles in an account.\n- `cf zero-trust profiles predefined get <profileId>` — Fetches a predefined DLP profile by id.\n- `cf zero-trust risk-scoring behaviours get` — Retrieves configured risk score behaviors that define how user actions affect their overall risk score.\n- `cf zero-trust risk-scoring get <userId>` — Retrieves the detailed risk score breakdown for a specific user, including contributing factors.\n- `cf zero-trust risk-scoring integrations get <integrationId>` — Gets configuration details for a specific Zero Trust risk score integration.\n- `cf zero-trust risk-scoring integrations list` — Lists all configured Zero Trust risk score integrations for the account.\n- `cf zero-trust risk-scoring integrations references get <referenceId>` — Retrieves a Zero Trust risk score integration using its external reference ID.\n- `cf zero-trust risk-scoring summary get` — Gets an aggregate summary of risk scores across the account, including distribution and trends.\n- `cf zero-trust service-tokens get <serviceTokenId>` — Fetches a single service token.\n- `cf zero-trust service-tokens list` — Lists all service tokens.\n- `cf zero-trust settings get` — Get DLP account-level settings.\n- `cf zero-trust tunnels cloudflared configurations get <tunnelId>` — Gets the configuration for a remotely-managed tunnel\n- `cf zero-trust tunnels cloudflared connections get <tunnelId>` — Fetches connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared connectors get <connectorId>` — Fetches connector and connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared get <tunnelId>` — Fetches a single Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared list` — Lists and filters Cloudflare Tunnels in an account.\n- `cf zero-trust tunnels cloudflared token get <tunnelId>` — Gets the token used to associate cloudflared with a specific tunnel.\n- `cf zero-trust tunnels list` — Lists and filters all types of Tunnels in an account.\n- `cf zero-trust tunnels warp-connector connections get <tunnelId>` — Fetches connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector connectors get <connectorId>` — Fetches connector and connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector get <tunnelId>` — Fetches a single Warp Connector Tunnel.\n- `cf zero-trust tunnels warp-connector list` — Lists and filters Warp Connector Tunnels in an account.\n- `cf zero-trust tunnels warp-connector token get <tunnelId>` — Gets the token used to associate warp device with a specific Warp Connector tunnel.\n- `cf zero-trust zone-identity-providers get <identityProviderId>` — Fetches a configured identity provider.\n- `cf zero-trust zone-identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust zone-organizations get` — Returns the configuration for your Zero Trust organization.\n\n### Create Operations\n\n- `cf zero-trust access ai-controls mcp portals create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access applications cas create <appId>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust access applications create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust access applications policies create <appId>` — Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array. (supports --dry-run, --body)\n- `cf zero-trust access applications policy-tests create` — Starts an Access policy test. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks create <bookmarkId>` — Create a new Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages create` — Create a custom page (supports --dry-run, --body)\n- `cf zero-trust access gateway-ca create` — Adds a new SSH Certificate Authority (CA). (supports --dry-run)\n- `cf zero-trust access groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets create` — Creates a new infrastructure access target for secure access through Cloudflare Access. Targets can be servers, databases, or other infrastructure. (supports --dry-run, --body)\n- `cf zero-trust access policies create` — Creates a new Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token. (supports --dry-run, --body)\n- `cf zero-trust access tags create` — Create a tag (supports --dry-run, --body)\n- `cf zero-trust access users create` — Creates a new user. (supports --dry-run, --body)\n- `cf zero-trust apps ca create <appId>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust apps create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust apps policies create <appId>` — Create a new Access policy for an application. (supports --dry-run, --body)\n- `cf zero-trust apps revoke tokens create <appId>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups create` — Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices dex-tests create` — Create a DEX test. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles create` — Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks create` — Creates a new device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom create` — Creates a device settings profile to be applied to certain devices matching the criteria. (supports --dry-run, --body)\n- `cf zero-trust devices posture create` — Creates a new device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations create` — Create a new device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices resilience global-warp-override create` — Sets the Global WARP override state. (supports --dry-run, --body)\n- `cf zero-trust devices revoke create` — Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead. (supports --dry-run, --body)\n- `cf zero-trust devices unrevoke create` — Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead. (supports --dry-run, --body)\n- `cf zero-trust dex commands create` — Initiate commands for up to 10 devices per account (supports --dry-run, --body)\n- `cf zero-trust dex rules create` — Create a DEX Rule (supports --dry-run, --body)\n- `cf zero-trust dlp datasets create` — Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload create <datasetId>` — Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists. (supports --dry-run)\n- `cf zero-trust dlp datasets versions create <version>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets versions entries create <entryId>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. (supports --dry-run, --body)\n- `cf zero-trust dlp email account-mapping create` — Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules create` — Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take. (supports --dry-run, --body)\n- `cf zero-trust dlp entries create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration create` — Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined create` — Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom create` — Creates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined create <profileId>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates create` — Create a new Zero Trust certificate. (supports --dry-run, --body)\n- `cf zero-trust gateway create` — Create a Zero Trust account for an existing Cloudflare account. (supports --dry-run)\n- `cf zero-trust gateway lists create` — Creates a new Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations create` — Create a new Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles create` — Create a new Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints create` — Create a new Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules create` — Create a new Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes create` — Create a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes create` — Routes a private network through a Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks create <ipNetworkEncoded>` — Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp create` — Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not) (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks create` — Adds a new virtual network to an account. (supports --dry-run, --body)\n- `cf zero-trust organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined create` — Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations create` — Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system. (supports --dry-run, --body)\n- `cf zero-trust service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared create` — Creates a new Cloudflare Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared management create <tunnelId>` — Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector create` — Creates a new Warp Connector Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zero-trust access ai-controls mcp portals update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access applications policies update <policyId>` — Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run, --body)\n- `cf zero-trust access applications settings edit <appId>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications settings update <appId>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications update <appId>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks update <bookmarkId>` — Updates a configured Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust access certificates update <certificateId>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages update <customPageId>` — Update a custom page (supports --dry-run, --body)\n- `cf zero-trust access groups update <groupId>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets update <targetId>` — Updates an existing infrastructure access target's configuration, including connection parameters and access policies. (supports --dry-run, --body)\n- `cf zero-trust access keys update` — Updates the Access key rotation settings for an account. (supports --dry-run, --body)\n- `cf zero-trust access policies update <policyId>` — Updates a Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens update <serviceTokenId>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust access tags update <tagName>` — Update a tag (supports --dry-run, --body)\n- `cf zero-trust access users update <userId>` — Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed). (supports --dry-run, --body)\n- `cf zero-trust apps policies make reusable update <policyId>` — Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust apps policies update <policyId>` — Update a configured Access policy. (supports --dry-run, --body)\n- `cf zero-trust apps review status update` — Update the statuses of your applications. (supports --dry-run, --body)\n- `cf zero-trust apps settings edit <appId>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps settings update <appId>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps update <appId>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust certificates update <certificateId>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust connectivity-settings edit` — Updates the Zero Trust Connectivity Settings for the given account. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups update <groupId>` — Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices dex-tests update <dexTestId>` — Update a DEX test. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles update <profileId>` — Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks update <networkId>` — Updates a configured device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom edit <policyId>` — Updates a configured device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom excludes update <policyId>` — Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom fallback-domains update <policyId>` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom includes update <policyId>` — Sets the list of routes included in the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies default certificates edit` — Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session. (supports --dry-run, --body)\n- `cf zero-trust devices policies default edit` — Updates the default device settings profile for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies default excludes update` — Sets the list of routes excluded from the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices policies default fallback-domains update` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. (supports --dry-run, --body)\n- `cf zero-trust devices policies default includes update` — Sets the list of routes included in the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations edit <integrationId>` — Updates a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices posture update <ruleId>` — Updates a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices settings edit` — Patches the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust devices settings update` — Updates the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust dex rules update <ruleId>` — Update a DEX Rule (supports --dry-run, --body)\n- `cf zero-trust dlp datasets update <datasetId>` — Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload edit <version>` — This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules update <ruleId>` — Modifies an existing DLP email scanning rule, updating detection patterns, conditions, or actions. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom update <entryId>` — Updates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries update <entryId>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp payload-logs update` — Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom update <profileId>` — Updates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined update <profileId>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints update <documentFingerprintId>` — Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents. (supports --dry-run, --body)\n- `cf zero-trust gateway audit-ssh-settings update` — Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations edit` — Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, or `certificate` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations update` — Update the current Zero Trust account configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway lists edit <listId>` — Appends or removes an item from a configured Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway lists update <listId>` — Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations update <locationId>` — Update a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway logging update` — Update logging settings for the current Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles update <pacfileId>` — Update a configured Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints edit <proxyEndpointId>` — Update a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules update <ruleId>` — Update a configured Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups update <groupId>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers update <identityProviderId>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes edit <hostnameRouteId>` — Updates a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes edit <routeId>` — Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks edit <ipNetworkEncoded>` — Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run)\n- `cf zero-trust networks subnets cloudflare-source update <addressFamily>` — Updates the Cloudflare Source subnet of the given address family (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp edit <subnetId>` — Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks edit <virtualNetworkId>` — Updates an existing virtual network. (supports --dry-run, --body)\n- `cf zero-trust organizations doh update` — Updates the DoH settings for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined update <profileId>` — Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring behaviours update` — Updates risk score behavior configurations, defining weights and thresholds for risk calculation. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations update <integrationId>` — Overwrite the reference_id, tenant_url, and active values with the ones provided. (supports --dry-run, --body)\n- `cf zero-trust seats edit` — Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false. (supports --dry-run, --body)\n- `cf zero-trust service-tokens update <serviceTokenId>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust settings edit` — Missing fields keep their existing values. (supports --dry-run, --body)\n- `cf zero-trust settings update` — Missing fields are reset to initial (unconfigured) values. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared configurations update <tunnelId>` — Adds or updates the configuration for a remotely-managed tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared edit <tunnelId>` — Updates an existing Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector edit <tunnelId>` — Updates an existing Warp Connector Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector failover update <tunnelId>` — Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers update <identityProviderId>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zero-trust access ai-controls mcp portals delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access applications cas delete <appId>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust access applications delete <appId>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust access applications policies delete <policyId>` — Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust access bookmarks delete <bookmarkId>` — Deletes a Bookmark application. (supports --dry-run, --body)\n- `cf zero-trust access certificates delete <certificateId>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust access custom-pages delete <customPageId>` — Delete a custom page (supports --dry-run)\n- `cf zero-trust access gateway-ca delete <certificateId>` — Deletes an SSH Certificate Authority. (supports --dry-run)\n- `cf zero-trust access groups delete <groupId>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust access infrastructure targets delete <targetId>` — Removes an infrastructure access target. The target will no longer be accessible through Cloudflare Access. (supports --dry-run)\n- `cf zero-trust access policies delete <policyId>` — Deletes an Access reusable policy. (supports --dry-run)\n- `cf zero-trust access service-tokens delete <serviceTokenId>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust access tags delete <tagName>` — Delete a tag (supports --dry-run)\n- `cf zero-trust access users delete <userId>` — Deletes a specific user for an account. This will also revoke any active seats and tokens for the user. (supports --dry-run)\n- `cf zero-trust apps ca delete <appId>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust apps delete <appId>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust