cf 0.9.0 → 0.10.0

package/dist/_meta/agent-context.json

@@ -2,14 +2,14 @@
 	"version": "1.0",
 	"generatedAt": "build-time",
 	"products": {
-		"abuse-reports": "# abuse-reports — Submit and track abuse reports for phishing, malware, and other policy violations on Cloudflare-proxied sites\n\n## Commands\n\n### Read Operations\n\n- `cf abuse-reports emails list` — List emails sent to the customer for an abuse report. Returns all successful customer emails sent for the specified abuse report. Does not include emails sent to hosts or submitters.\n- `cf abuse-reports get <report-param>` — Retrieve the details of an abuse report.\n- `cf abuse-reports list` — List the abuse reports for a given account\n- `cf abuse-reports mitigations list` — List mitigations done to remediate the abuse report.\n\n### Create Operations\n\n- `cf abuse-reports create <report-param>` — Submit an abuse report of a particular type. Requires the abuse-reports entitlement on the account (Enterprise accounts have it by default; other accounts must request access) and an API token with the `Account > Abuse Reports > Edit` permission. If the account is not entitled, the request is rejected with an HTTP `401` response (see below). (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf abuse-reports appeals eligibility <report-id>` — Returns whether the report is currently appealable, along with the signals behind that decision: whether it already has an open appeal, how many appeals have been submitted against it, and whether it has at least one mitigation that an appeal could reverse. (supports --dry-run)\n- `cf abuse-reports mitigations review <report-id>` — Request a review for mitigations on an account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"abuse-reports": "# abuse-reports — Submit and track abuse reports for phishing, malware, and other policy violations on Cloudflare-proxied sites\n\n## Commands\n\n### Read Operations\n\n- `cf abuse-reports emails list` — List emails sent to the customer for an abuse report. Returns all successful customer emails sent for the specified abuse report. Does not include emails sent to hosts or submitters.\n- `cf abuse-reports get <report-param>` — Retrieve the details of an abuse report.\n- `cf abuse-reports list` — List the abuse reports for a given account\n- `cf abuse-reports mitigations list` — List mitigations done to remediate the abuse report.\n\n### Create Operations\n\n- `cf abuse-reports create <report-param>` — Submit an abuse report of a particular type. Requires the abuse-reports entitlement on the account (Enterprise accounts have it by default; other accounts must request access) and an API token with the `Account > Abuse Reports > Edit` permission. If the account is not entitled, the request is rejected with an HTTP `401` response (see below). (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf abuse-reports appeals eligibility <report-id>` — Returns whether the report is currently appealable, along with the signals behind that decision: whether it already has an open appeal, how many appeals have been submitted against it, and whether it has at least one mitigation that an appeal could reverse. (supports --dry-run)\n- `cf abuse-reports emails listSubmitted <report-id>` — List successful emails sent to the submitter of a report submitted by the account. Does not include emails sent to customers or hosts. (supports --dry-run)\n- `cf abuse-reports getSubmitted <report-id>` — Retrieve a report submitted by the account. (supports --dry-run)\n- `cf abuse-reports listSubmitted` — List abuse reports submitted by the account. (supports --dry-run)\n- `cf abuse-reports mitigations review <report-id>` — Request a review for mitigations on an account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"access": "# access — access\n\n## Commands\n\n### Read Operations\n\n- `cf access targets get <target-id>` — Fetches a single infrastructure access target by its ID.\n- `cf access targets list` — Lists and sorts an account's targets. Filters are optional and are ANDed together.\n\n### Create Operations\n\n- `cf access targets create` — Creates a new infrastructure access target in the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf access targets bulk update` — Adds one or more targets. (supports --dry-run, --body)\n- `cf access targets update <target-id>` — Updates an existing infrastructure access target by its ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf access targets bulk delete` — Removes one or more targets. (supports --dry-run, --body)\n- `cf access targets delete <target-id>` — Removes a single infrastructure access target by its ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"account": "# account — account\n\n## Commands\n\n### Read Operations\n\n- `cf account organization list` — Retrieve a list of the organizations that \"contain\" this account or are managing it. The returned list will be in order from \"root\" to \"leaf\", where the \"leaf\" will be the organization that _immediately_ contains the specified account.\n- `cf account profile get` — Retrieves the profile information for a specific Cloudflare account, including organization details, settings, and metadata. This endpoint is commonly used to verify account access and retrieve account-level configuration.\n\n### Update Operations\n\n- `cf account profile update` — Updates the profile information for a Cloudflare account. Allows modification of account-level settings and organizational details. Requires Account Settings Write permission. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf account batch move` — Batch move a collection of accounts to a specific organization. ⚠️ Not implemented. (supports --dry-run, --body)\n- `cf account move` — Move an account within an organization hierarchy or an account outside an organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"account-tags": "# account-tags — account-tags\n\n## Commands\n\n### Read Operations\n\n- `cf account-tags get` — Retrieves tags for a specific account-level resource.\n\n### Update Operations\n\n- `cf account-tags update` — Creates or updates tags for a specific account-level resource. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf account-tags delete` — Removes all tags from a specific account-level resource. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"accounts": "# accounts — Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account\n\n## Commands\n\n### Read Operations\n\n- `cf accounts billing history list` — Gets the billing history for an account.\n- `cf accounts billing payment-methods get <payment-method-id>` — Gets a specific payment method for an account.\n- `cf accounts billing payment-methods list` — Lists all payment methods for an account.\n- `cf accounts get` — Get information about a specific account that you are a member of.\n- `cf accounts list` — List all accounts you have ownership or verified access to.\n- `cf accounts logs audit list` — Gets a list of audit logs for an account.\n- `cf accounts members get <member-id>` — Get information about a specific member of an account.\n- `cf accounts members list` — List all members of an account.\n- `cf accounts subscriptions get` — Lists all of an account's subscriptions.\n- `cf accounts tokens get <token-id>` — Get information about a specific Account Owned API token.\n- `cf accounts tokens list` — List all Account Owned API tokens created for this account. Results include active, disabled, and recently-expired tokens when include_expired is set to true.\n- `cf accounts tokens permission-groups list` — Find all available permission groups for Account Owned API Tokens\n\n### Create Operations\n\n- `cf accounts applications create` — Create a custom application for an account. (supports --dry-run, --body)\n- `cf accounts billing payment-methods create` — Creates a new payment method for an account. (supports --dry-run, --body)\n- `cf accounts create` — Create an account (only available for tenant admins at this time) (supports --dry-run, --body)\n- `cf accounts members create` — Add a user to the list of members for this account. (supports --dry-run, --body)\n- `cf accounts subscriptions create` — Creates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens create` — Create a new Account Owned API token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf accounts applications update <id>` — Replace the network matchers for a custom application and create a new version. (supports --dry-run, --body)\n- `cf accounts billing payment-methods update <payment-method-id>` — Updates a payment method for an account. (supports --dry-run, --body)\n- `cf accounts members update <member-id>` — Modify an account member. (supports --dry-run, --body)\n- `cf accounts subscriptions update <subscription-identifier>` — Updates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens update <token-id>` — Update an existing token. (supports --dry-run, --body)\n- `cf accounts update` — Update an existing account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf accounts applications delete <id>` — Delete a custom application and all of its versions. Deletion is rejected when other resources reference the application. (supports --dry-run)\n- `cf accounts billing payment-methods delete <payment-method-id>` — Deletes a payment method from an account. (supports --dry-run)\n- `cf accounts delete` — Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account (supports --dry-run)\n- `cf accounts members delete <member-id>` — Remove a member from an account. (supports --dry-run)\n- `cf accounts subscriptions delete <subscription-identifier>` — Deletes an account's subscription. (supports --dry-run)\n- `cf accounts tokens delete <token-id>` — Destroy an Account Owned API token. (supports --dry-run)\n\n### Other Operations\n\n- `cf accounts applications get applications` — List the applications available to an account, both the applications Cloudflare curates and the custom applications the account has defined. Results are paginated. Use `filter` and `search` to narrow the list, `order_by` to sort it, and `fields` to reduce each result to only the properties you need. The authenticated principal must have access to the account identified by `account_id`. (supports --dry-run)\n- `cf accounts applications get by id <id>` — Get application by ID. (supports --dry-run)\n- `cf accounts billing createSetupIntent` — Creates a Stripe setup intent for adding a payment method to an account. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf accounts billing getBadDebt` — Gets bad debt information for an account, including outstanding invoices and total debt amount. (supports --dry-run)\n- `cf accounts billing getCredits` — Gets the credit balance and eligibility for an account. (supports --dry-run)\n- `cf accounts billing getReceiptPdf <receipt-id>` — Downloads a receipt as a PDF document. (supports --dry-run)\n- `cf accounts billing getUnpaidInvoices` — Gets unpaid invoice information for an account. (supports --dry-run)\n- `cf accounts billing payBadDebt` — Pays outstanding bad debt for an account. Discovers all debt automatically and handles invoice deduplication. (supports --dry-run, --body)\n- `cf accounts billing payInvoice` — Pays an outstanding invoice for an account. Returns a Stripe client secret when Strong Customer Authentication (SCA) is required to complete the payment. (supports --dry-run, --body)\n- `cf accounts billing payment-methods setDefault <payment-method-id>` — Sets a payment method as the default for an account. (supports --dry-run)\n- `cf accounts billing togglePdfInvoices` — Toggles PDF invoice generation for an account. (supports --dry-run, --body)\n- `cf accounts categories get by id <id>` — Get application category by ID. (supports --dry-run)\n- `cf accounts categories get categories` — List application categories. (supports --dry-run)\n- `cf accounts logs audit history <id>` — Returns the chronological change history for the resource identified by the given audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned. (supports --dry-run)\n- `cf accounts logs audit product-categories` — Lists the available audit log product categories and the resource products each one expands to. Use these values with the product_category filter on the account audit logs endpoint. (supports --dry-run)\n- `cf accounts subscriptions cancelDelayedDowngrade` — Cancels pending delayed downgrades for the specified subscriptions. (supports --dry-run, --body)\n- `cf accounts subscriptions createCancelReason <subscription-identifier>` — Records a cancellation reason for an account subscription. (supports --dry-run, --body)\n- `cf accounts subscriptions getByIdentifier <subscription-identifier>` — Gets an account subscription by identifier. (supports --dry-run)\n- `cf accounts subscriptions getCancelReason <subscription-identifier>` — Gets the cancellation reason for an account subscription. (supports --dry-run)\n- `cf accounts tokens roll <token-id>` — Roll the Account Owned API token secret. (supports --dry-run)\n- `cf accounts tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"account-tags": "# account-tags — account-tags\n\n## Commands\n\n### Read Operations\n\n- `cf account-tags get` — Retrieves tags for a specific account or zone-level resource.\n\n### Update Operations\n\n- `cf account-tags update` — Creates or updates tags for a specific account or zone-level resource. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf account-tags delete` — Removes all tags from a specific account or zone-level resource. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"accounts": "# accounts — Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account\n\n## Commands\n\n### Read Operations\n\n- `cf accounts billing history list` — Gets the billing history for an account.\n- `cf accounts billing payment-methods get <payment-method-id>` — Gets a specific payment method for an account.\n- `cf accounts billing payment-methods list` — Lists all payment methods for an account.\n- `cf accounts get` — Get information about a specific account that you are a member of.\n- `cf accounts list` — List all accounts you have ownership or verified access to.\n- `cf accounts logs audit list` — Gets a list of audit logs for an account.\n- `cf accounts members get <member-id>` — Get information about a specific member of an account.\n- `cf accounts members list` — List all members of an account.\n- `cf accounts subscriptions get` — Lists all of an account or zone's subscriptions.\n- `cf accounts tokens get <token-id>` — Get information about a specific Account Owned API token.\n- `cf accounts tokens list` — List all Account Owned API tokens created for this account. Results include active, disabled, and recently-expired tokens when include_expired is set to true.\n- `cf accounts tokens permission-groups list` — Find all available permission groups for Account Owned API Tokens\n\n### Create Operations\n\n- `cf accounts applications create` — Create a custom application for an account. (supports --dry-run, --body)\n- `cf accounts billing payment-methods create` — Creates a new payment method for an account. (supports --dry-run, --body)\n- `cf accounts create` — Create an account (only available for tenant admins at this time) (supports --dry-run, --body)\n- `cf accounts members create` — Add a user to the list of members for this account. (supports --dry-run, --body)\n- `cf accounts subscriptions create` — Creates an account or zone subscription. (supports --dry-run, --body)\n- `cf accounts tokens create` — Create a new Account Owned API token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf accounts applications update <id>` — Replace the network matchers for a custom application and create a new version. (supports --dry-run, --body)\n- `cf accounts billing payment-methods update <payment-method-id>` — Updates a payment method for an account. (supports --dry-run, --body)\n- `cf accounts members update <member-id>` — Modify an account member. (supports --dry-run, --body)\n- `cf accounts subscriptions update <subscription-identifier>` — Updates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens update <token-id>` — Update an existing token. (supports --dry-run, --body)\n- `cf accounts update` — Update an existing account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf accounts applications delete <id>` — Delete a custom application and all of its versions. Deletion is rejected when other resources reference the application. (supports --dry-run)\n- `cf accounts billing payment-methods delete <payment-method-id>` — Deletes a payment method from an account. (supports --dry-run)\n- `cf accounts delete` — Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account (supports --dry-run)\n- `cf accounts members delete <member-id>` — Remove a member from an account. (supports --dry-run)\n- `cf accounts subscriptions delete <subscription-identifier>` — Deletes an account's subscription. (supports --dry-run)\n- `cf accounts tokens delete <token-id>` — Destroy an Account Owned API token. (supports --dry-run)\n\n### Other Operations\n\n- `cf accounts applications get applications` — List the applications available to an account, both the applications Cloudflare curates and the custom applications the account has defined. Results are paginated. Use `filter` and `search` to narrow the list, `order_by` to sort it, and `fields` to reduce each result to only the properties you need. The authenticated principal must have access to the account identified by `account_id`. (supports --dry-run)\n- `cf accounts applications get by id <id>` — Get application by ID. (supports --dry-run)\n- `cf accounts billing createSetupIntent` — Creates a Stripe setup intent for adding a payment method to an account. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf accounts billing getBadDebt` — Gets bad debt information for an account, including outstanding invoices and total debt amount. (supports --dry-run)\n- `cf accounts billing getCredits` — Gets the credit balance and eligibility for an account. (supports --dry-run)\n- `cf accounts billing getReceiptPdf <receipt-id>` — Downloads a receipt as a PDF document. (supports --dry-run)\n- `cf accounts billing getUnpaidInvoices` — Gets unpaid invoice information for an account. (supports --dry-run)\n- `cf accounts billing payBadDebt` — Pays outstanding bad debt for an account. Discovers all debt automatically and handles invoice deduplication. (supports --dry-run, --body)\n- `cf accounts billing payInvoice` — Pays an outstanding invoice for an account. Returns a Stripe client secret when Strong Customer Authentication (SCA) is required to complete the payment. (supports --dry-run, --body)\n- `cf accounts billing payment-methods setDefault <payment-method-id>` — Sets a payment method as the default for an account. (supports --dry-run)\n- `cf accounts billing togglePdfInvoices` — Toggles PDF invoice generation for an account. (supports --dry-run, --body)\n- `cf accounts categories get by id <id>` — Get application category by ID. (supports --dry-run)\n- `cf accounts categories get categories` — List application categories. (supports --dry-run)\n- `cf accounts logs audit history <id>` — Returns the chronological change history for the resource identified by the given audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned. (supports --dry-run)\n- `cf accounts logs audit product-categories` — Lists the available audit log product categories and the resource products each one expands to. Use these values with the product_category filter on the account audit logs endpoint. (supports --dry-run)\n- `cf accounts subscriptions cancelDelayedDowngrade` — Cancels pending delayed downgrades for the specified subscriptions. (supports --dry-run, --body)\n- `cf accounts subscriptions createCancelReason <subscription-identifier>` — Records a cancellation reason for an account subscription. (supports --dry-run, --body)\n- `cf accounts subscriptions getByIdentifier <subscription-identifier>` — Gets an account subscription by identifier. (supports --dry-run)\n- `cf accounts subscriptions getCancelReason <subscription-identifier>` — Gets the cancellation reason for an account subscription. (supports --dry-run)\n- `cf accounts tokens roll <token-id>` — Roll the Account Owned API token secret. (supports --dry-run)\n- `cf accounts tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"acm": "# acm — acm\n\n## Commands\n\n### Read Operations\n\n- `cf acm custom-trust-store get <custom-origin-trust-store-id>` — Retrieves details about a specific root CA certificate in the custom origin trust store, including expiration and subject information.\n- `cf acm custom-trust-store list` — Get Custom Origin Trust Store for a Zone.\n- `cf acm total-tls get` — Get Total TLS Settings for a Zone.\n\n### Create Operations\n\n- `cf acm custom-trust-store create` — Upload a root CA certificate to the Custom Origin Trust Store for a Zone. Only root CA certificates are accepted. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf acm total-tls edit` — Set Total TLS Settings or disable the feature for a Zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf acm custom-trust-store delete <custom-origin-trust-store-id>` — Removes a root CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"addressing": "# addressing — addressing\n\n## Commands\n\n### Read Operations\n\n- `cf addressing address-maps get <address-map-id>` — Show a particular address map owned by the account.\n- `cf addressing address-maps list` — List all address maps owned by the account.\n- `cf addressing leases list` — List all leases owned by the account.\n- `cf addressing loa-documents get <loa-document-id>` — Download specified LOA document under the account.