apps policies delete <policyId>` — Delete an Access policy. (supports --dry-run)\n- `cf zero-trust certificates delete <certificateId>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust devices deployment groups delete <groupId>` — Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta. (supports --dry-run)\n- `cf zero-trust devices devices delete <deviceId>` — Deletes a WARP device. (supports --dry-run)\n- `cf zero-trust devices dex-tests delete <dexTestId>` — Delete a Device DEX test. Returns the remaining device dex tests for the account. (supports --dry-run)\n- `cf zero-trust devices ip-profiles delete <profileId>` — Delete a WARP Device IP profile. (supports --dry-run)\n- `cf zero-trust devices networks delete <networkId>` — Deletes a device managed network and fetches a list of the remaining device managed networks for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom delete <policyId>` — Deletes a device settings profile and fetches a list of the remaining profiles for an account. (supports --dry-run, --body)\n- `cf zero-trust devices posture delete <ruleId>` — Deletes a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations delete <integrationId>` — Delete a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices registrations delete <registrationId>` — Deletes a WARP registration. (supports --dry-run)\n- `cf zero-trust devices settings delete` — Resets the current device settings for a Zero Trust account. (supports --dry-run)\n- `cf zero-trust dex rules delete <ruleId>` — Delete a DEX Rule (supports --dry-run)\n- `cf zero-trust dlp datasets delete <datasetId>` — This deletes all versions of the dataset. (supports --dry-run)\n- `cf zero-trust dlp email rules delete <ruleId>` — Removes a DLP email scanning rule. The rule will no longer be applied to email messages. (supports --dry-run)\n- `cf zero-trust dlp entries custom delete <entryId>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries delete <entryId>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries integration delete <entryId>` — This is a no-op as integration entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp entries predefined delete <entryId>` — This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp profiles custom delete <profileId>` — Deletes a DLP custom profile. (supports --dry-run)\n- `cf zero-trust dlp profiles predefined delete <profileId>` — This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust document-fingerprints delete <documentFingerprintId>` — Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected. (supports --dry-run)\n- `cf zero-trust gateway certificates delete <certificateId>` — Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it. (supports --dry-run, --body)\n- `cf zero-trust gateway lists delete <listId>` — Deletes a Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations delete <locationId>` — Delete a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles delete <pacfileId>` — Delete a configured Zero Trust Gateway PAC file. (supports --dry-run)\n- `cf zero-trust gateway proxy-endpoints delete <proxyEndpointId>` — Delete a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules delete <ruleId>` — Delete a Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups delete <groupId>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust identity-providers delete <identityProviderId>` — Deletes an identity provider from Access. (supports --dry-run)\n- `cf zero-trust networks hostname-routes delete <hostnameRouteId>` — Delete a hostname route. (supports --dry-run)\n- `cf zero-trust networks routes delete <routeId>` — Deletes a private network route from an account. (supports --dry-run)\n- `cf zero-trust networks routes networks delete <ipNetworkEncoded>` — Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type. (supports --dry-run)\n- `cf zero-trust networks subnets warp delete <subnetId>` — Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result. (supports --dry-run)\n- `cf zero-trust networks virtual-networks delete <virtualNetworkId>` — Deletes an existing virtual network. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations delete <integrationId>` — Removes a Zero Trust risk score integration, disconnecting the external risk signal source. (supports --dry-run)\n- `cf zero-trust service-tokens delete <serviceTokenId>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust settings delete` — Delete (reset) DLP account-level settings to initial values. (supports --dry-run)\n- `cf zero-trust tunnels cloudflared connections delete <tunnelId>` — Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared delete <tunnelId>` — Deletes a Cloudflare Tunnel from an account. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector delete <tunnelId>` — Deletes a Warp Connector Tunnel from an account. (supports --dry-run, --body)\n- `cf zero-trust users mfa authenticators delete <authenticatorId>` — Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization. (supports --dry-run)\n- `cf zero-trust zone-identity-providers delete <identityProviderId>` — Deletes an identity provider from Access. (supports --dry-run)\n\n### Other Operations\n\n- `cf zero-trust access ai-controls mcp portals read <id>` — Retrieves gateway configuration for MCP portals. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers read <id>` — Retrieves gateway configuration for MCP portals. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers sync <id>` — Syncs an MCP server's tool catalog with the portal. (supports --dry-run)\n- `cf zero-trust access applications revoke-tokens <appId>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust access infrastructure targets bulk-delete` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-delete-v2` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-update` — Adds one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access keys rotate` — Perfoms a key rotation for an account. (supports --dry-run)\n- `cf zero-trust access service-tokens refresh <serviceTokenId>` — Refreshes the expiration of a service token. (supports --dry-run)\n- `cf zero-trust access service-tokens rotate <serviceTokenId>` — Generates a new Client Secret for a service token and revokes the old one. (supports --dry-run, --body)\n- `cf zero-trust devices devices revoke <deviceId>` — Revokes all WARP registrations associated with the specified device. (supports --dry-run)\n- `cf zero-trust devices registrations bulk-delete` — Deletes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations revoke` — Revokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations unrevoke` — Unrevokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust dex fleet-status live` — List details for live (up to 60 minutes) devices using WARP (supports --dry-run)\n- `cf zero-trust dex fleet-status over-time` — List details for devices using WARP, up to 7 days (supports --dry-run)\n- `cf zero-trust dex traceroute-tests network-path <testId>` — Get a breakdown of metrics by hop for individual traceroute test runs (supports --dry-run)\n- `cf zero-trust dex traceroute-tests percentiles <testId>` — Get percentiles for a traceroute test for a given time period between 1 hour and 7 days. (supports --dry-run)\n- `cf zero-trust dlp email rules bulk-edit` — Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first. (supports --dry-run, --body)\n- `cf zero-trust dlp patterns validate` — Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create document fingerprints` — Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create v2 <documentFingerprintId>` — Updates metadata for an existing document fingerprint, such as its name or description. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints get document fingerprints <documentFingerprintId>` — Retrieve data about a specific document fingerprint. (supports --dry-run)\n- `cf zero-trust document-fingerprints get fingerprints all` — Lists all document fingerprints configured for DLP scanning in the account. (supports --dry-run)\n- `cf zero-trust gateway audit-ssh-settings rotate-seed` — Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy. (supports --dry-run)\n- `cf zero-trust gateway certificates activate <certificateId>` — Bind a single Zero Trust certificate to the edge. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates deactivate <certificateId>` — Unbind a single Zero Trust certificate from the edge. (supports --dry-run, --body)\n- `cf zero-trust gateway rules list-tenant` — List Zero Trust Gateway rules for the parent account of an account in the MSP configuration. (supports --dry-run)\n- `cf zero-trust gateway rules reset-expiration <ruleId>` — Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`. (supports --dry-run)\n- `cf zero-trust organizations revoke-users` — Revokes a user's access across all applications. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring reset <userId>` — Resets risk scores for specified users, clearing their accumulated risk history. (supports --dry-run)\n- `cf zero-trust zone-organizations revoke-user-create` — Revokes a user's access across all applications. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones environments list` — List zone environments\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Zone Details\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <planIdentifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <settingId>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Create Zone (supports --dry-run, --body)\n- `cf zones environments create` — Create zone environments (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones environments edit` — Partially update zone environments (supports --dry-run, --body)\n- `cf zones environments update` — Upsert zone environments (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <settingId>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run, --body)\n- `cf zones environments delete <environmentId>` — Delete zone environment (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. (supports --dry-run)\n\n### Other Operations\n\n- `cf zones activation-check trigger` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n- `cf zones environments rollback <environmentId>` — Roll back zone environment (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