\n- `cf addressing prefixes advertisement-status get <prefix-id>` — View the current advertisement state for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.\n- `cf addressing prefixes bgp-prefixes get <bgp-prefix-id>` — Retrieve a single BGP Prefix according to its identifier\n- `cf addressing prefixes bgp-prefixes list` — List all BGP Prefixes within the specified IP Prefix. BGP Prefixes are used to control which specific subnets are advertised to the Internet. It is possible to advertise subnets more specific than an IP Prefix by creating more specific BGP Prefixes.\n- `cf addressing prefixes delegations list` — List all delegations for a given account IP prefix.\n- `cf addressing prefixes get <prefix-id>` — List a particular prefix owned by the account.\n- `cf addressing prefixes list` — List all prefixes owned by the account.\n- `cf addressing prefixes service-bindings get <binding-id>` — Fetch a single Service Binding\n- `cf addressing prefixes service-bindings list` — List the Cloudflare services this prefix is currently bound to. Traffic sent to an address within an IP prefix will be routed to the Cloudflare service of the most-specific Service Binding matching the address. **Example:** binding `192.0.2.0/24` to Cloudflare Magic Transit and `192.0.2.1/32` to the Cloudflare CDN would route traffic for `192.0.2.1` to the CDN, and traffic for all other IPs in the prefix to Cloudflare Magic Transit.\n- `cf addressing regional_hostnames get <hostname>` — Fetch the configuration for a specific Regional Hostname, within a zone.\n- `cf addressing regional_hostnames list` — List all Regional Hostnames within a zone.\n- `cf addressing regional_hostnames regions list` — List all Regional Services regions available for use by this account.\n- `cf addressing services list` — Bring-Your-Own IP (BYOIP) prefixes onboarded to Cloudflare must be bound to a service running on the Cloudflare network to enable a Cloudflare product on the IP addresses. This endpoint can be used as a reference of available services on the Cloudflare network, and their service IDs.\n\n### Create Operations\n\n- `cf addressing address-maps create` — Create a new address map under the account. (supports --dry-run, --body)\n- `cf addressing loa-documents create` — Submit LOA document (pdf format) under the account. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes create <prefix-id>` — Create a BGP prefix, controlling the BGP advertisement status of a specific subnet. When created, BGP prefixes are initially withdrawn, and can be advertised with the Update BGP Prefix API. (supports --dry-run, --body)\n- `cf addressing prefixes create` — Add a new prefix under the account. (supports --dry-run, --body)\n- `cf addressing prefixes delegations create <prefix-id>` — Create a new account delegation for a given IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes service-bindings create <prefix-id>` — Creates a new Service Binding, routing traffic to IPs within the given CIDR to a service running on Cloudflare's network. **NOTE:** The first Service Binding created for an IP Prefix must exactly match the IP Prefix's CIDR. Subsequent Service Bindings may be created with a more-specific CIDR. Refer to the [Service Bindings Documentation](https://developers.cloudflare.com/byoip/service-bindings/) for compatibility details. (supports --dry-run, --body)\n- `cf addressing prefixes validate create <prefix-id>` — Triggers a new prefix validation. The checks are run asynchronously and include IRR, RPKI, and prefix ownership. (supports --dry-run)\n- `cf addressing regional_hostnames create` — Create a new Regional Hostname entry. Cloudflare will only use data centers that are physically located within the chosen region to decrypt and service HTTPS traffic. Learn more about [Regional Services](https://developers.cloudflare.com/data-localization/regional-services/get-started/). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf addressing address-maps accounts update <account-id-2>` — Add an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps edit <address-map-id>` — Modify properties of an address map owned by the account. (supports --dry-run, --body)\n- `cf addressing address-maps ips update <ip-address>` — Add an IP from a prefix owned by the account to a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones update` — Add a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes advertisement-status edit <prefix-id>` — Advertise or withdraw the BGP route for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes edit <bgp-prefix-id>` — Update the properties of a BGP Prefix, such as the on demand advertisement status (advertised or withdrawn). (supports --dry-run, --body)\n- `cf addressing prefixes edit <prefix-id>` — Modify the description for a prefix owned by the account. (supports --dry-run, --body)\n- `cf addressing regional_hostnames edit <hostname>` — Update the configuration for a specific Regional Hostname. Only the region_key of a hostname is mutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf addressing address-maps accounts delete <account-id-2>` — Remove an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps delete <address-map-id>` — Delete a particular address map owned by the account. An Address Map must be disabled before it can be deleted. (supports --dry-run)\n- `cf addressing address-maps ips delete <ip-address>` — Remove an IP from a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones delete` — Remove a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes bgp-prefixes delete <bgp-prefix-id>` — Delete a BGP Prefix associated with the specified IP Prefix. A BGP Prefix must be withdrawn before it can be deleted. (supports --dry-run)\n- `cf addressing prefixes delegations delete <delegation-id>` — Delete an account delegation for a given IP prefix. (supports --dry-run)\n- `cf addressing prefixes delete <prefix-id>` — Delete an unapproved prefix owned by the account. (supports --dry-run)\n- `cf addressing prefixes service-bindings delete <binding-id>` — Delete a Service Binding (supports --dry-run)\n- `cf addressing regional_hostnames delete <hostname>` — Delete the region configuration for a specific Regional Hostname. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"agent-memory": "# agent-memory — agent-memory\n\n## Commands\n\n### Other Operations\n\n- `cf agent-memory create-namespace` — Creates a new memory namespace owned by the account. (supports --dry-run, --body)\n- `cf agent-memory delete-memory <memory-id>` — Deletes a memory by ID. Removes the memory and any source messages linked to it. Returns the deleted memory. (supports --dry-run)\n- `cf agent-memory delete-namespace <namespace-name>` — Deletes a namespace. (supports --dry-run)\n- `cf agent-memory delete-profile <profile-name>` — Marks a profile for deletion. (supports --dry-run)\n- `cf agent-memory delete-session <session-id>` — Marks all memories and messages in a profile that are tagged with the given session ID for deletion. (supports --dry-run)\n- `cf agent-memory get-memory <memory-id>` — Retrieves a memory by ID. (supports --dry-run)\n- `cf agent-memory get-namespace <namespace-name>` — Gets a namespace by name. (supports --dry-run)\n- `cf agent-memory ingest <profile-name>` — Processes a conversation and extracts structured memories from it. Agent Memory identifies facts, events, instructions, and tasks automatically. (supports --dry-run, --body)\n- `cf agent-memory list-memories <profile-name>` — List memories stored in a profile. (supports --dry-run)\n- `cf agent-memory list-namespaces` — Lists all namespaces for the given account. Results are paginated. (supports --dry-run)\n- `cf agent-memory recall <profile-name>` — Retrieves memories relevant to the query and returns a synthesized answer. (supports --dry-run, --body)\n- `cf agent-memory remember <profile-name>` — Stores a single memory explicitly. (supports --dry-run, --body)\n- `cf agent-memory summary <profile-name>` — Generates a structured Markdown summary of everything stored in a memory profile. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"agent-memory": "# agent-memory — agent-memory\n\n## Commands\n\n### Other Operations\n\n- `cf agent-memory create-namespace` — Creates a new memory namespace owned by the account. (supports --dry-run, --body)\n- `cf agent-memory delete-memory <memory-id>` — Deletes a memory by ID. Removes the memory and any source messages linked to it. Returns the deleted memory. (supports --dry-run)\n- `cf agent-memory delete-namespace <namespace-name>` — Deletes a namespace. (supports --dry-run)\n- `cf agent-memory delete-profile <profile-name>` — Marks a profile for deletion. (supports --dry-run)\n- `cf agent-memory delete-session <session-id>` — Marks all memories and messages in a profile that are tagged with the given session ID for deletion. (supports --dry-run)\n- `cf agent-memory get-memory <memory-id>` — Retrieves a memory by ID. (supports --dry-run)\n- `cf agent-memory get-namespace <namespace-name>` — Gets a namespace by name. (supports --dry-run)\n- `cf agent-memory ingest <profile-name>` — Processes a conversation and extracts structured memories from it. Agent Memory identifies facts, events, instructions, and tasks automatically. (supports --dry-run, --body)\n- `cf agent-memory list-memories <profile-name>` — List memories stored in a profile. (supports --dry-run)\n- `cf agent-memory list-namespaces` — Lists all namespaces for the given account. Results are paginated. (supports --dry-run)\n- `cf agent-memory list-profiles <namespace-name>` — Lists the profiles of a namespace, ordered by name. A profile appears once it has been used. (supports --dry-run)\n- `cf agent-memory recall <profile-name>` — Retrieves memories relevant to the query and returns a synthesized answer. (supports --dry-run, --body)\n- `cf agent-memory remember <profile-name>` — Stores a single memory explicitly. (supports --dry-run, --body)\n- `cf agent-memory summary <profile-name>` — Generates a paste-ready prompt block summarizing everything stored in a memory profile. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ai": "# ai — ai\n\n## Commands\n\n### Read Operations\n\n- `cf ai authors list` — Searches Workers AI models by author or organization name.\n- `cf ai finetunes list` — Lists all fine-tuning jobs created by the account, including status and metrics.\n- `cf ai finetunes public list` — Lists publicly available fine-tuned models that can be used with Workers AI.\n- `cf ai models list` — Searches Workers AI models by name or description.\n- `cf ai tasks list` — Searches Workers AI models by task type (e.g., text-generation, embeddings).\n\n### Create Operations\n\n- `cf ai finetunes assets create <finetune-id>` — Uploads training data assets for a Workers AI fine-tuning job. (supports --dry-run, --body)\n- `cf ai finetunes create` — Creates a new fine-tuning job for a Workers AI model using custom training data. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai finetunes delete <finetune-id>` — Delete a finetune. Any in-flight requests referencing the lora will fail after the files are deleted. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai finetunes assets download <file-name>` — Returns a pre-signed R2 URL for downloading a finetune asset file. (supports --dry-run)\n- `cf ai getModelSchema` — Retrieves the input and output JSON schema definition for a Workers AI model. (supports --dry-run)\n- `cf ai listMarkdownSupportedFormats` — Lists all file formats supported for conversion to Markdown. (supports --dry-run)\n- `cf ai run <model-name>` — Run inference on a Workers AI model. The request body is model-specific: fetch the model's input schema with `cf ai getModelSchema --model <id>` (or `cf ai run <model> --help`) to discover its fields, then pass them as flags or as a single JSON payload via --body. `cf ai models list` enumerates the models this account can run. (supports --dry-run, --body)\n- `cf ai runModel <model-name>` — This endpoint provides users with the capability to run specific AI models on-demand. By submitting the required input data, users can receive real-time predictions or results generated by the chosen AI model. The endpoint supports various AI model types, ensuring flexibility and adaptability for diverse use cases. Model specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/). (supports --dry-run, --body)\n- `cf ai toMarkdown` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ai-audit": "# ai-audit — ai-audit\n\n## Commands\n\n### Read Operations\n\n- `cf ai-audit robots get` — Fetches and parses the robots.txt file for a zone or a specific subdomain within the zone. Returns parsed user-agent rules, content signals, and sitemaps.\n\n### Other Operations\n\n- `cf ai-audit robots bulk-get` — Fetches and parses robots.txt files for multiple domains within a zone in a single request. Each domain must belong to the specified zone. Results are keyed by hostname. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ai-gateway": "# ai-gateway — Proxy, cache, rate-limit, and observe requests to AI providers — OpenAI, Anthropic, Workers AI, and more\n\n## Commands\n\n### Read Operations\n\n- `cf ai-gateway account-providers costs get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway account-providers costs list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway account-providers get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway account-providers list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway billing spending-limit get` — Retrieve the current spending limit configuration for the account.\n- `cf ai-gateway billing topup config get` — Retrieve the current auto top-up threshold, amount, and any error state.\n- `cf ai-gateway billing topup status` — Get the payment processing status of a top-up by its invoice ID. (supports --body)\n- `cf ai-gateway custom-domains get <hostname>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway custom-domains list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway datasets get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway datasets list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway dynamic-routing get <id>` — Get an AI Gateway Dynamic Route.\n- `cf ai-gateway dynamic-routing list` — List all AI Gateway Dynamic Routes.\n- `cf ai-gateway evaluation-types list` — Lists all available evaluator types for scoring AI gateway responses.\n- `cf ai-gateway evaluations get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway evaluations list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway gateways get <id>` — Retrieves details for a specific AI Gateway dataset.\n- `cf ai-gateway gateways list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway gateways providers list` — Lists all AI Gateway evaluator types configured for the account.\n- `cf ai-gateway logging-state get` — Returns the canonical logging platform and migration availability for an account.\n- `cf ai-gateway logs get <id>` — Retrieves detailed information for a specific AI Gateway log entry.\n- `cf ai-gateway logs list` — Lists request/response log entries for the AI gateway with filtering and pagination.\n- `cf ai-gateway urls get <provider>` — Retrieves the endpoint URL for an AI Gateway.\n\n### Create Operations\n\n- `cf ai-gateway account-providers costs create` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway account-providers create` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway billing spending-limit create` — Deprecated: spending limits can no longer be created, enabled, or modified and this endpoint always responds 403. Use the new AI Gateway spend limits instead: https://developers.cloudflare.com/ai-gateway/features/spend-limits/. Existing limits can be removed via DELETE /spending-limit. (supports --dry-run, --body)\n- `cf ai-gateway billing topup config create` — Configure auto top-up with a balance threshold and top-up amount. (supports --dry-run, --body)\n- `cf ai-gateway billing topup create` — Create a credit top-up for the given account, charged to the account's default payment method. (supports --dry-run, --body)\n- `cf ai-gateway custom-domains create <gateway-id>` — Provisions a Cloudflare-for-SaaS custom hostname and returns the CNAME target to point DNS at. (supports --dry-run, --body)\n- `cf ai-gateway datasets create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create <gateway-id>` — Create a new AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway evaluations create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway gateways create` — Creates a new AI Gateway. (supports --dry-run, --body)\n- `cf ai-gateway gateways providers create <gateway-id>` — Creates a new AI Gateway. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf ai-gateway account-providers costs update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway account-providers update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway datasets update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing update <id>` — Update an AI Gateway Dynamic Route. (supports --dry-run, --body)\n- `cf ai-gateway gateways providers update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway gateways update <id>` — Updates an existing AI Gateway dataset. (supports --dry-run, --body)\n- `cf ai-gateway logging-state update` — Irreversibly migrates an eligible account to Workers Observability logging. (supports --dry-run)\n- `cf ai-gateway logs edit <id>` — Updates metadata for an AI Gateway log entry. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai-gateway account-providers costs delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway account-providers delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway billing spending-limit delete` — Remove the spending limit for the account. (supports --dry-run)\n- `cf ai-gateway billing topup config delete` — Remove the auto top-up configuration for the account. (supports --dry-run)\n- `cf ai-gateway custom-domains delete <hostname>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway datasets delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway dynamic-routing delete <id>` — Delete an AI Gateway Dynamic Route. (supports --dry-run)\n- `cf ai-gateway evaluations delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway gateways delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway gateways providers delete <id>` — Deletes an AI Gateway dataset. (supports --dry-run)\n- `cf ai-gateway logs delete <gateway-id>` — Deletes gateway log entries matching the specified criteria. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai-gateway billing credit-balance` — Retrieve the current credit balance, payment method info, and top-up configuration. (supports --dry-run)\n- `cf ai-gateway billing get-topup-limits` — Retrieve the minimum and maximum allowed top-up amounts (in cents) for this account. (supports --dry-run)\n- `cf ai-gateway billing invoice-history` — Retrieve a list of past invoices with pagination, optionally filtered by type. (supports --dry-run)\n- `cf ai-gateway billing invoice-preview` — Retrieve a preview of the upcoming invoice including line items and tax. (supports --dry-run)\n- `cf ai-gateway billing topup eligibility` — Determine whether an account can self-serve a credit top-up, and if not, why. The dashboard forwards the account's payment-method list in the body; the reason logic is owned here. (supports --dry-run, --body)\n- `cf ai-gateway billing usage-history` — Retrieve aggregated usage meter event summaries for the given time range. (supports --dry-run)\n- `cf ai-gateway dynamic-routing create-deployment <id>` — Create a new AI Gateway Dynamic Route Deployment. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing create-version <id>` — Create a new AI Gateway Dynamic Route Version. (supports --dry-run, --body)\n- `cf ai-gateway dynamic-routing get-version <version-id>` — Get an AI Gateway Dynamic Route Version. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-deployments <id>` — List all AI Gateway Dynamic Route Deployments. (supports --dry-run)\n- `cf ai-gateway dynamic-routing list-versions <id>` — List all AI Gateway Dynamic Route Versions. (supports --dry-run)\n- `cf ai-gateway logs request <id>` — Retrieves the original request payload for an AI Gateway log entry. (supports --dry-run)\n- `cf ai-gateway logs response <id>` — Retrieves the response payload for an AI Gateway log entry. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -17,14 +17,14 @@
 		"ai-security": "# ai-security — Detect prompt injection, PII, and unsafe topics in traffic to your AI applications\n\n## Commands\n\n### Read Operations\n\n- `cf ai-security custom-topics get` — Get the custom topic categories defined for the zone. While AI Security for Apps is enabled, it scores every incoming prompt against these topics and writes the scores to the `cf.llm.prompt.custom_topic_categories` field, keyed by topic label. Topics can be configured while the detection is disabled, but no prompt is scored until you enable it.\n- `cf ai-security get` — Get the current AI Security for Apps status for the zone. While enabled, Cloudflare scans prompts sent to endpoints labeled `cf-llm` for personally identifiable information, unsafe topics, and prompt injection attempts.\n\n### Update Operations\n\n- `cf ai-security custom-topics update` — Update the custom topic list of the zone, overwriting it entirely with the topics in the request, so include every topic you want to keep. Changes can take up to a minute to propagate. Each entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic` description, which the classifier scores prompts against while AI Security for Apps is enabled. The following rules apply: - A zone can hold at most 20 topics. - `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens. - `topic` must be 2–50 printable ASCII characters. - Labels must be unique within the zone, and so must topic descriptions. (supports --dry-run, --body)\n- `cf ai-security update` — Update the AI Security for Apps status for the zone, enabling or disabling the detection. The detection results are exposed as `cf.llm.prompt.*` fields for use in custom rules and rate limiting rules; changes can take up to a minute to propagate. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"alerting": "# alerting — alerting\n\n## Commands\n\n### Read Operations\n\n- `cf alerting available-alerts list` — Gets a list of all alert types for which an account is eligible.\n- `cf alerting destinations eligible get` — Get a list of all delivery mechanism types for which an account is eligible.\n- `cf alerting destinations pagerduty get` — Get a list of all configured PagerDuty services.\n- `cf alerting destinations webhooks get <webhook-id>` — Get details for a single webhooks destination.\n- `cf alerting destinations webhooks list` — Gets a list of all configured webhook destinations.\n- `cf alerting history list` — Gets a list of history records for notifications sent to an account. The records are displayed for last `x` number of days based on the zone plan (free = 30, pro = 30, biz = 30, ent = 90).\n- `cf alerting policies get <policy-id>` — Get details for a single policy.\n- `cf alerting policies list` — Get a list of all Notification policies.\n- `cf alerting silences get <silence-id>` — Gets a specific silence for an account.\n- `cf alerting silences list` — Gets a list of silences for an account.\n\n### Create Operations\n\n- `cf alerting destinations pagerduty create` — Creates a new token for integrating with PagerDuty. (supports --dry-run)\n- `cf alerting destinations webhooks create` — Creates a new webhook destination. (supports --dry-run, --body)\n- `cf alerting policies create` — Creates a new Notification policy. (supports --dry-run, --body)\n- `cf alerting silences create` — Creates a new silence for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf alerting destinations webhooks update <webhook-id>` — Update a webhook destination. (supports --dry-run, --body)\n- `cf alerting policies update <policy-id>` — Update a Notification policy. (supports --dry-run, --body)\n- `cf alerting silences update` — Updates existing silences for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf alerting destinations pagerduty delete` — Deletes all the PagerDuty Services connected to the account. (supports --dry-run)\n- `cf alerting destinations webhooks delete <webhook-id>` — Delete a configured webhook destination. (supports --dry-run)\n- `cf alerting policies delete <policy-id>` — Delete a Notification policy. (supports --dry-run)\n- `cf alerting silences delete <silence-id>` — Deletes an existing silence for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf alerting destinations pagerduty link <token-id>` — Links PagerDuty with the account using the integration token. (supports --dry-run)\n- `cf alerting policies email details <policy-id>` — Shows details for unsubscribing an email address from a notification policy. (supports --dry-run)\n- `cf alerting policies email unsubscribe <policy-id>` — Unsubscribes an email address from a notification policy. (supports --dry-run)\n- `cf alerting policies test <policy-id>` — Send a test notification for a policy to verify delivery mechanisms are working as expected. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"alerts": "# alerts — alerts\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"analytics": "# analytics — Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics\n\n## Commands\n\n### Read Operations\n\n- `cf analytics latency colos get` — Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.\n- `cf analytics latency get` — Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.\n\n### Other Operations\n\n- `cf analytics query artAnalyticsQuerySummary <dataset>` — Returns aggregate summary stats for a dataset. Includes current-period and previous-period totals for trend comparison. (supports --dry-run, --body)\n- `cf analytics query artAnalyticsQueryTimeseries <dataset>` — Returns time-bucketed analytics data for a dataset. Includes time slots, each containing the requested stats, group-by dimensions, and resolution-controlled bucket size (e.g. `hour`, `day`). (supports --dry-run, --body)\n- `cf analytics query artAnalyticsQueryTopN <dataset>` — Returns the top N results for a dataset by a specified stat. Includes an array of result rows, each containing the requested stats and group-by dimensions. (supports --dry-run, --body)\n- `cf analytics query dataSecurityContentFindingsTopN` — Returns the top N integrations ranked by total content findings. (supports --dry-run, --body)\n- `cf analytics query dataSecurityFindingsSummary` — Returns aggregate current-period and previous-period totals for CASB findings. (supports --dry-run, --body)\n- `cf analytics query dataSecurityFindingsTimeseries` — Returns merged time-bucketed CASB findings. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"analytics": "# analytics — Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics\n\n## Commands\n\n### Read Operations\n\n- `cf analytics latency colos get` — Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.\n- `cf analytics latency get` — Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.\n\n### Other Operations\n\n- `cf analytics query data-security content-findings topN` — Returns the top N integrations ranked by total content findings. (supports --dry-run, --body)\n- `cf analytics query data-security findings summary` — Returns aggregate current-period and previous-period totals for CASB findings. (supports --dry-run, --body)\n- `cf analytics query data-security findings timeseries` — Returns merged time-bucketed CASB findings. (supports --dry-run, --body)\n- `cf analytics query summary <dataset>` — Returns aggregate summary stats for a dataset. Includes current-period and previous-period totals for trend comparison. (supports --dry-run, --body)\n- `cf analytics query timeseries <dataset>` — Returns time-bucketed analytics data for a dataset. Includes time slots, each containing the requested stats, group-by dimensions, and resolution-controlled bucket size (e.g. `hour`, `day`). (supports --dry-run, --body)\n- `cf analytics query topN <dataset>` — Returns the top N results for a dataset by a specified stat. Includes an array of result rows, each containing the requested stats and group-by dimensions. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"analytics_engine": "# analytics_engine — analytics_engine\n\n## Commands\n\n### Other Operations\n\n- `cf analytics_engine sql query` — Executes a SQL query against Workers Analytics Engine data. Pass the SQL query in the request body as plain text. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Prefer this method for longer queries that may exceed URL length limits. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"api-security": "# api-security — api-security\n\n## Commands\n\n### Read Operations\n\n- `cf api-security schema-validation schemas get <schema-id>` — Gets the contents and metadata of a specific OpenAPI schema uploaded to API Security.\n- `cf api-security schema-validation schemas hosts list` — Lists all unique hosts found in uploaded OpenAPI schemas for the zone.\n- `cf api-security schema-validation schemas list` — Lists all OpenAPI schemas uploaded to API Security.\n- `cf api-security schema-validation schemas operations list` — Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.\n- `cf api-security schema-validation settings get` — Retrieves the current global schema validation settings for a zone.\n- `cf api-security schema-validation settings operations get <operation-id>` — Retrieves the schema validation settings configured for a specific API operation.\n- `cf api-security schema-validation settings operations list` — Lists per-operation schema validation settings configured for the zone.\n- `cf api-security session-identifiers get` — Returns the authentication identifier characteristics configured for the zone. Header, cookie, or JWT claim values identify distinct API sessions.\n- `cf api-security token-validation configurations get <config-id>` — Returns a JWT validation configuration by ID.\n- `cf api-security token-validation configurations list` — Lists the JWT validation configurations defined for the zone.\n- `cf api-security token-validation rules get <rule-id>` — Returns a token validation rule by ID.\n- `cf api-security token-validation rules list` — Lists token validation rules for the zone, with filters for configuration, action, state, ID, and host.\n- `cf api-security vulnerability-scanner credential-sets credentials get <credential-id>` — Returns a single credential by ID.\n- `cf api-security vulnerability-scanner credential-sets credentials list` — Returns all credentials within a credential set.\n- `cf api-security vulnerability-scanner credential-sets get <credential-set-id>` — Returns a single credential set by ID.\n- `cf api-security vulnerability-scanner credential-sets list` — Returns all credential sets for the account.\n- `cf api-security vulnerability-scanner scans get <scan-id>` — Returns a single scan by ID.\n- `cf api-security vulnerability-scanner scans list` — Returns all scans for the account.\n- `cf api-security vulnerability-scanner target-environments get <target-environment-id>` — Returns a single target environment by ID.\n- `cf api-security vulnerability-scanner target-environments list` — Returns all target environments for the account.\n\n### Create Operations\n\n- `cf api-security schema-validation schemas create` — Uploads an OpenAPI schema that defines expected request formats for API operations. (supports --dry-run, --body)\n- `cf api-security token-validation configurations create` — Creates a JWT validation configuration for the zone. (supports --dry-run, --body)\n- `cf api-security token-validation rules create` — Creates a token validation rule for the zone. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets create` — Creates a new credential set. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets credentials create <credential-set-id>` — Creates a new credential within a credential set. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner scans create` — Creates and starts a new vulnerability scan. The response may include non-fatal warnings in the `messages` array. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner target-environments create` — Creates a new target environment for the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf api-security schema-validation settings edit` — Partially updates global schema validation settings for a zone using PATCH semantics. (supports --dry-run, --body)\n- `cf api-security schema-validation settings operations update <operation-id>` — Fully updates schema validation settings for a specific API operation. (supports --dry-run, --body)\n- `cf api-security schema-validation settings update` — Fully updates global schema validation settings for a zone, replacing existing configuration. (supports --dry-run, --body)\n- `cf api-security session-identifiers update` — Replaces the zone's authentication identifier characteristics used to identify distinct API sessions. (supports --dry-run, --body)\n- `cf api-security token-validation configurations credentials edit <config-id>` — Updates the configuration's complete key set while allowing omitted fields on existing keys to retain stored values. Omitted key identities are removed. (supports --dry-run, --body)\n- `cf api-security token-validation configurations credentials update <config-id>` — Replaces the configuration's complete key set. Symmetric keys must include their key material. (supports --dry-run, --body)\n- `cf api-security token-validation configurations edit <config-id>` — Updates only the supplied fields on a JWT validation configuration. (supports --dry-run, --body)\n- `cf api-security token-validation rules edit <rule-id>` — Updates only the supplied fields on a token validation rule. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets credentials edit <credential-id>` — Updates a credential with only the provided fields; omitted fields remain unchanged. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets credentials update <credential-id>` — Replaces a credential. All fields must be provided. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets edit <credential-set-id>` — Updates a credential set with only the provided fields; omitted fields remain unchanged. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner credential-sets update <credential-set-id>` — Replaces a credential set. All fields must be provided. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner target-environments edit <target-environment-id>` — Updates a target environment with only the provided fields; omitted fields remain unchanged. (supports --dry-run, --body)\n- `cf api-security vulnerability-scanner target-environments update <target-environment-id>` — Replaces a target environment. All fields must be provided. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf api-security schema-validation schemas delete <schema-id>` — Permanently removes an uploaded OpenAPI schema from API Security. Operations using this schema will lose their validation rules. (supports --dry-run)\n- `cf api-security schema-validation settings operations delete <operation-id>` — Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults. (supports --dry-run)\n- `cf api-security token-validation configurations delete <config-id>` — Deletes a JWT validation configuration from the zone. (supports --dry-run)\n- `cf api-security token-validation rules delete <rule-id>` — Deletes a token validation rule from the zone. (supports --dry-run)\n- `cf api-security vulnerability-scanner credential-sets credentials delete <credential-id>` — Deletes a credential. (supports --dry-run)\n- `cf api-security vulnerability-scanner credential-sets delete <credential-set-id>` — Deletes a credential set and all of its credentials. (supports --dry-run)\n- `cf api-security vulnerability-scanner scans delete <scan-id>` — Deletes a scan and all associated data. Only scans in a terminal state (`finished`, `failed`) may be deleted. Attempting to delete a scan that is still being created or executed (`created`, `scheduled`, `planning`, `running`) returns `400`. (supports --dry-run)\n- `cf api-security vulnerability-scanner target-environments delete <target-environment-id>` — Removes a target environment. (supports --dry-run)\n\n### Other Operations\n\n- `cf api-security schema-validation schemas set-validation <schema-id>` — Enables or disables validation for an uploaded OpenAPI schema without changing the schema document. (supports --dry-run, --body)\n- `cf api-security schema-validation settings operations bulk-edit` — Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints. (supports --dry-run, --body)\n- `cf api-security token-validation rules bulk-create` — Creates multiple token validation rules for the zone in one request. (supports --dry-run, --body)\n- `cf api-security token-validation rules bulk-edit` — Updates and reorders multiple token validation rules in one request, then returns the updated rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"argo": "# argo — argo\n\n## Commands\n\n### Read Operations\n\n- `cf argo smart-routing get` — Retrieves the value of Argo Smart Routing enablement setting.\n- `cf argo tiered-caching get` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.\n\n### Update Operations\n\n- `cf argo smart-routing edit` — Configures the value of the Argo Smart Routing enablement setting. (supports --dry-run, --body)\n- `cf argo tiered-caching edit` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"artifacts": "# artifacts — artifacts\n\n## Commands\n\n### Other Operations\n\n- `cf artifacts namespaces artifactsNamespacesGet <namespace>` — Returns an Artifacts namespace summary. (supports --dry-run)\n- `cf artifacts namespaces artifactsNamespacesList` — Lists Artifacts namespaces for an account. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposBlobGet <hash>` — Returns raw bytes for an immutable Git blob object. Blob responses are cacheable forever by hash. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposCommitGet <hash>` — Returns decoded metadata for an immutable Git commit object. Commit responses are cacheable forever by hash. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposCreate <namespace>` — Creates a Git-compatible Artifacts repository in a namespace. (supports --dry-run, --body)\n- `cf artifacts namespaces artifactsReposDelete <name>` — Deletes a repository and schedules cleanup of its backing data. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposFileGet <name>` — Returns raw bytes for a file resolved by ref and path. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposFork <name>` — Forks a source repository into a new repository. (supports --dry-run, --body)\n- `cf artifacts namespaces artifactsReposGet <name>` — Returns repository metadata. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposImport <name>` — Imports an HTTPS Git repository into an Artifacts repository. (supports --dry-run, --body)\n- `cf artifacts namespaces artifactsReposList <namespace>` — Lists repositories in a namespace. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposLogGet <name>` — Returns commit metadata walking backwards from a ref, branch, tag, or HEAD. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposRawGet <path>` — Returns file bytes resolved by ref and path, with a sniffed content type and browser-safe response headers. (supports --dry-run)\n- `cf artifacts namespaces artifactsReposTreeGet <hash>` — Returns decoded entries for an immutable Git tree object. Tree responses are cacheable forever by hash. (supports --dry-run)\n- `cf artifacts namespaces artifactsRepoTokensList <name>` — Lists tokens for a repository. (supports --dry-run)\n- `cf artifacts namespaces artifactsTokensCreate <namespace>` — Creates a scoped Git token for a repository. (supports --dry-run, --body)\n- `cf artifacts namespaces artifactsTokensRevoke <id>` — Revokes an Artifacts repository token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"argo": "# argo — Network optimization features that speed up and improve reliability of traffic to your origins\n\n## Commands\n\n### Read Operations\n\n- `cf argo smart-routing get` — Retrieves the value of Argo Smart Routing enablement setting.\n- `cf argo tiered-caching get` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.\n\n### Update Operations\n\n- `cf argo smart-routing edit` — Configures the value of the Argo Smart Routing enablement setting. (supports --dry-run, --body)\n- `cf argo tiered-caching edit` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"artifacts": "# artifacts — artifacts\n\n## Commands\n\n### Read Operations\n\n- `cf artifacts namespaces get <namespace>` — Returns an Artifacts namespace summary.\n- `cf artifacts namespaces repos blobs get <hash>` — Returns raw bytes for an immutable Git blob object. Blob responses are cacheable forever by hash.\n- `cf artifacts namespaces repos commits get <hash>` — Returns decoded metadata for an immutable Git commit object. Commit responses are cacheable forever by hash.\n- `cf artifacts namespaces repos files get <name>` — Returns raw bytes for a file resolved by ref and path.\n- `cf artifacts namespaces repos get <name>` — Returns repository metadata.\n- `cf artifacts namespaces repos list` — Lists repositories in a namespace.\n- `cf artifacts namespaces repos logs get <name>` — Returns commit metadata walking backwards from a ref, branch, tag, or HEAD.\n- `cf artifacts namespaces repos raw get <path>` — Returns file bytes resolved by ref and path, with a sniffed content type and browser-safe response headers.\n- `cf artifacts namespaces repos trees get <hash>` — Returns decoded entries for an immutable Git tree object. Tree responses are cacheable forever by hash.\n- `cf artifacts namespaces tokens list` — Lists tokens for a repository.\n\n### Create Operations\n\n- `cf artifacts namespaces repos create <namespace>` — Creates a Git-compatible Artifacts repository in a namespace. (supports --dry-run, --body)\n- `cf artifacts namespaces tokens create <namespace>` — Creates a scoped Git token for a repository. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf artifacts namespaces repos delete <name>` — Deletes a repository and schedules cleanup of its backing data. (supports --dry-run)\n\n### Other Operations\n\n- `cf artifacts namespaces artifactsNamespacesList` — Lists Artifacts namespaces for an account. (supports --dry-run)\n- `cf artifacts namespaces repos fork <name>` — Forks a source repository into a new repository. (supports --dry-run, --body)\n- `cf artifacts namespaces repos import <name>` — Imports an HTTPS Git repository into an Artifacts repository. (supports --dry-run, --body)\n- `cf artifacts namespaces tokens revoke <id>` — Revokes an Artifacts repository token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"audit-logs": "# audit-logs — audit-logs\n\n## Commands\n\n### Read Operations\n\n- `cf audit-logs list` — Gets a list of audit logs for an account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"autorag": "# autorag — autorag\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"billing": "# billing — Account billing profiles and usage data for Cloudflare subscriptions and add-on services\n\n## Commands\n\n### Read Operations\n\n- `cf billing profiles get` — Gets the current billing profile for the account.