+		"zero-trust": "# zero-trust — Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation\n\n## Commands\n\n### Read Operations\n\n- `cf zero-trust access ai-controls mcp portals list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access ai-controls mcp servers list` — Lists all MCP portals configured for the account.\n- `cf zero-trust access applications cas get <app-id>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust access applications cas list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust access applications get <app-id>` — Fetches information about an Access application.\n- `cf zero-trust access applications list` — Lists all Access applications in an account.\n- `cf zero-trust access applications policies get <policy-id>` — Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.\n- `cf zero-trust access applications policies list` — Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.\n- `cf zero-trust access applications policy-tests get <policy-test-id>` — Fetches the current status of a given Access policy test.\n- `cf zero-trust access applications policy-tests users list` — Fetches a single page of user results from an Access policy test.\n- `cf zero-trust access applications user-policy-checks list` — Tests if a specific user has permission to access an application.\n- `cf zero-trust access bookmarks get <bookmark-id>` — Fetches a single Bookmark application.\n- `cf zero-trust access bookmarks list` — Lists Bookmark applications.\n- `cf zero-trust access certificates get <certificate-id>` — Fetches a single mTLS certificate.\n- `cf zero-trust access certificates list` — Lists all mTLS root certificates.\n- `cf zero-trust access certificates settings get` — List all mTLS hostname settings for this account.\n- `cf zero-trust access custom-pages get <custom-page-id>` — Fetches a custom page and also returns its HTML.\n- `cf zero-trust access custom-pages list` — List custom pages\n- `cf zero-trust access gateway-ca list` — Lists SSH Certificate Authorities (CA).\n- `cf zero-trust access groups get <group-id>` — Fetches a single Access group.\n- `cf zero-trust access groups list` — Lists all Access groups.\n- `cf zero-trust access infrastructure targets get <target-id>` — Get target\n- `cf zero-trust access infrastructure targets list` — Lists and sorts an account’s targets. Filters are optional and are ANDed together.\n- `cf zero-trust access keys get` — Gets the Access key rotation settings for an account.\n- `cf zero-trust access logs access-requests list` — Gets a list of Access authentication audit logs for an account.\n- `cf zero-trust access logs scim updates list` — Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust access policies get <policy-id>` — Fetches a single Access reusable policy.\n- `cf zero-trust access policies list` — Lists Access reusable policies.\n- `cf zero-trust access service-tokens get <service-token-id>` — Fetches a single service token.\n- `cf zero-trust access service-tokens list` — Lists all service tokens.\n- `cf zero-trust access tags get <tag-name>` — Get a tag\n- `cf zero-trust access tags list` — List tags\n- `cf zero-trust access users active-sessions get <nonce>` — Get an active session for a single user.\n- `cf zero-trust access users active-sessions list` — Get active sessions for a single user.\n- `cf zero-trust access users failed-logins list` — Get all failed login attempts for a single user.\n- `cf zero-trust access users get <user-id>` — Gets a specific user for an account.\n- `cf zero-trust access users last-seen-identity get <user-id>` — Get last seen identity for a single user.\n- `cf zero-trust access users list` — Gets a list of users for an account.\n- `cf zero-trust apps ca get <app-id>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust apps ca list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust apps get <app-id>` — Fetches information about an Access application.\n- `cf zero-trust apps list` — List all Access Applications in a zone.\n- `cf zero-trust apps policies get <policy-id>` — Fetches a single Access policy.\n- `cf zero-trust apps policies list` — Lists Access policies configured for an application.\n- `cf zero-trust apps review status list` — Retrieve the statuses of your applications.\n- `cf zero-trust apps user policy checks get <app-id>` — Tests if a specific user has permission to access an application.\n- `cf zero-trust certificates get <certificate-id>` — Fetches a single mTLS certificate.\n- `cf zero-trust certificates list` — Lists all mTLS certificates.\n- `cf zero-trust certificates settings list` — List all mTLS hostname settings for this zone.\n- `cf zero-trust connectivity-settings get` — Gets the Zero Trust Connectivity Settings for the given account.\n- `cf zero-trust devices client target environments list` — Retrieves a list of all available target environments with their display names. This endpoint is in Beta.\n- `cf zero-trust devices client versions list` — Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups get <group-id>` — Fetches a single deployment group by its ID. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups list` — Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.\n- `cf zero-trust devices get <device-id>` — Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}\n- `cf zero-trust devices ip-profiles get <profile-id>` — Fetches a single WARP Device IP profile.\n- `cf zero-trust devices ip-profiles list` — Lists WARP Device IP profiles.\n- `cf zero-trust devices list` — List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations\n- `cf zero-trust devices networks get <network-id>` — Fetches details for a single managed network.\n- `cf zero-trust devices networks list` — Fetches a list of managed networks for an account.\n- `cf zero-trust devices override-codes get <registration-id>` — Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.\n- `cf zero-trust devices override-codes list` — Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.\n- `cf zero-trust devices physical-devices get <device-id>` — Fetches a single WARP device.\n- `cf zero-trust devices physical-devices list` — Lists WARP devices.\n- `cf zero-trust devices policies custom excludes get <policy-id>` — Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom fallback-domains get <policy-id>` — Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies custom get <policy-id>` — Fetches a device settings profile by ID.\n- `cf zero-trust devices policies custom includes get <policy-id>` — Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom list` — Fetches a list of the device settings profiles for an account.\n- `cf zero-trust devices policies default certificates get` — Fetches device certificate provisioning.\n- `cf zero-trust devices policies default excludes get` — Fetches the list of routes excluded from the WARP client's tunnel.\n- `cf zero-trust devices policies default fallback-domains get` — Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies default get` — Fetches the default device settings profile for an account.\n- `cf zero-trust devices policies default includes get` — Fetches the list of routes included in the WARP client's tunnel.\n- `cf zero-trust devices posture get <rule-id>` — Fetches a single device posture rule.\n- `cf zero-trust devices posture integrations get <integration-id>` — Fetches details for a single device posture integration.\n- `cf zero-trust devices posture integrations list` — Fetches the list of device posture integrations for an account.\n- `cf zero-trust devices posture list` — Fetches device posture rules for a Zero Trust account.\n- `cf zero-trust devices registrations get <registration-id>` — Fetches a single WARP registration.\n- `cf zero-trust devices registrations list` — Lists WARP registrations.\n- `cf zero-trust devices resilience global-warp-override get` — Fetch the Global WARP override state.\n- `cf zero-trust devices settings get` — Describes the current device settings for a Zero Trust account.\n- `cf zero-trust dex colos list` — List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.\n- `cf zero-trust dex commands eligible-devices list` — List devices with WARP client support for remote captures which have been connected in the last 1 hour.