\n- `cf billing rate-plans get <public-key>` — Gets a rate plan's details by its public key (e.g., 'teams_free', 'cf_pro_20_20'). This is a public catalog endpoint, so authentication is not enforced and credentials are accepted but not required.\n\n### Create Operations\n\n- `cf billing profiles create` — Creates a billing profile for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf billing profiles update` — Updates the billing profile for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf billing profiles delete` — Deletes the billing profile for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf billing addresses validate` — Validates a billing address and returns validated address suggestions. Authentication is not enforced to support pre-signup address validation flows, so credentials are accepted but not required. (supports --dry-run, --body)\n- `cf billing profiles createPaymentIntent` — Creates a Stripe payment intent for adding or updating a payment method on the account's billing profile. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf billing profiles updateEmail` — Updates the billing email addresses and preferred locale for an account. (supports --dry-run, --body)\n- `cf billing usage get-account-usage-v2` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days. (supports --dry-run)\n- `cf billing usage get-info-v1` — Returns high-level usage information for the account, including coverage, and subscription metadata. (supports --dry-run)\n- `cf billing usage get-v1` — Returns billable usage data for the account. When no query parameters are provided, returns usage for the current billing period. (supports --dry-run)\n- `cf billing usage query` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. This is the filterable counterpart to `GET` on the same path. It is a read-only operation and requires only the `#billing:read` permission; `POST` is used so that filter criteria can be supplied in a request body rather than in the query string. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. The request body is optional. When it is omitted, or when `TimePeriod` is omitted, the range defaults to the start of the current month through today. The maximum date range is 31 days. Filters are combined with AND. Filter values that do not match a known billable metric or product family simply match no usage, and the response is an empty result set. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"billing": "# billing — Account billing profiles and usage data for Cloudflare subscriptions and add-on services\n\n## Commands\n\n### Read Operations\n\n- `cf billing profiles get` — Gets the current billing profile for the account.\n- `cf billing rate-plans get <public-key>` — Gets a rate plan's details by its public key (e.g., 'teams_free', 'cf_pro_20_20'). This is a public catalog endpoint, so authentication is not enforced and credentials are accepted but not required.\n\n### Create Operations\n\n- `cf billing profiles create` — Creates a billing profile for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf billing profiles update` — Updates the billing profile for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf billing profiles delete` — Deletes the billing profile for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf billing addresses validate` — Validates a billing address and returns validated address suggestions. Authentication is not enforced to support pre-signup address validation flows, so credentials are accepted but not required. (supports --dry-run, --body)\n- `cf billing profiles createPaymentIntent` — Creates a Stripe payment intent for adding or updating a payment method on the account's billing profile. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf billing profiles updateEmail` — Updates the billing email addresses and preferred locale for an account. (supports --dry-run, --body)\n- `cf billing usage get-account-usage-v2` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days. (supports --dry-run)\n- `cf billing usage get-info-v1` — Returns high-level usage information for the account, including coverage, and subscription metadata. (supports --dry-run)\n- `cf billing usage get-v1` — Returns billable usage data for the account. When no query parameters are provided, returns usage for the current billing period. (supports --dry-run)\n- `cf billing usage query` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. This is the filterable counterpart to `GET` on the same path. It is a read-only operation and requires only the `#billing:read` permission; `POST` is used so that filter criteria can be supplied in a request body rather than in the query string. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. The request body is optional. When it is omitted, or when `TimePeriod` is omitted, the range defaults to the start of the current month through today. The maximum date range is 31 days. Filters of different kinds are combined with AND. Values within one tag filter are combined with OR. Filter values that do not match usage produce an empty result set. Results can be grouped by up to two customer resource-tag keys. Grouped values are returned in the `Tags` field. Usage without a requested tag remains in an untagged group, with that key omitted from `Tags`. Requests using tag filtering or grouping return HTTP 400 when tag-aware usage data is unavailable. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"bot-management": "# bot-management — bot-management\n\n## Commands\n\n### Read Operations\n\n- `cf bot-management feedback list` — Returns all feedback reports previously submitted for the specified zone. Feedback reports help improve detection by sharing samples of traffic that were misclassified as bots or humans.\n- `cf bot-management get` — Retrieve a zone's Bot Management Config\n\n### Create Operations\n\n- `cf bot-management feedback create` — Submit a feedback report for the specified zone. Use `type` to indicate whether the report is a false positive (good traffic flagged as bot) or a false negative (bot traffic missed). Furthermore, you can also use `expression` as a wirefilter to identify the affected traffic sample. See more accepted API fields and expression types at https://developers.cloudflare.com/bots/concepts/feedback-loop/#api-fields and https://developers.cloudflare.com/bots/concepts/feedback-loop/#expression-fields, respectively. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf bot-management update` — Updates the Bot Management configuration for a zone. This API is used to update: - **Bot Fight Mode** - **Super Bot Fight Mode** - **Bot Management for Enterprise** See [Bot Plans](https://developers.cloudflare.com/bots/plans/) for more information on the different plans \\ If you recently upgraded or downgraded your plan, refer to the following examples to clean up old configurations. Copy and paste the example body to remove old zone configurations based on your current plan. #### Clean up configuration for Bot Fight Mode plan ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"suppress_session_score\": false } ``` #### Clean up configuration for SBFM Pro plan ```json { \"sbfm_likely_automated\": \"allow\", \"fight_mode\": false } ``` #### Clean up configuration for SBFM Biz plan ```json { \"fight_mode\": false } ``` #### Clean up configuration for BM Enterprise Subscription plan It is strongly recommended that you ensure you have [custom rules](https://developers.cloudflare.com/waf/custom-rules/) in place to protect your zone before disabling the SBFM rules. Without these protections, your zone is vulnerable to attacks. ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"fight_mode\": false } ``` (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"botnet-feed": "# botnet-feed — botnet-feed\n\n## Commands\n\n### Read Operations\n\n- `cf botnet-feed configs asn get` — Gets a list of all ASNs registered for a user for the DDoS Botnet Feed API.\n\n### Delete Operations\n\n- `cf botnet-feed configs asn delete <asn-id>` — Delete an ASN from botnet threat feed for a given user. (supports --dry-run)\n\n### Other Operations\n\n- `cf botnet-feed asn day-report <asn-id>` — Gets all the data the botnet tracking database has for a given ASN registered to user account for given date. If no date is given, it will return results for the previous day. (supports --dry-run)\n- `cf botnet-feed asn full-report <asn-id>` — Gets all the data the botnet threat feed tracking database has for a given ASN registered to user account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"brand-protection": "# brand-protection — brand-protection\n\n## Commands\n\n### Read Operations\n\n- `cf brand-protection v2 logo-matches get` — Get paginated list of logo matches for a specific brand protection logo query\n- `cf brand-protection v2 logos get` — Get all saved brand protection logo queries for an account. Optionally specify id to get a single query. Set download=true to include base64-encoded image data.\n- `cf brand-protection v2 matches get` — Get paginated list of domain matches for one or more brand protection queries. When multiple query_ids are provided (comma-separated), matches are deduplicated across queries and each match includes a match_details array with per-match query metadata and individual dismissed state.\n- `cf brand-protection v2 queries get` — Get all saved brand protection queries for an account\n\n### Create Operations\n\n- `cf brand-protection v2 logos create` — Create a new saved brand protection logo query for visual similarity matching (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf brand-protection v2 logos delete <query-id>` — Delete a saved brand protection logo query. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n\n### Other Operations\n\n- `cf brand-protection submit` — Submit an image and find the n closest matches from the scanned images index without creating any match records. Returns similarity scores and metadata for each match. (supports --dry-run, --body)\n- `cf brand-protection url-info` — Get the total number of saved brand protection queries (domain + logo) for an account (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -38,20 +38,22 @@
 		"client-certificates": "# client-certificates — client-certificates\n\n## Commands\n\n### Read Operations\n\n- `cf client-certificates get <client-certificate-id>` — Get Details for a single mTLS API Shield Client Certificate.\n- `cf client-certificates list` — List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination.\n\n### Create Operations\n\n- `cf client-certificates create` — Create a new API Shield mTLS Client Certificate. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf client-certificates edit <client-certificate-id>` — If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf client-certificates delete <client-certificate-id>` — Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"client-side-security": "# client-side-security — Client-Side Security — monitor JavaScript, connections, and cookies on your pages for supply-chain attacks\n\n## Commands\n\n### Read Operations\n\n- `cf client-side-security connections get <connection-id>` — Returns a webpage connection detected on the zone by connection ID.\n- `cf client-side-security connections list` — Lists outbound connections made by webpages in the zone.\n- `cf client-side-security cookies get <cookie-id>` — Returns a cookie detected on the zone by cookie ID.\n- `cf client-side-security cookies list` — Lists cookies detected on the zone.\n- `cf client-side-security policies get <policy-id>` — Returns a content security rule by ID.\n- `cf client-side-security policies list` — Lists content security rules configured for the zone.\n- `cf client-side-security scripts get <script-id>` — Returns a script detected on the zone by script ID.\n- `cf client-side-security scripts list` — Lists scripts detected on webpages in the zone, with filtering and pagination.\n- `cf client-side-security settings get` — Returns the client-side security product enablement status and reporting behaviors.\n\n### Create Operations\n\n- `cf client-side-security policies create` — Creates a rule that applies a client-side security action when its filter expression matches. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf client-side-security policies update <policy-id>` — Updates the description, action, expression, enabled state, and policy value for a content security rule. (supports --dry-run, --body)\n- `cf client-side-security settings update` — Updates client-side security enablement and reporting behaviors for the zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf client-side-security policies delete <policy-id>` — Permanently deletes a content security rule by ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"cloud-connector": "# cloud-connector — Route traffic from Cloudflare directly to cloud provider services (AWS, Azure, GCP) without origin servers\n\n## Commands\n\n### Read Operations\n\n- `cf cloud-connector rules list` — Retrieves the Cloud Connector rules configured for a zone. Rules define how traffic is routed to cloud services.\n\n### Update Operations\n\n- `cf cloud-connector rules update` — Updates Cloud Connector rules for a zone, replacing the existing rule configuration. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"cloudforce-one": "# cloudforce-one — Detection rule management APIs\n\n## Commands\n\n### Read Operations\n\n- `cf cloudforce-one binary-storage get <hash>` — Retrieves a binary file from the Cloudforce One binary storage for analysis.\n- `cf cloudforce-one events aggregate get` — Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.\n- `cf cloudforce-one events categories catalog get` — Lists categories\n- `cf cloudforce-one events dataset events get <event-id>` — Retrieves a specific event by its UUID.\n- `cf cloudforce-one events dataset groups members get <group-id>` — List group members\n- `cf cloudforce-one events dataset indicators tags get <dataset-id>` — Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.\n- `cf cloudforce-one events dataset permissions get <dataset-id>` — List permissions\n- `cf cloudforce-one events dataset tags indicators get <tag-uuid>` — Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets.\n- `cf cloudforce-one events dataset target industries get <dataset-id>` — Lists all target industries for a specific dataset\n- `cf cloudforce-one events indicator types get` — Lists indicator types across multiple datasets\n- `cf cloudforce-one events indicators get` — Retrieves indicators across specified datasets, ordered by createdAt descending then UUID, dataset ID, and shard ID ascending. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.\n- `cf cloudforce-one events relationships get <event-id>` — The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.\n- `cf cloudforce-one events tags categories get` — Returns all Source-of-Truth tag categories for an account.\n- `cf cloudforce-one events tags get` — Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.\n- `cf cloudforce-one events target industries catalog get` — Lists all target industries from industry map catalog\n- `cf cloudforce-one requests assets get <asset-id>` — Retrieves an asset attached to a Cloudforce One intelligence request.\n- `cf cloudforce-one requests get <request-id>` — Retrieves details for a specific Cloudforce One intelligence request.\n- `cf cloudforce-one requests list` — Lists Cloudforce One intelligence requests with filtering and pagination. (supports --body)\n- `cf cloudforce-one requests message get <request-id>` — Lists messages in a Cloudforce One intelligence request conversation. (supports --body)\n- `cf cloudforce-one requests priority get <priority-id>` — Retrieves a specific priority intelligence request from Cloudforce One.\n- `cf cloudforce-one requests priority list` — Lists priority intelligence requests in Cloudforce One. (supports --body)\n- `cf cloudforce-one rules approvals get <id>` — Get a single rule approval with current rule data.\n- `cf cloudforce-one rules approvals list` — Returns rule approvals with optional status, revision, reviewer-scope, and mutation-type filtering.\n- `cf cloudforce-one rules email get <id>` — Get a structured email rule by ID.\n- `cf cloudforce-one rules email list` — Returns structured email rules.\n- `cf cloudforce-one rules email schema get` — Get the field catalog for structured email rules.\n- `cf cloudforce-one rules exemptions get` — Get all exemption rule patterns for the account, grouped by type.\n- `cf cloudforce-one rules get <id>` — Get a single rule by ID.\n- `cf cloudforce-one rules list` — Returns all rules for an account with optional filtering.\n- `cf cloudforce-one rules managed get` — Get DFP managed rule metadata (name and description) from YARA rules.\n- `cf cloudforce-one rules stats get` — Get statistics about rules for the dashboard.\n- `cf cloudforce-one rules tree get` — Get the folder tree structure for rules navigation.\n- `cf cloudforce-one scans config list` — List Scan Configs\n- `cf cloudforce-one scans results get <config-id>` — Get the Latest Scan Result\n- `cf cloudforce-one stakeout collections export <collection-id>` — Streams collection data in the requested format. Supports CSV (default), JSONL, or Markdown via Accept header. Queries items in batches of 1000 to avoid memory/timeout limits.\n- `cf cloudforce-one stakeout collections get <collection-id>` — Retrieves a single collection by ID with its schema and metadata\n- `cf cloudforce-one stakeout collections list` — Retrieves all collections for an account with pagination\n- `cf cloudforce-one stakeout graphs get` — Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. \"event:550e8400-...\". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope.\n- `cf cloudforce-one stakeout items get <item-id>` — Retrieve a single item from a collection by its identifier.\n- `cf cloudforce-one stakeout letter-templates get <template-id>` — Get a specific user-defined takedown letter template by ID. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout letter-templates list` — List user-defined takedown letter templates. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout takedown-letters get <letter-id>` — Get a specific takedown letter by ID, including the rendered text.\n- `cf cloudforce-one stakeout takedown-letters list` — List all letters for a specific takedown notice.\n- `cf cloudforce-one stakeout takedown-notices get <notice-id>` — Get a specific takedown notice by ID.\n- `cf cloudforce-one stakeout takedown-notices list` — List all takedown notices for the account.\n- `cf cloudforce-one threat-events attackers list` — Lists known threat attackers tracked in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-events categories get <category-id>` — Retrieves details for a specific threat event category.\n- `cf cloudforce-one threat-events categories list` — Lists all threat event categories configured for classifying and organizing threat events.\n- `cf cloudforce-one threat-events countries list` — Lists countries referenced in Cloudforce One threat intelligence data.\n- `cf cloudforce-one threat-events datasets get <dataset-id>` — Retrieves details for a specific threat event dataset.\n- `cf cloudforce-one threat-events datasets list` — Lists all threat event datasets configured in Cloudforce One.\n- `cf cloudforce-one threat-events get <event-id>` — This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.\n- `cf cloudforce-one threat-events indicator-types list` — This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.\n- `cf cloudforce-one threat-events list` — Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.\n- `cf cloudforce-one threat-events raw get <raw-id>` — Retrieves raw threat event data for a specific event in Cloudforce One.\n- `cf cloudforce-one threat-events target-industries list` — Retrieves the catalog of industry classifications used in Cloudforce One threat intelligence.\n\n### Create Operations\n\n- `cf cloudforce-one binary-storage create` — Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. (supports --dry-run, --body)\n- `cf cloudforce-one events categories create <category-id>` — Updates a category (supports --dry-run, --body)\n- `cf cloudforce-one events create <event-id>` — Updates an event (supports --dry-run, --body)\n- `cf cloudforce-one events dataset copy create <dataset-id>` — Copies specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset create <dataset-id>` — Updates an existing dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups create` — Create a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups members create <group-id>` — Create a group member (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicator types create create <dataset-id>` — Creates a new indicator type and initializes its dedicated Durable Object (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators bulk create <dataset-id>` — Creates multiple indicators at once with their respective types and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators create create <dataset-id>` — Creates a new indicator with the specified type and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset move create <dataset-id>` — Moves specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions create <dataset-id>` — Create a permission (supports --dry-run, --body)\n- `cf cloudforce-one events datasets populate create` — Populate dataset-specific lookup tables from existing Events data with batch processing (supports --dry-run)\n- `cf cloudforce-one events queries create <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events raw create <raw-id>` — Updates a raw event (supports --dry-run, --body)\n- `cf cloudforce-one events relate create create <event-id>` — Creates event references for a event (supports --dry-run, --body)\n- `cf cloudforce-one events relationships create create` — Creates a directed relationship between two events. The relationship is from parent to child with a specified type. (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories create create` — Creates a new Source-of-Truth tag category for an account. (supports --dry-run, --body)\n- `cf cloudforce-one requests asset-new create <request-id>` — Uploads a new asset to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets create <request-id>` — Lists assets attached to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests create` — Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. (supports --dry-run, --body)\n- `cf cloudforce-one requests message create <request-id>` — Adds a message to a Cloudforce One intelligence request conversation. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority create` — Creates a new priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one rules create` — Create a new detection rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email create` — Create a structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions create` — Add regex patterns to per-account exemption rules (union semantics). Missing keys leave that type untouched; duplicates are silently deduped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config create` — Create a new Scan Config (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections create` — Creates a collection with four patterns: schema-only (empty collection), rows-only (inferred schema), schema+rows (validated data), or file upload (CSV/JSON/JSONL) (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns create <collection-id>` — Adds a new column to an existing collection schema. Existing items will have NULL for the new column unless a default value is provided. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries create` — Create a new saved brand protection query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items create <collection-id>` — Create one or more items in a collection. Supports single item (data field) or bulk creation (data array). Item data is validated against the collection schema. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates create` — Create a new user-defined takedown letter template (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters create <notice-id>` — Generate a takedown letter for a notice and persist the rendered text. The PDF is generated lazily on download. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices create` — Create a new takedown notice for a domain suspected of trademark infringement. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories create` — Creates a new threat event category in Cloudforce One for organizing and classifying threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events create <account-id-path>` — To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets create` — Creates a new threat event dataset in Cloudforce One for organizing related threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events event-tags create <event-id>` — Adds a tag to a threat event in Cloudforce One for classification and filtering. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events tags create` — Creates a new tag to be used accross threat events. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf cloudforce-one events dataset groups update <group-id>` — Update a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators patch <indicator-id>` — Updates an existing indicator's properties. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions update <grant-id>` — Update a permission (supports --dry-run, --body)\n- `cf cloudforce-one events queries patch <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories patch <category-uuid>` — Updates a Source-of-Truth tag category by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags patch <tag-uuid>` — Updates a Source-of-Truth tag by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events update bulk patch` — Updates multiple events with the same field values. Maximum 100 events per request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets update <asset-id>` — Updates an asset in a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests message update <message-id>` — Updates a message in a Cloudforce One intelligence request thread. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority update <priority-id>` — Updates a priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one requests update <request-id>` — Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. (supports --dry-run, --body)\n- `cf cloudforce-one rules email update <id>` — Updates an existing structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions update` — Replace existing exemption patterns with new values. Each key maps to an array of {old_pattern, new_pattern} entries. Missing keys leave that type untouched. Fails if any old pattern is not found or any new pattern already exists. (supports --dry-run, --body)\n- `cf cloudforce-one rules update <id>` — Updates an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one scans config edit <config-id>` — Update an existing Scan Config (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections update <collection-id>` — Updates collection name and/or metadata. Schema (columns) cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns update <column-id>` — Update name, type, required, or position of a column. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries update <query-id>` — Update a saved brand protection domain query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items update <item-id>` — Update an item in a collection with partial data. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates update <template-id>` — Update a user-defined takedown letter template. System templates cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices update <notice-id>` — Update a takedown notice (e.g. change status to sent, resolved, etc.). (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories edit <category-id>` — Partially updates a threat event category in Cloudforce One, modifying specific fields without replacing the entire category. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets edit <dataset-id>` — Partially updates a threat event dataset in Cloudforce One, modifying specific fields without replacing the entire dataset configuration. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events edit <event-id>` — Partially updates a threat event in Cloudforce One, modifying specific fields without replacing the entire event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events raw edit <raw-id>` — Partially updates raw threat event data in Cloudforce One, modifying specific fields of the event. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cloudforce-one events dataset delete <dataset-id>` — Soft-deletes a dataset given a datasetId. (supports --dry-run)\n- `cf cloudforce-one events dataset groups delete <group-id>` — Delete a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups members delete <member-id>` — Delete a group member (supports --dry-run)\n- `cf cloudforce-one events dataset indicators delete <indicator-id>` — Deletes a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events dataset permissions delete <grant-id>` — Delete a permission (supports --dry-run)\n- `cf cloudforce-one events delete delete <dataset-id>` — Deletes one or more events (supports --dry-run)\n- `cf cloudforce-one events queries delete <query-id>` — Delete a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories delete <category-uuid>` — Deletes a Source-of-Truth tag category by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags delete <tag-uuid>` — Deletes a Source-of-Truth tag by UUID. (supports --dry-run)\n- `cf cloudforce-one requests assets delete <asset-id>` — Removes an asset from a Cloudforce One intelligence request. (supports --dry-run)\n- `cf cloudforce-one requests delete <request-id>` — Deletes a Cloudforce One intelligence request and all associated data. (supports --dry-run)\n- `cf cloudforce-one requests message delete <message-id>` — Removes a message from a Cloudforce One intelligence request thread. (supports --dry-run)\n- `cf cloudforce-one requests priority delete <priority-id>` — Deletes a priority intelligence request from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one rules delete <id>` — Delete an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email delete <id>` — Delete an existing structured email rule. (supports --dry-run)\n- `cf cloudforce-one rules exemptions delete` — Remove regex patterns from per-account exemption rules. Missing keys leave that type untouched; non-existent patterns are silently skipped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config delete <config-id>` — Delete a Scan Config (supports --dry-run)\n- `cf cloudforce-one stakeout collections delete <collection-id>` — Deletes a collection and all its items. This action cannot be undone. The Durable Object storage is deleted asynchronously. (supports --dry-run)\n- `cf cloudforce-one stakeout columns delete <column-id>` — Delete a column from the collection schema. Data is preserved as orphaned UUID keys (forensic safety) and filtered from API responses. (supports --dry-run)\n- `cf cloudforce-one stakeout domain-queries delete <query-id>` — Delete a saved brand protection domain query from the account_queries table. This operation will remove the query from the durable object database. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n- `cf cloudforce-one stakeout items delete <item-id>` — Delete an item from a collection by its identifier. (supports --dry-run)\n- `cf cloudforce-one stakeout letter-templates delete <template-id>` — Delete a user-defined takedown letter template. System templates cannot be deleted. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters delete <letter-id>` — Delete a specific takedown letter and its associated PDF from storage. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices delete <notice-id>` — Delete a takedown notice and all associated letters. PDFs are also removed from storage. (supports --dry-run)\n- `cf cloudforce-one threat-events categories delete <category-id>` — Removes a threat event category from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one threat-events event-tags delete <event-id>` — Removes a tag from a threat event in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events relate delete <event-id>` — Removes a reference link between related threat events in Cloudforce One. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf cloudforce-one events dataset groups get group` — List groups for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups get v2 <group-id>` — Read a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset indicators get indicator <indicator-id>` — Retrieves a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph ql` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph qlv2` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events queries create-create` — Create a new saved event query for the account (supports --dry-run, --body)\n- `cf cloudforce-one events queries get event` — Retrieve all saved event queries for the account (supports --dry-run)\n- `cf cloudforce-one events queries get v2 <query-id>` — Retrieve a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one requests constants` — Retrieves constant values used in Cloudforce One requests, including valid statuses and types. (supports --dry-run)\n- `cf cloudforce-one requests priority quota` — Retrieves quota usage for Cloudforce One priority requests. (supports --dry-run)\n- `cf cloudforce-one requests quota` — Retrieves quota usage for Cloudforce One standard requests. (supports --dry-run)\n- `cf cloudforce-one requests types` — Lists available request types for Cloudforce One intelligence requests. (supports --dry-run)\n- `cf cloudforce-one rules approvals cancel <id>` — Cancel a pending rule approval. Only its original requester may cancel it. (supports --dry-run)\n- `cf cloudforce-one rules approvals resubmit <id>` — Create a new pending revision from a rejected rule approval. Only the original requester may resubmit the latest revision. (supports --dry-run, --body)\n- `cf cloudforce-one rules deleteAll` — Delete all rules in an account. (supports --dry-run)\n- `cf cloudforce-one rules email approvals resubmit <id>` — Validates and compiles a complete structured email rule, then creates an immutable pending revision of its rejected approval. (supports --dry-run, --body)\n- `cf cloudforce-one rules email test <id>` — Test a structured email rule against sample email JSON. (supports --dry-run, --body)\n- `cf cloudforce-one rules email updatePendingApproval <id>` — Validate, compile, and replace the proposed structured email rule on a pending approval. Only the original requester may update it. (supports --dry-run, --body)\n- `cf cloudforce-one rules email validate` — Validates structured email rule syntax and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one rules search` — Search rules using hybrid, vector, keyword, or exact retrieval, backed by AI Search with a SQL fallback. (supports --dry-run)\n- `cf cloudforce-one rules validate` — Validates rule syntax, name uniqueness, namespace, and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout indicators aggregate` — Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. (supports --dry-run)\n- `cf cloudforce-one stakeout items query <collection-id>` — Retrieves items from a collection with keyset pagination and optional column-based filters (supports --dry-run)\n- `cf cloudforce-one stakeout items search <collection-id>` — Search collection items with advanced filtering. Supports operators (eq, neq, gt, lt, gte, lte, contains, is_empty, is_not_empty) and AND/OR logic for complex queries. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates examples` — List system-provided example templates that can be used as starting points when creating custom templates. These templates cannot be used directly for letter generation. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters generate` — Generate a takedown letter from a template. Returns V4 JSON for text format or a PDF binary for pdf format. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters get-pdf <letter-id>` — Download the PDF for a stored takedown letter. If no PDF exists yet, it is generated from the stored letter text and cached for future downloads. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices lookup` — Bulk lookup of takedown notices by domain names. Returns an array of { domain, queryId, notice } entries (notice is null when no match exists). Supports optional queryId or queryIds to scope lookups per query. Uses POST to avoid URL length limits when looking up many domains. This endpoint is read-only. Domains are normalized (trimmed, lowercased) and deduplicated. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events bulk-create` — The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets raw <event-id>` — Retrieves the raw data associated with an event. Searches across all shards in the dataset. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"cloudforce-one": "# cloudforce-one — Detection rule management APIs\n\n## Commands\n\n### Read Operations\n\n- `cf cloudforce-one binary-storage get <hash>` — Retrieves a binary file from the Cloudforce One binary storage for analysis.\n- `cf cloudforce-one events aggregate get` — Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.\n- `cf cloudforce-one events categories catalog get` — Lists categories\n- `cf cloudforce-one events dataset events get <event-id>` — Retrieves a specific event by its UUID.\n- `cf cloudforce-one events dataset groups members get <group-id>` — List group members\n- `cf cloudforce-one events dataset indicators relationships list` — Returns sparse relationship edges. Optionally hydrate related entities via `expand`.\n- `cf cloudforce-one events dataset indicators tags get <dataset-id>` — Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.\n- `cf cloudforce-one events dataset permissions get <dataset-id>` — List permissions\n- `cf cloudforce-one events dataset tags indicators get <tag-uuid>` — Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to UUIDs, analytics datasets, or operational datasets. Analytics datasets do not expose tag associations, so the analytics scope returns an empty result.\n- `cf cloudforce-one events dataset target industries get <dataset-id>` — Lists all target industries for a specific dataset\n- `cf cloudforce-one events indicator types get` — Lists indicator types across multiple datasets\n- `cf cloudforce-one events indicators get` — Retrieves indicators across specified datasets, ordered by createdAt descending then UUID, dataset ID, and shard ID ascending. Use the standalone datasetIds value 'all'/'*' for legacy all-datasets behavior, 'analytics' for isAnalytics=true datasets, or 'operational' for isAnalytics=false datasets. If no datasetIds are provided, uses the default dataset.\n- `cf cloudforce-one events relationships get <event-id>` — The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.\n- `cf cloudforce-one events tags categories get` — Returns all Source-of-Truth tag categories for an account.\n- `cf cloudforce-one events tags get` — Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.\n- `cf cloudforce-one events tags relationships list` — Returns sparse relationship edges. Optionally hydrate related entities via `expand`. Fans out across all accessible indicator dataset shards. Analytics datasets do not expose tag associations, so the analytics scope returns an empty result.\n- `cf cloudforce-one events target industries catalog get` — Lists all target industries from industry map catalog\n- `cf cloudforce-one requests assets get <asset-id>` — Retrieves an asset attached to a Cloudforce One intelligence request.\n- `cf cloudforce-one requests get <request-id>` — Retrieves details for a specific Cloudforce One intelligence request.\n- `cf cloudforce-one requests list` — Lists Cloudforce One intelligence requests with filtering and pagination. (supports --body)\n- `cf cloudforce-one requests message get <request-id>` — Lists messages in a Cloudforce One intelligence request conversation. (supports --body)\n- `cf cloudforce-one requests priority get <priority-id>` — Retrieves a specific priority intelligence request from Cloudforce One.\n- `cf cloudforce-one requests priority list` — Lists priority intelligence requests in Cloudforce One. (supports --body)\n- `cf cloudforce-one rules approvals get <id>` — Get a single rule approval with current rule data.\n- `cf cloudforce-one rules approvals list` — Returns rule approvals with optional status, revision, reviewer-scope, and mutation-type filtering.\n- `cf cloudforce-one rules email get <id>` — Get a structured email rule by ID.\n- `cf cloudforce-one rules email list` — Returns structured email rules.\n- `cf cloudforce-one rules email schema get` — Get the field catalog for structured email rules.\n- `cf cloudforce-one rules exemptions get` — Get all exemption rule patterns for the account, grouped by type.\n- `cf cloudforce-one rules get <id>` — Get a single rule by ID.\n- `cf cloudforce-one rules list` — Returns all rules for an account with optional filtering.\n- `cf cloudforce-one rules managed get` — Get DFP managed rule metadata (name and description) from YARA rules.\n- `cf cloudforce-one rules stats get` — Get statistics about rules for the dashboard.\n- `cf cloudforce-one rules tree get` — Get the folder tree structure for rules navigation.\n- `cf cloudforce-one scans config list` — Lists scan configurations for Cloudforce One's network scanning service.\n- `cf cloudforce-one scans results get <config-id>` — Retrieves the latest scan results for a Cloudforce One scan configuration, including discovered open ports.\n- `cf cloudforce-one stakeout collections export <collection-id>` — Streams collection data in the requested format. Supports CSV (default), JSONL, or Markdown via Accept header. Queries items in batches of 1000 to avoid memory/timeout limits.\n- `cf cloudforce-one stakeout collections get <collection-id>` — Retrieves a single collection by ID with its schema and metadata\n- `cf cloudforce-one stakeout collections list` — Retrieves all collections for an account with pagination\n- `cf cloudforce-one stakeout graphs get` — Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. \"event:550e8400-...\". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope.\n- `cf cloudforce-one stakeout items get <item-id>` — Retrieve a single item from a collection by its identifier.\n- `cf cloudforce-one stakeout letter-templates get <template-id>` — Get a specific user-defined takedown letter template by ID. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout letter-templates list` — List user-defined takedown letter templates. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout takedown-letters get <letter-id>` — Get a specific takedown letter by ID, including the rendered text.\n- `cf cloudforce-one stakeout takedown-letters list` — List all letters for a specific takedown notice.