\n- `cf zero-trust dex commands list` — Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters\n- `cf zero-trust dex commands quota get` — Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset\n- `cf zero-trust dex commands results get <filename>` — Downloads artifacts for an executed command. Bulk downloads are not supported\n- `cf zero-trust dex devices aggregates live get` — Get details for live (up to 60 minutes) devices using WARP.\n- `cf zero-trust dex devices aggregates over-time get` — Get aggregate details for devices using WARP, up to 7 days.\n- `cf zero-trust dex devices get <device-id>` — Get the latest status of a device given device_id from the device_state table.\n- `cf zero-trust dex devices list` — List details of devices using WARP.\n- `cf zero-trust dex devices over-time get <device-id>` — Get time-bucketed status metrics for a specific device.\n- `cf zero-trust dex isps list` — List ISP information observed for a specific device during traceroute tests.\n- `cf zero-trust dex overview tests list` — List DEX tests with overview metrics.\n- `cf zero-trust dex overview tests unique-devices get` — Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.\n- `cf zero-trust dex rules get <rule-id>` — Get details for a DEX Rule.\n- `cf zero-trust dex rules list` — List DEX Rules.\n- `cf zero-trust dex test-results http get <test-id>` — Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results http percentiles get <test-id>` — Get percentiles for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute get <test-id>` — Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute network-path get <test-result-id>` — Get a breakdown of hops and performance metrics for a specific traceroute test run\n- `cf zero-trust dex test-results traceroute percentiles get <test-id>` — Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex tests get <dex-test-id>` — Fetch a single DEX test.\n- `cf zero-trust dex tests list` — Fetch all DEX tests.\n- `cf zero-trust dex tests network-path get <test-id>` — Get a breakdown of metrics by hop for individual traceroute test runs.\n- `cf zero-trust dex warp-change-events list` — List WARP configuration and enablement toggle change events by device.\n- `cf zero-trust dlp datasets get <dataset-id>` — Gets a dataset and its latest upload status.\n- `cf zero-trust dlp datasets list` — Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.\n- `cf zero-trust dlp email account-mapping get` — Retrieves the email provider mapping configuration for DLP email scanning.\n- `cf zero-trust dlp email rules get <rule-id>` — Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.\n- `cf zero-trust dlp email rules list` — Lists all email scanner rules for an account.\n- `cf zero-trust dlp entries get <entry-id>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp limits list` — Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.\n- `cf zero-trust dlp payload-logs get` — Gets the current payload logging configuration for DLP, showing whether matched content is being logged.\n- `cf zero-trust dlp profiles custom get <profile-id>` — Fetches a custom DLP profile by id.\n- `cf zero-trust dlp profiles get <profile-id>` — Fetches a DLP profile by ID.\n- `cf zero-trust dlp profiles list` — Lists all DLP profiles in an account.\n- `cf zero-trust dlp profiles predefined get <profile-id>` — This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.\n- `cf zero-trust gateway app-types list` — List all application and application type mappings.\n- `cf zero-trust gateway audit-ssh-settings get` — Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.\n- `cf zero-trust gateway categories list` — List all categories.\n- `cf zero-trust gateway certificates get <certificate-id>` — Get a single Zero Trust certificate.\n- `cf zero-trust gateway certificates list` — List all Zero Trust certificates for an account.\n- `cf zero-trust gateway configurations custom-certificate get` — Retrieve the current Zero Trust certificate configuration.\n- `cf zero-trust gateway configurations get` — Retrieve the current Zero Trust account configuration.\n- `cf zero-trust gateway list` — Retrieve information about the current Zero Trust account.\n- `cf zero-trust gateway lists get <list-id>` — Fetch a single Zero Trust list.\n- `cf zero-trust gateway lists items list` — Fetch all items in a single Zero Trust list.\n- `cf zero-trust gateway lists list` — Fetch all Zero Trust lists for an account.\n- `cf zero-trust gateway locations get <location-id>` — Get a single Zero Trust Gateway location.\n- `cf zero-trust gateway locations list` — List Zero Trust Gateway locations for an account.\n- `cf zero-trust gateway logging get` — Retrieve the current logging settings for the Zero Trust account.\n- `cf zero-trust gateway pacfiles get <pacfile-id>` — Get a single Zero Trust Gateway PAC file.\n- `cf zero-trust gateway pacfiles list` — List all Zero Trust Gateway PAC files for an account.\n- `cf zero-trust gateway proxy-endpoints get <proxy-endpoint-id>` — Get a single Zero Trust Gateway proxy endpoint.\n- `cf zero-trust gateway proxy-endpoints list` — List all Zero Trust Gateway proxy endpoints for an account.\n- `cf zero-trust gateway rules get <rule-id>` — Get a single Zero Trust Gateway rule.\n- `cf zero-trust gateway rules list` — List Zero Trust Gateway rules for an account.\n- `cf zero-trust groups get <group-id>` — Fetches a single Access group.\n- `cf zero-trust groups list` — Lists all Access groups.\n- `cf zero-trust identity-providers get <identity-provider-id>` — Fetches a configured identity provider.\n- `cf zero-trust identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust identity-providers scim groups list` — Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust identity-providers scim users list` — Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust networks hostname-routes get <hostname-route-id>` — Get a hostname route.\n- `cf zero-trust networks hostname-routes list` — Lists and filters hostname routes in an account.\n- `cf zero-trust networks routes get <route-id>` — Get a private network route in an account.\n- `cf zero-trust networks routes ips get <ip>` — Fetches routes that contain the given IP address.\n- `cf zero-trust networks routes list` — Lists and filters private network routes in an account.\n- `cf zero-trust networks subnets list` — Lists and filters subnets in an account.\n- `cf zero-trust networks subnets warp get <subnet-id>` — Get a WARP IP assignment subnet.\n- `cf zero-trust networks virtual-networks get <virtual-network-id>` — Get a virtual network. (supports --body)\n- `cf zero-trust networks virtual-networks list` — Lists and filters virtual networks in an account.\n- `cf zero-trust organizations doh get` — Returns the DoH settings for your Zero Trust organization.\n- `cf zero-trust organizations list` — Returns the configuration for your Zero Trust organization.\n- `cf zero-trust profiles custom list` — Lists all DLP custom profiles in an account.\n- `cf zero-trust profiles predefined get <profile-id>` — Fetches a predefined DLP profile by id.\n- `cf zero-trust risk-scoring behaviours get` — Retrieves configured risk score behaviors that define how user actions affect their overall risk score.\n- `cf zero-trust risk-scoring get <user-id>` — Retrieves the detailed risk score breakdown for a specific user, including contributing factors.\n- `cf zero-trust risk-scoring integrations get <integration-id>` — Gets a Zero Trust risk score integration by ID.\n- `cf zero-trust risk-scoring integrations list` — Lists all configured Zero Trust risk score integrations for the account.\n- `cf zero-trust risk-scoring integrations references get <reference-id>` — Retrieves a Zero Trust risk score integration using its external reference ID.\n- `cf zero-trust risk-scoring summary get` — Gets an aggregate summary of risk scores across the account, including distribution and trends.\n- `cf zero-trust service-tokens get <service-token-id>` — Fetches a single service token.\n- `cf zero-trust service-tokens list` — Lists all service tokens.\n- `cf zero-trust settings get` — Gets the account-level DLP settings.\n- `cf zero-trust tunnels cloudflared configurations get <tunnel-id>` — Gets the configuration for a remotely-managed tunnel\n- `cf zero-trust tunnels cloudflared connections get <tunnel-id>` — Fetches connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared connectors get <connector-id>` — Fetches connector and connection details for a Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared get <tunnel-id>` — Fetches a single Cloudflare Tunnel.\n- `cf zero-trust tunnels cloudflared list` — Lists and filters Cloudflare Tunnels in an account.\n- `cf zero-trust tunnels cloudflared token get <tunnel-id>` — Gets the token used to associate cloudflared with a specific tunnel.\n- `cf zero-trust tunnels list` — Lists and filters all types of Tunnels in an account.\n- `cf zero-trust tunnels warp-connector connections get <tunnel-id>` — Fetches connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector connectors get <connector-id>` — Fetches connector and connection details for a WARP Connector Tunnel.\n- `cf zero-trust tunnels warp-connector get <tunnel-id>` — Fetches a single Warp Connector Tunnel.\n- `cf zero-trust tunnels warp-connector list` — Lists and filters Warp Connector Tunnels in an account.\n- `cf zero-trust tunnels warp-connector token get <tunnel-id>` — Gets the token used to associate warp device with a specific Warp Connector tunnel.\n- `cf zero-trust zone-identity-providers get <identity-provider-id>` — Fetches a configured identity provider.