\n- `cf cloudforce-one stakeout takedown-notices get <notice-id>` — Get a specific takedown notice by ID.\n- `cf cloudforce-one stakeout takedown-notices list` — List all takedown notices for the account.\n- `cf cloudforce-one threat-events attackers list` — Lists known threat attackers tracked in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-events categories get <category-id>` — Retrieves details for a specific threat event category.\n- `cf cloudforce-one threat-events categories list` — Lists all threat event categories configured for classifying and organizing threat events.\n- `cf cloudforce-one threat-events countries list` — Lists countries referenced in Cloudforce One threat intelligence data.\n- `cf cloudforce-one threat-events datasets get <dataset-id>` — Retrieves details for a specific threat event dataset.\n- `cf cloudforce-one threat-events datasets list` — Lists all threat event datasets configured in Cloudforce One.\n- `cf cloudforce-one threat-events get <event-id>` — This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.\n- `cf cloudforce-one threat-events indicator-types list` — This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.\n- `cf cloudforce-one threat-events list` — Use `datasetId=all` or `datasetId=*` for the legacy all-datasets scope, `datasetId=analytics` for datasets with `isAnalytics=true`, or `datasetId=operational` for datasets with `isAnalytics=false` (limited to 50). Scope values must be used alone. When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.\n- `cf cloudforce-one threat-events raw get <raw-id>` — Retrieves raw threat event data for a specific event in Cloudforce One.\n- `cf cloudforce-one threat-events target-industries list` — Retrieves the catalog of industry classifications used in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-signals articles get <article-id>` — Get Threat Signals article.\n- `cf cloudforce-one threat-signals articles list` — List Threat Signals articles.\n- `cf cloudforce-one threat-signals curated-feeds list` — List curated Threat Signals feeds.\n- `cf cloudforce-one threat-signals feeds list` — List Threat Signals feeds.\n- `cf cloudforce-one threat-signals feeds skills get <feed-id>` — Get Threat Signals feed skills.\n- `cf cloudforce-one threat-signals indicators list` — List Threat Signals article indicators.\n- `cf cloudforce-one threat-signals skills get <skill-id>` — Get Threat Signals skill.\n- `cf cloudforce-one threat-signals skills list` — List Threat Signals skills.\n- `cf cloudforce-one threat-signals skills tag-categories get <skill-id>` — Get Threat Signals skill tag categories.\n\n### Create Operations\n\n- `cf cloudforce-one binary-storage create` — Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. (supports --dry-run, --body)\n- `cf cloudforce-one events categories create <category-id>` — Updates a category (supports --dry-run, --body)\n- `cf cloudforce-one events create <event-id>` — Updates an event (supports --dry-run, --body)\n- `cf cloudforce-one events dataset copy create <dataset-id>` — Copies specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset create <dataset-id>` — Updates an existing dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups create` — Create a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups members create <group-id>` — Create a group member (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicator types create create <dataset-id>` — Creates a new indicator type and initializes its dedicated Durable Object (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators bulk create <dataset-id>` — Creates multiple indicators at once with their respective types and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators create create <dataset-id>` — Creates a new indicator with the specified type and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators relationships create <indicator-id>` — Creates a new relationship with the indicator as the source entity. Indicator↔indicator relationships are not supported. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset move create <dataset-id>` — Moves specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions create <dataset-id>` — Create a permission (supports --dry-run, --body)\n- `cf cloudforce-one events datasets populate create` — Populate dataset-specific lookup tables from existing Events data with batch processing (supports --dry-run)\n- `cf cloudforce-one events queries create <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events raw create <raw-id>` — Updates a raw event (supports --dry-run, --body)\n- `cf cloudforce-one events relate create create <event-id>` — Creates event references for a event (supports --dry-run, --body)\n- `cf cloudforce-one events relationships create create` — Creates a directed relationship between two events. The relationship is from parent to child with a specified type. (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories create create` — Creates a new Source-of-Truth tag category for an account. (supports --dry-run, --body)\n- `cf cloudforce-one events tags relationships create <tag-uuid>` — Creates a new relationship with the tag as the source entity. Requires a datasetId to locate the Indicators DO. (supports --dry-run, --body)\n- `cf cloudforce-one requests asset-new create <request-id>` — Uploads a new asset to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets create <request-id>` — Lists assets attached to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests create` — Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. (supports --dry-run, --body)\n- `cf cloudforce-one requests message create <request-id>` — Adds a message to a Cloudforce One intelligence request conversation. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority create` — Creates a new priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one rules create` — Create a new detection rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email create` — Create a structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions create` — Add regex patterns to per-account exemption rules (union semantics). Missing keys leave that type untouched; duplicates are silently deduped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config create` — Creates a new scan configuration for Cloudforce One's network scanning service. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections create` — Creates a collection with four patterns: schema-only (empty collection), rows-only (inferred schema), schema+rows (validated data), or file upload (CSV/JSON/JSONL) (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns create <collection-id>` — Adds a new column to an existing collection schema. Existing items will have NULL for the new column unless a default value is provided. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries create` — Create a new saved brand protection query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items create <collection-id>` — Create one or more items in a collection. Supports single item (data field) or bulk creation (data array). Item data is validated against the collection schema. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates create` — Create a new user-defined takedown letter template (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters create <notice-id>` — Generate a takedown letter for a notice and persist the rendered text. The PDF is generated lazily on download. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices create` — Create a new takedown notice for a domain suspected of trademark infringement. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories create` — Creates a new threat event category in Cloudforce One for organizing and classifying threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events create <account-id-path>` — To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets create` — Creates a new threat event dataset in Cloudforce One for organizing related threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events event-tags create <event-id>` — Adds a tag to a threat event in Cloudforce One for classification and filtering. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events tags create` — Creates a new tag to be used accross threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds create` — Create curated Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds create` — Create Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills create` — Create Threat Signals skill. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf cloudforce-one events dataset groups update <group-id>` — Update a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators patch <indicator-id>` — Updates an existing indicator's properties. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators relationships update <rel-uuid>` — Partially updates a relationship by UUID. Only provided fields are changed. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions update <grant-id>` — Update a permission (supports --dry-run, --body)\n- `cf cloudforce-one events queries patch <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories patch <category-uuid>` — Updates a Source-of-Truth tag category by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags patch <tag-uuid>` — Updates a Source-of-Truth tag by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags relationships update <rel-uuid>` — Partially updates a relationship by UUID. Requires datasetId query param. (supports --dry-run, --body)\n- `cf cloudforce-one events update bulk patch` — Updates multiple events with the same field values. Maximum 100 events per request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets update <asset-id>` — Updates an asset in a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests message update <message-id>` — Updates a message in a Cloudforce One intelligence request thread. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority update <priority-id>` — Updates a priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one requests update <request-id>` — Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. (supports --dry-run, --body)\n- `cf cloudforce-one rules email update <id>` — Updates an existing structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions update` — Replace existing exemption patterns with new values. Each key maps to an array of {old_pattern, new_pattern} entries. Missing keys leave that type untouched. Fails if any old pattern is not found or any new pattern already exists. (supports --dry-run, --body)\n- `cf cloudforce-one rules update <id>` — Updates an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one scans config edit <config-id>` — Updates an existing scan configuration in Cloudforce One's network scanning service. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections update <collection-id>` — Updates collection name and/or metadata. Schema (columns) cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns update <column-id>` — Update name, type, required, or position of a column. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries update <query-id>` — Update a saved brand protection domain query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items update <item-id>` — Update an item in a collection with partial data. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates update <template-id>` — Update a user-defined takedown letter template. System templates cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices update <notice-id>` — Update a takedown notice (e.g. change status to sent, resolved, etc.). (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories edit <category-id>` — Partially updates a threat event category in Cloudforce One, modifying specific fields without replacing the entire category. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets edit <dataset-id>` — Partially updates a threat event dataset in Cloudforce One, modifying specific fields without replacing the entire dataset configuration. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events edit <event-id>` — Partially updates a threat event in Cloudforce One, modifying specific fields without replacing the entire event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events raw edit <raw-id>` — Partially updates raw threat event data in Cloudforce One, modifying specific fields of the event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds update <curated-feed-id>` — Update curated Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds skills update <feed-id>` — Set Threat Signals feed skills. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds update <feed-id>` — Update Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills tag-categories update <skill-id>` — Replace Threat Signals skill tag categories. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills update <skill-id>` — Update Threat Signals skill. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cloudforce-one events dataset delete <dataset-id>` — Soft-deletes a dataset given a datasetId. (supports --dry-run)\n- `cf cloudforce-one events dataset groups delete <group-id>` — Delete a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups members delete <member-id>` — Delete a group member (supports --dry-run)\n- `cf cloudforce-one events dataset indicators delete <indicator-id>` — Deletes a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events dataset indicators relationships delete <rel-uuid>` — Deletes a relationship by UUID. Idempotent: returns deleted=false if not found. (supports --dry-run)\n- `cf cloudforce-one events dataset permissions delete <grant-id>` — Delete a permission (supports --dry-run)\n- `cf cloudforce-one events delete delete <dataset-id>` — Deletes one or more events (supports --dry-run)\n- `cf cloudforce-one events queries delete <query-id>` — Delete a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories delete <category-uuid>` — Deletes a Source-of-Truth tag category by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags delete <tag-uuid>` — Deletes a Source-of-Truth tag by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags relationships delete <rel-uuid>` — Deletes a relationship by UUID. Idempotent: returns deleted=false if not found. Requires datasetId query param. (supports --dry-run)\n- `cf cloudforce-one requests assets delete <asset-id>` — Removes an asset from a Cloudforce One intelligence request. (supports --dry-run)\n- `cf cloudforce-one requests delete <request-id>` — Deletes a Cloudforce One intelligence request and all associated data. (supports --dry-run)\n- `cf cloudforce-one requests message delete <message-id>` — Removes a message from a Cloudforce One intelligence request thread. (supports --dry-run)\n- `cf cloudforce-one requests priority delete <priority-id>` — Deletes a priority intelligence request from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one rules delete <id>` — Delete an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email delete <id>` — Delete an existing structured email rule. (supports --dry-run)\n- `cf cloudforce-one rules exemptions delete` — Remove regex patterns from per-account exemption rules. Missing keys leave that type untouched; non-existent patterns are silently skipped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config delete <config-id>` — Deletes a scan configuration from Cloudforce One's network scanning service. (supports --dry-run)\n- `cf cloudforce-one stakeout collections delete <collection-id>` — Deletes a collection and all its items. This action cannot be undone. The Durable Object storage is deleted asynchronously. (supports --dry-run)\n- `cf cloudforce-one stakeout columns delete <column-id>` — Delete a column from the collection schema. Data is preserved as orphaned UUID keys (forensic safety) and filtered from API responses. (supports --dry-run)\n- `cf cloudforce-one stakeout domain-queries delete <query-id>` — Delete a saved brand protection domain query from the account_queries table. This operation will remove the query from the durable object database. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n- `cf cloudforce-one stakeout items delete <item-id>` — Delete an item from a collection by its identifier. (supports --dry-run)\n- `cf cloudforce-one stakeout letter-templates delete <template-id>` — Delete a user-defined takedown letter template. System templates cannot be deleted. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters delete <letter-id>` — Delete a specific takedown letter and its associated PDF from storage. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices delete <notice-id>` — Delete a takedown notice and all associated letters. PDFs are also removed from storage. (supports --dry-run)\n- `cf cloudforce-one threat-events categories delete <category-id>` — Removes a threat event category from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one threat-events event-tags delete <event-id>` — Removes a tag from a threat event in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events relate delete <event-id>` — Removes a reference link between related threat events in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles tags remove <tag-id>` — Remove tag from Threat Signals article. (supports --dry-run)\n- `cf cloudforce-one threat-signals curated-feeds delete <curated-feed-id>` — Delete curated Threat Signals feed. (supports --dry-run)\n- `cf cloudforce-one threat-signals feeds delete <feed-id>` — Delete Threat Signals feed. (supports --dry-run)\n- `cf cloudforce-one threat-signals skills delete <skill-id>` — Delete Threat Signals skill. (supports --dry-run)\n\n### Other Operations\n\n- `cf cloudforce-one events dataset groups get group` — List groups for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups get v2 <group-id>` — Read a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset indicators get indicator <indicator-id>` — Retrieves a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph ql` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph qlv2` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events queries create-create` — Create a new saved event query for the account (supports --dry-run, --body)\n- `cf cloudforce-one events queries get event` — Retrieve all saved event queries for the account (supports --dry-run)\n- `cf cloudforce-one events queries get v2 <query-id>` — Retrieve a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories get-by-id <category-uuid>` — Returns a single Source-of-Truth tag category by UUID, including its full schema. (supports --dry-run)\n- `cf cloudforce-one events tags get-by-id <tag-uuid>` — Returns a single Source-of-Truth tag by UUID, including custom fields (properties). (supports --dry-run)\n- `cf cloudforce-one requests constants` — Retrieves constant values used in Cloudforce One requests, including valid statuses and types. (supports --dry-run)\n- `cf cloudforce-one requests priority quota` — Retrieves quota usage for Cloudforce One priority requests. (supports --dry-run)\n- `cf cloudforce-one requests quota` — Retrieves quota usage for Cloudforce One standard requests. (supports --dry-run)\n- `cf cloudforce-one requests types` — Lists available request types for Cloudforce One intelligence requests. (supports --dry-run)\n- `cf cloudforce-one rules approvals cancel <id>` — Cancel a pending rule approval. Only its original requester may cancel it. (supports --dry-run)\n- `cf cloudforce-one rules approvals resubmit <id>` — Create a new pending revision from a rejected rule approval. Only the original requester may resubmit the latest revision. (supports --dry-run, --body)\n- `cf cloudforce-one rules deleteAll` — Delete all rules in an account. (supports --dry-run)\n- `cf cloudforce-one rules email approvals resubmit <id>` — Validates and compiles a complete structured email rule, then creates an immutable pending revision of its rejected approval. (supports --dry-run, --body)\n- `cf cloudforce-one rules email test <id>` — Test a structured email rule against sample email JSON. (supports --dry-run, --body)\n- `cf cloudforce-one rules email updatePendingApproval <id>` — Validate, compile, and replace the proposed structured email rule on a pending approval. Only the original requester may update it. (supports --dry-run, --body)\n- `cf cloudforce-one rules email validate` — Validates structured email rule syntax and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one rules search` — Search rules using hybrid, vector, keyword, or exact retrieval, backed by AI Search with a SQL fallback. (supports --dry-run)\n- `cf cloudforce-one rules validate` — Validates rule syntax, name uniqueness, namespace, and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one scans results getBanners <config-id>` — Retrieves the latest banner grab results for a Cloudforce One scan configuration, including service banners from open ports. (supports --dry-run)\n- `cf cloudforce-one stakeout indicators aggregate` — Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. (supports --dry-run)\n- `cf cloudforce-one stakeout items query <collection-id>` — Retrieves items from a collection with keyset pagination and optional column-based filters (supports --dry-run)\n- `cf cloudforce-one stakeout items search <collection-id>` — Search collection items with advanced filtering. Supports operators (eq, neq, gt, lt, gte, lte, contains, is_empty, is_not_empty) and AND/OR logic for complex queries. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates examples` — List system-provided example templates that can be used as starting points when creating custom templates. These templates cannot be used directly for letter generation. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters generate` — Generate a takedown letter from a template. Returns V4 JSON for text format or a PDF binary for pdf format. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters get-pdf <letter-id>` — Download the PDF for a stored takedown letter. If no PDF exists yet, it is generated from the stored letter text and cached for future downloads. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices lookup` — Bulk lookup of takedown notices by domain names. Returns an array of { domain, queryId, notice } entries (notice is null when no match exists). Supports optional queryId or queryIds to scope lookups per query. Uses POST to avoid URL length limits when looking up many domains. This endpoint is read-only. Domains are normalized (trimmed, lowercased) and deduplicated. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events bulk-create` — The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets raw <event-id>` — Retrieves the raw data associated with an event. Searches across all shards in the dataset. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles bulk-mark-read` — Bulk update Threat Signals article read status. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles get-content <article-id>` — Get Threat Signals article content. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles mark-read <article-id>` — Update Threat Signals article read status. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles skills get-output <skill-id>` — Get Threat Signals article skill output. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles tags add <article-id>` — Add tag to Threat Signals article. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles tags generate <article-id>` — Generate Threat Signals article AI tags. (supports --dry-run)\n- `cf cloudforce-one threat-signals curated-feeds bulk-create` — Bulk create curated Threat Signals feeds. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds opt-out` — Opt out of curated Threat Signals feeds. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds get-raw <feed-id>` — Get Threat Signals feed XML. (supports --dry-run)\n- `cf cloudforce-one threat-signals feeds poll` — Trigger Threat Signals feed poll. (supports --dry-run)\n- `cf cloudforce-one threat-signals health` — Check Threat Signals service health. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-interrupts": "# connector-interrupts — connector-interrupts\n\n## Commands\n\n### Read Operations\n\n- `cf connector-interrupts list` — Lists interrupts for a Magic WAN Connector.\n\n### Create Operations\n\n- `cf connector-interrupts create <connector-id>` — Creates an interrupt for a Magic WAN Connector. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-events": "# connector-telemetry-events — connector-telemetry-events\n\n## Commands\n\n### Read Operations\n\n- `cf connector-telemetry-events get <event-n>` — Gets Magic WAN Connector Telemetry Event\n- `cf connector-telemetry-events list` — Lists Magic WAN Connector Telemetry Events\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"connector-telemetry-events-latest": "# connector-telemetry-events-latest — connector-telemetry-events-latest\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-snapshots": "# connector-telemetry-snapshots — connector-telemetry-snapshots\n\n## Commands\n\n### Read Operations\n\n- `cf connector-telemetry-snapshots get <snapshot-t>` — Gets Magic WAN Connector Telemetry Snapshot\n- `cf connector-telemetry-snapshots list` — Lists Magic WAN Connector Telemetry Snapshots\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"connector-telemetry-snapshots-latest": "# connector-telemetry-snapshots-latest — connector-telemetry-snapshots-latest\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connectors": "# connectors — connectors\n\n## Commands\n\n### Read Operations\n\n- `cf connectors get <connector-id>` — Gets a Magic WAN Connector.\n- `cf connectors list` — Lists Magic WAN Connectors.\n\n### Create Operations\n\n- `cf connectors create` — Creates a Magic WAN Connector. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf connectors edit <connector-id>` — Edits properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n- `cf connectors update <connector-id>` — Updates properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf connectors delete <connector-id>` — Deletes a Magic WAN Connector. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"containers": "# containers — Deploy and manage Containers applications on Cloudflare's global network\n\n## Commands\n\n### Read Operations\n\n- `cf containers applications get <application-id>` — Returns a single application by id.\n- `cf containers applications instances get <instance-id>` — Returns a container instance belonging to an application.\n- `cf containers applications instances list` — Lists container instances belonging to an application.\n- `cf containers applications list` — Lists all the applications that are associated with your account.\n- `cf containers applications versions list` — Returns all versions for a scheduler-backed application with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`.\n- `cf containers registries list` — Get the list of configured registries in the account.\n\n### Create Operations\n\n- `cf containers applications create` — Create a Containers application. Use `scheduling_policy: \"default\"` for a scheduler-backed application. The Containers scheduler maintains the requested instance count and manages deployment configuration, placement, scaling, versions, and rollouts. Use `scheduling_policy: \"durable_object\"` for a Durable Object-managed application. Each Durable Object creates and manages the lifecycle of its container instance. This request accepts only `name`, `scheduling_policy`, and `durable_objects`. Application-level configuration, scaling, constraints, versions, and rollouts do not apply. (supports --dry-run, --body)\n- `cf containers applications rollouts create <application-id>` — Creates a rollout to update the application's configuration across instances with minimal downtime. Rollouts apply only to scheduler-backed applications with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`. (supports --dry-run, --body)\n- `cf containers registries create` — Registers credentials for a supported private external image registry so Containers can pull images from it. This endpoint does not create a registry or upload an image. Public Docker Hub images and images in the Cloudflare managed registry do not require this configuration. Refer to [Image management](https://developers.cloudflare.com/containers/platform-details/image-management/) for supported registries and instructions for storing registry credentials. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf containers applications edit <application-id>` — Modifies a single application by id. Changes that replace instance deployment configuration, including the image, must be applied with a rollout. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf containers applications delete <application-id>` — Deletes a single application by id. (supports --dry-run)\n- `cf containers registries delete <domain>` — Delete a registry from the account, this will prevent Containers from pulling images from the registry. (supports --dry-run)\n\n### Other Operations\n\n- `cf containers images prepare` — Idempotently starts or observes preparation of the runtime artifacts required to run one digest-pinned managed container image on Cloudflare's network. Returns 202 while durable preparation continues and 200 when the image is ready or preparation has reached a terminal error. (supports --dry-run, --body)\n- `cf containers registries credentials generate <domain>` — Generates credentials for accessing a configured container image registry. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"content-scan": "# content-scan — Malicious uploads detection, scan uploaded content in HTTP requests for malware and malicious payloads\n\n## Commands\n\n### Read Operations\n\n- `cf content-scan expressions list` — List the Content Scanning custom expressions configured for the zone, each with its own identifier. A custom expression tells the scanner how to reach content objects in a request it cannot parse on its own, such as files Base64-encoded inside a JSON body.\n- `cf content-scan get` — Get the current Content Scanning status for the zone, together with the date the status was last modified.\n\n### Create Operations\n\n- `cf content-scan expressions create` — Create one or more Content Scanning custom expressions, appending them to the existing list of the zone, and return the updated list. Each expression reaches content objects the scanner cannot find automatically, for example `lookup_json_string(http.request.body.raw, \"file\")`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf content-scan expressions update <expression-id>` — Update the Content Scanning custom expression with the given identifier and return the updated list of expressions. (supports --dry-run, --body)\n- `cf content-scan update` — Update the Content Scanning status by setting the status value to `enabled` or `disabled`. This is equivalent to calling the dedicated enable and disable endpoints. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf content-scan expressions delete <expression-id>` — Delete the Content Scanning custom expression with the given identifier and return the expressions that remain. Content objects reached only by the deleted expression are no longer scanned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"csamScanner": "# csamScanner — csamScanner\n\n## Commands\n\n### Read Operations\n\n- `cf csamScanner get` — Retrieve the current CSAM Scanner configuration for a zone. The notification email is masked by default in responses.\n\n### Update Operations\n\n- `cf csamScanner edit` — Update the CSAM Scanner configuration for a zone. Allows enabling or disabling CSAM scanning, updating the notification email, and configuring scanning sources. When a new email is provided, email verification is triggered automatically. The `enabled` field is a toggle; the server may adjust it based on whether the notification email is verified. Returns 403 if the zone or account is locked by Trust & Safety. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ct-alerting": "# ct-alerting — ct-alerting\n\n## Commands\n\n### Read Operations\n\n- `cf ct-alerting get` — Retrieve the Certificate Transparency alerting subscription settings for a zone. Returns whether CT monitoring is enabled and the list of email addresses that receive alerts, if any have been configured.\n\n### Update Operations\n\n- `cf ct-alerting update` — Create or update the Certificate Transparency alerting subscription for a zone. Enables or disables email notifications when certificates are issued for the zone's domains. The `enabled` field is required on every request and controls whether the subscription is active. The `emails` field is optional and, when provided, replaces the stored recipient list for the zone. When `emails` is omitted, the stored recipient list is preserved and only the enabled state is toggled. A maximum of 100 email addresses may be configured per zone. Requests that omit `enabled` are rejected with error code 1008. Subscribe and unsubscribe notification emails are only sent for recipients whose effective subscription state changes. Idempotent requests (no state change) send no notification email. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"custom-certificates": "# custom-certificates — custom-certificates\n\n## Commands\n\n### Read Operations\n\n- `cf custom-certificates get <custom-certificate-id>` — Retrieves details for a specific custom SSL certificate, including certificate metadata, bundle method, geographic restrictions, and associated keyless server configuration.\n- `cf custom-certificates list` — List, search, and filter all of your custom SSL certificates. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates.\n\n### Create Operations\n\n- `cf custom-certificates create` — Upload a new SSL certificate for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-certificates edit <custom-certificate-id>` — Upload a new private key and/or PEM/CRT for the SSL certificate. Note: PATCHing a configuration for sni_custom certificates will result in a new resource id being returned, and the previous one being deleted. (supports --dry-run, --body)\n- `cf custom-certificates prioritize update` — If a zone has multiple SSL certificates, you can set the order in which they should be used during a request. The higher priority will break ties across overlapping 'legacy_custom' certificates. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-certificates delete <custom-certificate-id>` — Remove a SSL certificate from a zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-csrs": "# custom-csrs — custom-csrs\n\n## Commands\n\n### Read Operations\n\n- `cf custom-csrs get <custom-csr-id>` — Retrieve details for a specific custom Certificate Signing Request (CSR).\n- `cf custom-csrs list` — List all custom Certificate Signing Requests (CSRs) for an account.\n\n### Create Operations\n\n- `cf custom-csrs create` — Generate a new custom Certificate Signing Request (CSR) for an account. Cloudflare generates and securely stores the private key associated with the CSR. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-csrs delete <custom-csr-id>` — Delete a custom Certificate Signing Request (CSR) and its associated private key. (supports --dry-run)\n\n### Other Operations\n\n- `cf custom-csrs customCsrsForAZoneCreateCustomCsr` — Generate a new custom Certificate Signing Request (CSR) for a zone. Cloudflare generates and securely stores the private key associated with the CSR. The CSR can then be provided to a Certificate Authority for signing. Once signed, the certificate is uploaded via the Custom SSL endpoint using the CSR ID. (supports --dry-run, --body)\n- `cf custom-csrs customCsrsForAZoneCustomCsrDetails <custom-csr-id>` — Retrieve details for a specific custom Certificate Signing Request (CSR). (supports --dry-run)\n- `cf custom-csrs customCsrsForAZoneDeleteCustomCsr <custom-csr-id>` — Delete a custom Certificate Signing Request (CSR) and its associated private key. A CSR cannot be deleted if any custom certificates still reference it. (supports --dry-run)\n- `cf custom-csrs customCsrsForAZoneListCustomCsrs` — List all custom Certificate Signing Requests (CSRs) for a zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-hostnames": "# custom-hostnames — custom-hostnames\n\n## Commands\n\n### Read Operations\n\n- `cf custom-hostnames fallback-origin get` — Retrieves the current fallback origin configuration for custom hostnames on a zone. The fallback origin handles traffic when specific custom hostname origins are unavailable.\n- `cf custom-hostnames get` — Returns custom hostname quota usage for a zone. The allocated quota is a soft limit; creating custom hostnames after usage exceeds this limit can still succeed until the hard cap is reached. Use the exceeded and hard_cap fields to track when usage is above the soft limit and when new custom hostname creation will be rejected.\n- `cf custom-hostnames list` — List, search, sort, and filter all of your custom hostnames.\n\n### Create Operations\n\n- `cf custom-hostnames create` — Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-hostnames certificate-pack certificates update <certificate-id>` — Replace a single custom certificate within a certificate pack that contains two bundled certificates. The replacement must adhere to the following constraints. You can only replace an RSA certificate with another RSA certificate or an ECDSA certificate with another ECDSA certificate. (supports --dry-run, --body)\n- `cf custom-hostnames edit <custom-hostname-id>` — Modify SSL configuration for a custom hostname. When sent with SSL config that matches existing config, used to indicate that hostname should pass domain control validation (DCV). Can also be used to change validation type, e.g., from 'http' to 'email'. Bundle an existing certificate with another certificate by using the \"custom_cert_bundle\" field. The bundling process supports combining certificates as long as the following condition is met. One certificate must use the RSA algorithm, and the other must use the ECDSA algorithm. (supports --dry-run, --body)\n- `cf custom-hostnames fallback-origin update` — Updates the fallback origin configuration for custom hostnames on a zone. Sets the default origin server for custom hostname traffic. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-hostnames certificate-pack certificates delete <certificate-id>` — Delete a single custom certificate from a certificate pack that contains two bundled certificates. Deletion is subject to the following constraints. You cannot delete a certificate if it is the only remaining certificate in the pack. At least one certificate must remain in the pack. (supports --dry-run)\n- `cf custom-hostnames delete <custom-hostname-id>` — Permanently deletes a custom hostname and revokes any SSL certificates that were issued for it. This action cannot be undone. (supports --dry-run)\n- `cf custom-hostnames fallback-origin delete` — Removes the fallback origin configuration for custom hostnames on a zone. Custom hostnames without specific origins will no longer have a fallback. (supports --dry-run)\n\n### Other Operations\n\n- `cf custom-hostnames customHostnameForAZoneCustomHostnameDetails <custom-hostname-id>` — Retrieves detailed information about a specific custom hostname, including SSL certificate status, ownership verification, and origin configuration. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-nameservers": "# custom-nameservers — custom-nameservers\n\n## Commands\n\n### Read Operations\n\n- `cf custom-nameservers get` — List an account's custom nameservers.\n\n### Create Operations\n\n- `cf custom-nameservers create` — Adds a custom nameserver to the account for use as a vanity nameserver on zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-nameservers delete <custom-ns-id>` — Removes a custom nameserver from the account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"custom-pages": "# custom-pages — Custom error and challenge pages (1000s, WAF blocks, captchas) for zones and accounts\n\n## Commands\n\n### Read Operations\n\n- `cf custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages list` — Fetches all the custom pages at the account level.\n- `cf custom-pages zone-custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages zone-custom-pages list` — Fetches all the custom pages at the zone level.\n\n### Create Operations\n\n- `cf custom-pages account-custom-pages preview-tokens create` — Creates a signed JWT token used to preview custom pages before they are published. (supports --dry-run, --body)\n- `cf custom-pages zone-custom-pages preview-tokens create <zone-identifier>` — Creates a signed JWT token used to preview custom pages before they are published. The API gateway rewrites zone-scoped requests to the account-level service endpoint. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-pages account-custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n- `cf custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf custom-pages assets create custom asset` — Creates a new custom asset at the account level. (supports --dry-run, --body)\n- `cf custom-pages assets create v2 <zone-identifier>` — Creates a new custom asset at the zone level. (supports --dry-run, --body)\n- `cf custom-pages assets delete custom asset <asset-name>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets delete v2 <asset-name>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets get custom asset <asset-name>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets get v2 <asset-name>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets list custom assets` — Fetches all the custom assets at the account level. (supports --dry-run)\n- `cf custom-pages assets list v2 <zone-identifier>` — Fetches all the custom assets at the zone level. (supports --dry-run)\n- `cf custom-pages assets update custom asset <asset-name>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n- `cf custom-pages assets update v2 <asset-name>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-csrs": "# custom-csrs — custom-csrs\n\n## Commands\n\n### Read Operations\n\n- `cf custom-csrs get <custom-csr-id>` — Retrieve details for a specific custom Certificate Signing Request (CSR).\n- `cf custom-csrs list` — List all custom Certificate Signing Requests (CSRs) for an account or zone.\n\n### Create Operations\n\n- `cf custom-csrs create` — Generate a new custom Certificate Signing Request (CSR) for an account or zone. Cloudflare generates and securely stores the private key associated with the CSR. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-csrs delete <custom-csr-id>` — Delete a custom Certificate Signing Request (CSR) and its associated private key. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-hostnames": "# custom-hostnames — custom-hostnames\n\n## Commands\n\n### Read Operations\n\n- `cf custom-hostnames fallback-origin get` — Retrieves the current fallback origin configuration for custom hostnames on a zone. The fallback origin handles traffic when specific custom hostname origins are unavailable.\n- `cf custom-hostnames get <custom-hostname-id>` — Retrieves detailed information about a specific custom hostname, including SSL certificate status, ownership verification, and origin configuration.