\n- `cf zero-trust zone-identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust zone-organizations get` — Returns the configuration for your Zero Trust organization.\n\n### Create Operations\n\n- `cf zero-trust access ai-controls mcp portals create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf zero-trust access applications cas create <app-id>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust access applications create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust access applications policies create <app-id>` — Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array. (supports --dry-run, --body)\n- `cf zero-trust access applications policy-tests create` — Starts an Access policy test. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks create <bookmark-id>` — Create a new Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages create` — Create a custom page (supports --dry-run, --body)\n- `cf zero-trust access gateway-ca create` — Adds a new SSH Certificate Authority (CA). (supports --dry-run)\n- `cf zero-trust access groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets create` — Create new target (supports --dry-run, --body)\n- `cf zero-trust access policies create` — Creates a new Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token. (supports --dry-run, --body)\n- `cf zero-trust access tags create` — Create a tag (supports --dry-run, --body)\n- `cf zero-trust access users create` — Creates a new user. (supports --dry-run, --body)\n- `cf zero-trust apps ca create <app-id>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust apps create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust apps policies create <app-id>` — Create a new Access policy for an application. (supports --dry-run, --body)\n- `cf zero-trust apps revoke tokens create <app-id>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups create` — Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles create` — Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks create` — Creates a new device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom create` — Creates a device settings profile to be applied to certain devices matching the criteria. (supports --dry-run, --body)\n- `cf zero-trust devices posture create` — Creates a new device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations create` — Create a new device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices resilience global-warp-override create` — Sets the Global WARP override state. (supports --dry-run, --body)\n- `cf zero-trust devices revoke create` — Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead. (supports --dry-run, --body)\n- `cf zero-trust devices unrevoke create` — Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead. (supports --dry-run, --body)\n- `cf zero-trust dex commands create` — Initiate commands for up to 10 devices per account. (supports --dry-run, --body)\n- `cf zero-trust dex rules create` — Create a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests create` — Create a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets create` — Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload create <dataset-id>` — Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists. (supports --dry-run)\n- `cf zero-trust dlp datasets versions create <version>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets versions entries create <entry-id>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. (supports --dry-run, --body)\n- `cf zero-trust dlp email account-mapping create` — Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules create` — Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take. (supports --dry-run, --body)\n- `cf zero-trust dlp entries create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration create` — Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined create` — Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom create` — Creates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined create <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates create` — Create a new Zero Trust certificate. (supports --dry-run, --body)\n- `cf zero-trust gateway create` — Create a Zero Trust account for an existing Cloudflare account. (supports --dry-run)\n- `cf zero-trust gateway lists create` — Creates a new Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations create` — Create a new Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles create` — Create a new Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints create` — Create a new Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules create` — Create a new Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes create` — Create a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes create` — Routes a private network through a Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks create <ip-network-encoded>` — Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp create` — Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not) (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks create` — Adds a new virtual network to an account. (supports --dry-run, --body)\n- `cf zero-trust organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined create` — Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations create` — Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system. (supports --dry-run, --body)\n- `cf zero-trust service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared create` — Creates a new Cloudflare Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared management create <tunnel-id>` — Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector create` — Creates a new Warp Connector Tunnel in an account. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zero-trust access ai-controls mcp portals update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access ai-controls mcp servers update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf zero-trust access applications policies update <policy-id>` — Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run, --body)\n- `cf zero-trust access applications settings edit <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications settings update <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications update <app-id>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks update <bookmark-id>` — Updates a configured Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust access certificates update <certificate-id>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages update <custom-page-id>` — Update a custom page (supports --dry-run, --body)\n- `cf zero-trust access groups update <group-id>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets update <target-id>` — Update target (supports --dry-run, --body)\n- `cf zero-trust access keys update` — Updates the Access key rotation settings for an account. (supports --dry-run, --body)\n- `cf zero-trust access policies update <policy-id>` — Updates a Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens update <service-token-id>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust access tags update <tag-name>` — Update a tag (supports --dry-run, --body)\n- `cf zero-trust access users update <user-id>` — Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed). (supports --dry-run, --body)\n- `cf zero-trust apps policies make reusable update <policy-id>` — Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust apps policies update <policy-id>` — Update a configured Access policy. (supports --dry-run, --body)\n- `cf zero-trust apps review status update` — Update the statuses of your applications. (supports --dry-run, --body)\n- `cf zero-trust apps settings edit <app-id>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps settings update <app-id>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps update <app-id>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust certificates update <certificate-id>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust connectivity-settings edit` — Updates the Zero Trust Connectivity Settings for the given account. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups update <group-id>` — Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles update <profile-id>` — Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks update <network-id>` — Updates a configured device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom edit <policy-id>` — Updates a configured device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom excludes update <policy-id>` — Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom fallback-domains update <policy-id>` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom includes update <policy-id>` — Sets the list of routes included in the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies default certificates edit` — Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session. (supports --dry-run, --body)\n- `cf zero-trust devices policies default edit` — Updates the default device settings profile for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies default excludes update` — Sets the list of routes excluded from the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices policies default fallback-domains update` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. (supports --dry-run, --body)\n- `cf zero-trust devices policies default includes update` — Sets the list of routes included in the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations edit <integration-id>` — Updates a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices posture update <rule-id>` — Updates a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices settings edit` — Patches the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust devices settings update` — Updates the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust dex rules update <rule-id>` — Update a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests update <dex-test-id>` — Update a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets update <dataset-id>` — Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload edit <version>` — This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules update <rule-id>` — Updates a DLP email scanning rule. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom update <entry-id>` — Updates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp payload-logs update` — Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom update <profile-id>` — Updates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined update <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints update <document-fingerprint-id>` — Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents. (supports --dry-run, --body)\n- `cf zero-trust gateway audit-ssh-settings update` — Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations edit` — Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations update` — Update the current Zero Trust account configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway lists edit <list-id>` — Appends or removes an item from a configured Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway lists update <list-id>` — Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations update <location-id>` — Update a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway logging update` — Update logging settings for the current Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles update <pacfile-id>` — Update a configured Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints edit <proxy-endpoint-id>` — Update a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules update <rule-id>` — Update a configured Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups update <group-id>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers update <identity-provider-id>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust networks hostname-routes edit <hostname-route-id>` — Updates a hostname route. (supports --dry-run, --body)\n- `cf zero-trust networks routes edit <route-id>` — Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request. (supports --dry-run, --body)\n- `cf zero-trust networks routes networks edit <ip-network-encoded>` — Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. (supports --dry-run)\n- `cf zero-trust networks subnets cloudflare-source update <address-family>` — Updates the Cloudflare Source subnet of the given address family (supports --dry-run, --body)\n- `cf zero-trust networks subnets warp edit <subnet-id>` — Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated (supports --dry-run, --body)\n- `cf zero-trust networks virtual-networks edit <virtual-network-id>` — Updates an existing virtual network. (supports --dry-run, --body)\n- `cf zero-trust organizations doh update` — Updates the DoH settings for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined update <profile-id>` — Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring behaviours update` — Updates risk score behavior configurations, defining weights and thresholds for risk calculation. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations update <integration-id>` — Overwrite the reference_id, tenant_url, and active values with the ones provided. (supports --dry-run, --body)\n- `cf zero-trust seats edit` — Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false. (supports --dry-run, --body)\n- `cf zero-trust service-tokens update <service-token-id>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust settings edit` — Missing fields keep their existing values. (supports --dry-run, --body)\n- `cf zero-trust settings update` — Missing fields are reset to initial (unconfigured) values. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared configurations update <tunnel-id>` — Adds or updates the configuration for a remotely-managed tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels cloudflared edit <tunnel-id>` — Updates an existing Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector edit <tunnel-id>` — Updates an existing Warp Connector Tunnel. (supports --dry-run, --body)\n- `cf zero-trust tunnels warp-connector failover update <tunnel-id>` — Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers update <identity-provider-id>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zero-trust access ai-controls mcp portals delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf zero-trust access applications cas delete <app-id>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust access applications delete <app-id>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust access applications policies delete <policy-id>` — Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust access bookmarks delete <bookmark-id>` — Deletes a Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates delete <certificate-id>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust access custom-pages delete <custom-page-id>` — Delete a custom page (supports --dry-run)\n- `cf zero-trust access gateway-ca delete <certificate-id>` — Deletes an SSH Certificate Authority. (supports --dry-run)\n- `cf zero-trust access groups delete <group-id>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust access infrastructure targets delete <target-id>` — Delete target (supports --dry-run)\n- `cf zero-trust access policies delete <policy-id>` — Deletes an Access reusable policy. (supports --dry-run)\n- `cf zero-trust access service-tokens delete <service-token-id>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust access tags delete <tag-name>` — Delete a tag (supports --dry-run)\n- `cf zero-trust access users delete <user-id>` — Deletes a specific user for an account. This will also revoke any active seats and tokens for the user. (supports --dry-run)\n- `cf zero-trust apps ca delete <app-id>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust apps delete <app-id>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust apps policies delete <policy-id>` — Delete an Access policy. (supports --dry-run)\n- `cf zero-trust certificates delete <certificate-id>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust devices deployment groups delete <group-id>` — Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta. (supports --dry-run)\n- `cf zero-trust devices ip-profiles delete <profile-id>` — Delete a WARP Device IP profile. (supports --dry-run)\n- `cf zero-trust devices networks delete <network-id>` — Deletes a device managed network and fetches a list of the remaining device managed networks for an account. (supports --dry-run)\n- `cf zero-trust devices physical-devices delete <device-id>` — Deletes a WARP device. (supports --dry-run)\n- `cf zero-trust devices policies custom delete <policy-id>` — Deletes a device settings profile and fetches a list of the remaining profiles for an account. (supports --dry-run)\n- `cf zero-trust devices posture delete <rule-id>` — Deletes a device posture rule. (supports --dry-run)\n- `cf zero-trust devices posture integrations delete <integration-id>` — Delete a configured device posture integration. (supports --dry-run)\n- `cf zero-trust devices registrations delete <registration-id>` — Deletes a WARP registration. (supports --dry-run)\n- `cf zero-trust devices settings delete` — Resets the current device settings for a Zero Trust account. (supports --dry-run)\n- `cf zero-trust dex rules delete <rule-id>` — Delete a DEX Rule. (supports --dry-run)\n- `cf zero-trust dex tests delete <dex-test-id>` — Delete a Device DEX test. Returns the remaining device dex tests for the account. (supports --dry-run)\n- `cf zero-trust dlp datasets delete <dataset-id>` — This deletes all versions of the dataset. (supports --dry-run)\n- `cf zero-trust dlp email rules delete <rule-id>` — Removes a DLP email scanning rule. The rule will no longer be applied to email messages. (supports --dry-run)\n- `cf zero-trust dlp entries delete <entry-id>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries integration delete <entry-id>` — This is a no-op as integration entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp entries predefined delete <entry-id>` — This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp profiles custom delete <profile-id>` — Deletes a DLP custom profile. (supports --dry-run)\n- `cf zero-trust dlp profiles predefined delete <profile-id>` — This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust document-fingerprints delete <document-fingerprint-id>` — Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected. (supports --dry-run)\n- `cf zero-trust gateway certificates delete <certificate-id>` — Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it. (supports --dry-run)\n- `cf zero-trust gateway lists delete <list-id>` — Deletes a Zero Trust list. (supports --dry-run)\n- `cf zero-trust gateway locations delete <location-id>` — Delete a configured Zero Trust Gateway location. (supports --dry-run)\n- `cf zero-trust gateway pacfiles delete <pacfile-id>` — Delete a configured Zero Trust Gateway PAC file. (supports --dry-run)\n- `cf zero-trust gateway proxy-endpoints delete <proxy-endpoint-id>` — Delete a configured Zero Trust Gateway proxy endpoint. (supports --dry-run)\n- `cf zero-trust gateway rules delete <rule-id>` — Delete a Zero Trust Gateway rule. (supports --dry-run)\n- `cf zero-trust groups delete <group-id>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust identity-providers delete <identity-provider-id>` — Deletes an identity provider from Access. (supports --dry-run)\n- `cf zero-trust networks hostname-routes delete <hostname-route-id>` — Delete a hostname route. (supports --dry-run)\n- `cf zero-trust networks routes delete <route-id>` — Deletes a private network route from an account. (supports --dry-run)\n- `cf zero-trust networks routes networks delete <ip-network-encoded>` — Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type. (supports --dry-run)\n- `cf zero-trust networks subnets warp delete <subnet-id>` — Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result. (supports --dry-run)\n- `cf zero-trust networks virtual-networks delete <virtual-network-id>` — Deletes an existing virtual network. (supports --dry-run)\n- `cf zero-trust risk-scoring integrations delete <integration-id>` — Removes a Zero Trust risk score integration, disconnecting the external risk signal source. (supports --dry-run)\n- `cf zero-trust service-tokens delete <service-token-id>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust settings delete` — Deletes account-level DLP settings and returns the initial values. (supports --dry-run)\n- `cf zero-trust tunnels cloudflared connections delete <tunnel-id>` — Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens. (supports --dry-run)\n- `cf zero-trust tunnels cloudflared delete <tunnel-id>` — Deletes a Cloudflare Tunnel from an account. (supports --dry-run)\n- `cf zero-trust tunnels warp-connector delete <tunnel-id>` — Deletes a Warp Connector Tunnel from an account. (supports --dry-run)\n- `cf zero-trust users mfa authenticators delete <authenticator-id>` — Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization. (supports --dry-run)\n- `cf zero-trust zone-identity-providers delete <identity-provider-id>` — Deletes an identity provider from Access. (supports --dry-run)\n\n### Other Operations\n\n- `cf zero-trust access ai-controls mcp portals read <id>` — Read the details of a single MCP Portal, including its configured servers. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers read <id>` — Retrieves gateway configuration for MCP portals. (supports --dry-run)\n- `cf zero-trust access ai-controls mcp servers sync <id>` — Syncs an MCP server's capabilities and returns the updated server state, including any connection errors. (supports --dry-run)\n- `cf zero-trust access applications revoke-tokens <app-id>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust access infrastructure targets bulk-delete` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-delete-v2` — Removes one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access infrastructure targets bulk-update` — Adds one or more targets. (supports --dry-run, --body)\n- `cf zero-trust access keys rotate` — Perfoms a key rotation for an account. (supports --dry-run)\n- `cf zero-trust access service-tokens refresh <service-token-id>` — Refreshes the expiration of a service token. (supports --dry-run)\n- `cf zero-trust access service-tokens rotate <service-token-id>` — Generates a new Client Secret for a service token and revokes the old one. (supports --dry-run, --body)\n- `cf zero-trust devices physical-devices revoke <device-id>` — Revokes all WARP registrations associated with the specified device. (supports --dry-run)\n- `cf zero-trust devices registrations bulk-delete` — Deletes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations revoke` — Revokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations unrevoke` — Unrevokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust dlp email rules bulk-edit` — Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first. (supports --dry-run, --body)\n- `cf zero-trust dlp patterns validate` — Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create document fingerprints` — Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create v2 <document-fingerprint-id>` — Updates metadata for an existing document fingerprint, such as its name or description. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints get document fingerprints <document-fingerprint-id>` — Gets a document fingerprint and its latest upload status. (supports --dry-run)\n- `cf zero-trust document-fingerprints get fingerprints all` — Lists all document fingerprints configured for DLP scanning in the account. (supports --dry-run)\n- `cf zero-trust gateway audit-ssh-settings rotate-seed` — Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy. (supports --dry-run)\n- `cf zero-trust gateway certificates activate <certificate-id>` — Bind a single Zero Trust certificate to the edge. (supports --dry-run)\n- `cf zero-trust gateway certificates deactivate <certificate-id>` — Unbind a single Zero Trust certificate from the edge. (supports --dry-run)\n- `cf zero-trust gateway rules list-tenant` — List Zero Trust Gateway rules for the parent account of an account in the MSP configuration. (supports --dry-run)\n- `cf zero-trust gateway rules reset-expiration <rule-id>` — Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`. (supports --dry-run)\n- `cf zero-trust organizations revoke-users` — Revokes a user's access across all applications. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring reset <user-id>` — Resets risk scores for specified users, clearing their accumulated risk history. (supports --dry-run)\n- `cf zero-trust zone-organizations revoke-user-create` — Revokes a user's access across all applications. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones environments list` — Lists configured environments for a zone.\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Zone Details\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <plan-identifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <setting-id>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Create Zone (supports --dry-run, --body)\n- `cf zones environments create` — Creates environments for a zone. (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. Zone holds cannot be enabled on CDN-only zones. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones environments edit` — Applies partial updates to zone environments. (supports --dry-run, --body)\n- `cf zones environments update` — Replaces the full environment configuration for a zone. (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. Existing zone holds can be removed from CDN-only zones by setting `hold_after` to `null`. Other zone hold updates cannot be made on CDN-only zones. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <setting-id>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run)\n- `cf zones environments delete <environment-id>` — Deletes a zone environment by reference identifier. (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. Existing zone holds can be removed from CDN-only zones when `hold_after` is not provided. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run)\n\n### Other Operations\n\n- `cf zones activation-check trigger` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n- `cf zones environments rollback <environment-id>` — Rolls a zone environment back to its previous version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
 	},
 	"universal": "# cf CLI Agent Guide\n\n## Authentication\n- Preferred: Set CLOUDFLARE_API_TOKEN environment variable\n- Alternative: `cf auth login` for OAuth flow\n- Verify: `cf auth whoami`\n\n## Output\n- All output is JSON; pipe through `jq` for transforms\n\n## Safety\n- Always use `--dry-run` before create/update/delete operations\n- Use `--body '{...}'` for complex request payloads\n- Verify zone resolution with `--quiet` disabled\n\n## Context Resolution\n\nAccount ID priority (highest to lowest):\n1. `CLOUDFLARE_ACCOUNT_ID` environment variable\n2. Project config (`.cfrc` walked up from cwd)\n3. User config (`~/.config/cf/config.json`)\n4. Interactive account picker / single-account auto-select\n\nZone priority (highest to lowest):\n1. `--zone` / `-z` flag\n2. `CLOUDFLARE_ZONE_ID` environment variable\n3. Project config (`.cfrc` walked up from cwd)\n4. User config (`~/.config/cf/config.json`)\n\nSet defaults to avoid repeating IDs:\n```bash\ncf context set account-id <id>\ncf context set zone example.com --project\n```\n\n## Introspection\n- `cf schema --list` — list all available API schemas\n- `cf schema dns records create` — get full request/response schema for a command\n- `cf agent-context [product]` — load agent skill files\n- `cf tools` — get MCP tool definitions\n\n## Error Handling\n- Non-zero exit codes indicate errors\n- Error details are in stderr\n- Check `cf auth whoami` if you get 401 errors\n"
 }