\n- `cf custom-hostnames list` — List, search, sort, and filter all of your custom hostnames.\n- `cf custom-hostnames quota get` — Returns custom hostname quota usage for a zone. The allocated quota is a soft limit; creating custom hostnames after usage exceeds this limit can still succeed until the hard cap is reached. Use the exceeded and hard_cap fields to track when usage is above the soft limit and when new custom hostname creation will be rejected.\n\n### Create Operations\n\n- `cf custom-hostnames create` — Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-hostnames certificate-pack certificates update <certificate-id>` — Replace a single custom certificate within a certificate pack that contains two bundled certificates. The replacement must adhere to the following constraints. You can only replace an RSA certificate with another RSA certificate or an ECDSA certificate with another ECDSA certificate. (supports --dry-run, --body)\n- `cf custom-hostnames edit <custom-hostname-id>` — Modify SSL configuration for a custom hostname. When sent with SSL config that matches existing config, used to indicate that hostname should pass domain control validation (DCV). Can also be used to change validation type, e.g., from 'http' to 'email'. Bundle an existing certificate with another certificate by using the \"custom_cert_bundle\" field. The bundling process supports combining certificates as long as the following condition is met. One certificate must use the RSA algorithm, and the other must use the ECDSA algorithm. (supports --dry-run, --body)\n- `cf custom-hostnames fallback-origin update` — Updates the fallback origin configuration for custom hostnames on a zone. Sets the default origin server for custom hostname traffic. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-hostnames certificate-pack certificates delete <certificate-id>` — Delete a single custom certificate from a certificate pack that contains two bundled certificates. Deletion is subject to the following constraints. You cannot delete a certificate if it is the only remaining certificate in the pack. At least one certificate must remain in the pack. (supports --dry-run)\n- `cf custom-hostnames delete <custom-hostname-id>` — Permanently deletes a custom hostname and revokes any SSL certificates that were issued for it. This action cannot be undone. (supports --dry-run)\n- `cf custom-hostnames fallback-origin delete` — Removes the fallback origin configuration for custom hostnames on a zone. Custom hostnames without specific origins will no longer have a fallback. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-nameservers": "# custom-nameservers — custom-nameservers\n\n## Commands\n\n### Read Operations\n\n- `cf custom-nameservers get` — List an account or zone's custom nameservers.\n\n### Create Operations\n\n- `cf custom-nameservers create` — Adds a custom nameserver to the account or zone for use as a vanity nameserver on zones. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf custom-nameservers delete <custom-ns-id>` — Removes a custom nameserver from the account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"custom-pages": "# custom-pages — Custom error and challenge pages (1000s, WAF blocks, captchas) for zones and accounts\n\n## Commands\n\n### Read Operations\n\n- `cf custom-pages get <identifier>` — Fetches the details of a custom page.\n- `cf custom-pages list` — Fetches all the custom pages.\n\n### Create Operations\n\n- `cf custom-pages account-custom-pages preview-tokens create` — Creates a signed JWT token used to preview custom pages before they are published. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf custom-pages account-custom-pages update <identifier>` — Updates the configuration of an existing custom page. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf custom-pages assets create custom asset` — Creates a new custom asset. (supports --dry-run, --body)\n- `cf custom-pages assets delete custom asset <asset-name>` — Deletes an existing custom asset. (supports --dry-run)\n- `cf custom-pages assets get custom asset <asset-name>` — Fetches the details of a custom asset. (supports --dry-run)\n- `cf custom-pages assets list custom assets` — Fetches all the custom assets. (supports --dry-run)\n- `cf custom-pages assets update custom asset <asset-name>` — Updates the configuration of an existing custom asset. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"d1": "# d1 — D1 is Cloudflare's managed, serverless database with SQLite's SQL semantics, built-in disaster recovery, and Worker and HTTP API access.\n\n## Commands\n\n### Read Operations\n\n- `cf d1 export <database-id>` — Returns a URL where the SQL contents of your D1 can be downloaded. Note: this process may take some time for larger DBs, during which your D1 will be unavailable to serve queries. To avoid blocking your DB unnecessarily, an in-progress export must be continually polled or will automatically cancel. (supports --body)\n- `cf d1 get <database-id>` — Returns the specified D1 database.\n- `cf d1 list` — Returns a list of D1 databases.\n- `cf d1 migrations list <database>` — List unapplied D1 migrations as JSON. Applies nothing.\n\n### Create Operations\n\n- `cf d1 create` — Returns the created D1 database. (supports --dry-run, --body)\n- `cf d1 migrations create <message>` — Create a new empty D1 migration file, numbered one above the highest existing migration. Entirely local — takes no database, needs no credentials and makes no network calls. If an ORM manages your migrations, use its own generator instead; for Drizzle, use `drizzle-kit generate`.\n\n### Update Operations\n\n- `cf d1 edit <database-id>` — Updates partially the specified D1 database. (supports --dry-run, --body)\n- `cf d1 update <database-id>` — Updates the specified D1 database. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf d1 delete <database-id>` — Deletes the specified D1 database. (supports --dry-run)\n\n### Other Operations\n\n- `cf d1 import <database-id>` — Generates a temporary URL for uploading an SQL file to, then instructing the D1 to import it and polling it for status updates. Imports block the D1 for their duration. (supports --dry-run, --body)\n- `cf d1 migrations apply <database>` — Apply any unapplied D1 migrations. Creates the bookkeeping table if absent, diffs the migration files under --dir against what the table records, and applies the rest in numeric order. Wire-compatible with `wrangler d1 migrations apply`: same table shape, same --dir-relative recorded names, same ordering. The database must be identified by ID; names and binding names are not accepted.\n- `cf d1 query <database-id>` — Returns the query result as an object. (supports --dry-run, --body)\n- `cf d1 raw <database-id>` — Returns the query result rows as arrays rather than objects. This is a performance-optimized version of the /query endpoint. (supports --dry-run, --body)\n- `cf d1 time-travel get-bookmark <database-id>` — Retrieves the current bookmark, or the nearest bookmark at or before a provided timestamp. Bookmarks can be used with the restore endpoint to revert the database to a previous point in time. (supports --dry-run)\n- `cf d1 time-travel restore <database-id>` — Restores a D1 database to a previous point in time either via a bookmark or a timestamp. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"data-security": "# data-security — data-security\n\n## Commands\n\n### Other Operations\n\n- `cf data-security posture archiveFindingInstance <finding-id>` — Archive one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture changeFindingSeverity <finding-id>` — Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. (supports --dry-run, --body)\n- `cf data-security posture createContentExport` — Creates a CSV export for content and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingExportCSV` — Creates a CSV export for findings and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingInstancesExportCSV <storage-namespace-id>` — Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. (supports --dry-run, --body)\n- `cf data-security posture createPolicy` — Creates a new policy configuration that defines automated actions to be executed when security findings are detected. A policy can include multiple remediation and/or webhook actions that will be triggered automatically. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobs` — Create one or more remediation jobs tied to a specific Cloudflare Account. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobsExportCSV` — Creates a CSV export for remediation jobs and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createWebhook` — Creates a new webhook configuration for sending finding notifications to external endpoints. (supports --dry-run, --body)\n- `cf data-security posture createWebhookJobs` — Creates webhook jobs to send a finding instance to one or more configured webhooks. (supports --dry-run, --body)\n- `cf data-security posture deletePolicy <policy-id>` — Deletes a policy configuration. (supports --dry-run)\n- `cf data-security posture deleteWebhook <webhook-id>` — Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. (supports --dry-run)\n- `cf data-security posture evaluateExistingWebhook <webhook-id>` — Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run)\n- `cf data-security posture evaluateNewWebhook` — Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run, --body)\n- `cf data-security posture getExportJob <id>` — Retrieves a single export job by its unique identifier (supports --dry-run)\n- `cf data-security posture getFinding <finding-id>` — Gets a security Finding that has been identified as being problematic. (supports --dry-run)\n- `cf data-security posture getFindingInstance <instance-id>` — Gets a security Finding instance by id. (supports --dry-run)\n- `cf data-security posture getFindingType <finding-type-id>` — Retrieve a specific finding type by its unique identifier. (supports --dry-run)\n- `cf data-security posture getPolicyByID <policy-id>` — Retrieves the details of a specific policy configuration, including its associated remediation and webhook actions. (supports --dry-run)\n- `cf data-security posture getRemediationTypesForFindingType <finding-type-id>` — List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. (supports --dry-run)\n- `cf data-security posture getWebhookConfigByID <webhook-id>` — Retrieves a specific webhook configuration by its unique identifier. (supports --dry-run)\n- `cf data-security posture ignoreFinding` — Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. (supports --dry-run, --body)\n- `cf data-security posture listContentAssets` — List DLP content findings (supports --dry-run)\n- `cf data-security posture listExportJobs` — List all export jobs for a given requestor's organization (supports --dry-run)\n- `cf data-security posture listFindingInstances <finding-id>` — Lists all security finding instances for a given security finding. (supports --dry-run)\n- `cf data-security posture listFindings` — List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not. (supports --dry-run)\n- `cf data-security posture listFindingTypes` — List all available finding types with pagination support. (supports --dry-run)\n- `cf data-security posture listPolicies` — Returns a list of integration-scoped policy configurations for the given account. This endpoint supports cursor based pagination. By default, results are returned in sorted order based on created_at. (supports --dry-run)\n- `cf data-security posture listPolicyLogs` — Returns a list of policy invocation logs for the given account, sourced from ClickHouse via Ready Analytics. Each entry represents one execution of a policy against a finding instance, including the actions (remediation jobs and webhooks) it dispatched. Results are scoped to the requesting account's CASB integrations. The `integration_id` query parameter, when supplied, is intersected against the account's integration allowlist; values outside the allowlist are silently dropped. Pagination is offset-based. The response does not include a total row count; clients should treat a result with fewer than `per_page` entries as the end of the list. (supports --dry-run)\n- `cf data-security posture listRemediationJobs` — List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive. (supports --dry-run)\n- `cf data-security posture listWebhooks` — Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. (supports --dry-run)\n- `cf data-security posture resetFindingSeverity <finding-id>` — If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. (supports --dry-run)\n- `cf data-security posture unarchiveFindingInstance <finding-id>` — Remove the archive marking from one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture unIgnoreFinding` — Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. (supports --dry-run, --body)\n- `cf data-security posture updatePolicy <policy-id>` — Updates an existing policy configuration and replaces its actions. (supports --dry-run, --body)\n- `cf data-security posture updateWebhook <webhook-id>` — Updates an existing webhook configuration with new settings. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dcv-delegation": "# dcv-delegation — dcv-delegation\n\n## Commands\n\n### Read Operations\n\n- `cf dcv-delegation get` — Retrieve the account and zone specific unique identifier used as part of the CNAME target for DCV Delegation.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -59,18 +61,17 @@
 		"directory": "# directory — directory\n\n## Commands\n\n### Read Operations\n\n- `cf directory services get <service-id>` — Fetches a single Workers VPC connectivity service by its ID.\n- `cf directory services list` — Lists the Workers VPC connectivity services in the account.\n\n### Create Operations\n\n- `cf directory services create` — Creates a new Workers VPC connectivity service in the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf directory services update <service-id>` — Updates an existing Workers VPC connectivity service by its ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf directory services delete <service-id>` — Removes a single Workers VPC connectivity service by its ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dispatch-namespaces": "# dispatch-namespaces — dispatch-namespaces\n\n## Commands\n\n### Read Operations\n\n- `cf dispatch-namespaces get <dispatch-namespace>` — Get a Workers for Platforms namespace.\n- `cf dispatch-namespaces list` — Fetch a list of Workers for Platforms namespaces.\n- `cf dispatch-namespaces scripts bindings get <script-name>` — Fetch script bindings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts content get <script-name>` — Fetch script content from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts get <script-name>` — Fetch information about a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts list` — Fetch a list of scripts uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets get <secret-name>` — Get a given secret binding (value omitted) on a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets list` — List secrets bound to a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts settings get <script-name>` — Get script settings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts tags list` — Fetch tags from a script uploaded to a Workers for Platforms namespace.\n\n### Create Operations\n\n- `cf dispatch-namespaces create` — Create a new Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts asset-upload create <script-name>` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags create <tag>` — Put a single tag on a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Update Operations\n\n- `cf dispatch-namespaces edit <dispatch-namespace>` — Patch a Workers for Platforms namespace. Omitted fields are left unchanged. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts content update <script-name>` — Put script content for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts secrets update <script-name>` — Add a secret to a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts settings edit <script-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags update <script-name>` — Put script tags for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts update <script-name>` — Upload a worker module to a Workers for Platforms namespace. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf dispatch-namespaces update <dispatch-namespace>` — Update a Workers for Platforms namespace. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dispatch-namespaces delete <dispatch-namespace>` — Delete a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts delete <script-name>` — Delete a worker from a Workers for Platforms namespace. This call has no response body on a successful delete. (supports --dry-run)\n- `cf dispatch-namespaces scripts secrets delete <secret-name>` — Remove a secret from a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts tags delete <tag>` — Delete script tag for a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Other Operations\n\n- `cf dispatch-namespaces scripts bulk-delete` — Delete multiple scripts from a Workers for Platforms namespace based on optional tag filters. (supports --dry-run)\n- `cf dispatch-namespaces scripts secrets bulk-edit` — Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dls": "# dls — dls\n\n## Commands\n\n### Read Operations\n\n- `cf dls regional_services prefix_bindings get <binding-id>` — Get a DLS prefix binding\n- `cf dls regional_services prefix_bindings list` — List DLS prefix bindings for an account\n- `cf dls regions get <region-id>` — Get a DLS region\n- `cf dls regions list` — List DLS regions for an account\n\n### Create Operations\n\n- `cf dls regional_services prefix_bindings create` — Create a DLS prefix binding (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dls regional_services prefix_bindings edit <binding-id>` — Update a DLS prefix binding (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dls regional_services prefix_bindings delete <binding-id>` — Delete a DLS prefix binding (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"dns": "# dns — dns\n\n## Commands\n\n### Read Operations\n\n- `cf dns dnssec get` — Details about DNSSEC status and configuration.\n- `cf dns records export` — You can export your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information.\n- `cf dns records get <dns-record-id>` — Retrieves details for a specific DNS record in the zone.\n- `cf dns records list` — List, search, sort, and filter a zones' DNS records.\n- `cf dns settings account get` — Show DNS settings for an account\n- `cf dns settings account views get <view-id>` — Get DNS Internal View\n- `cf dns settings account views list` — List DNS Internal Views for an Account\n- `cf dns settings zone get` — Show DNS settings for a zone\n- `cf dns usage account get` — Get the current DNS record usage and quota for an account. May include internal DNS usage and quota.\n- `cf dns usage zone get` — Get the current DNS record usage for a zone, including the number of records and the quota limit.\n- `cf dns zone-transfers acls get <acl-id>` — Get ACL.\n- `cf dns zone-transfers acls list` — List ACLs.\n- `cf dns zone-transfers incoming get` — Get secondary zone configuration for incoming zone transfers.\n- `cf dns zone-transfers outgoing get` — Get primary zone configuration for outgoing zone transfers.\n- `cf dns zone-transfers outgoing status get` — Get primary zone transfer status.\n- `cf dns zone-transfers peers get <peer-id>` — Get Peer.\n- `cf dns zone-transfers peers list` — List Peers.\n- `cf dns zone-transfers tsigs get <tsig-id>` — Get TSIG.\n- `cf dns zone-transfers tsigs list` — List TSIGs.\n\n### Create Operations\n\n- `cf dns records create` — Create a new DNS record for a zone. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account views create` — Create Internal DNS View for an account (supports --dry-run, --body)\n- `cf dns zone-transfers acls create` — Create ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers force-axfr create` — Sends AXFR zone transfer request to primary nameserver(s). (supports --dry-run)\n- `cf dns zone-transfers incoming create` — Create secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing create` — Create primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers create` — Create Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs create` — Create TSIG. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns dnssec edit` — Enable or disable DNSSEC. (supports --dry-run, --body)\n- `cf dns records edit <dns-record-id>` — Update an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns records update <dns-record-id>` — Overwrite an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account edit` — Update DNS settings for an account (supports --dry-run, --body)\n- `cf dns settings account views edit <view-id>` — Update an existing Internal DNS View (supports --dry-run, --body)\n- `cf dns settings zone edit` — Update DNS settings for a zone (supports --dry-run, --body)\n- `cf dns zone-transfers acls update <acl-id>` — Modify ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers incoming update` — Update secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing update` — Update primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers update <peer-id>` — Modify Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs update <tsig-id>` — Modify TSIG. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns dnssec delete` — Delete DNSSEC. (supports --dry-run)\n- `cf dns records delete <dns-record-id>` — Permanently removes a DNS record from the zone. (supports --dry-run)\n- `cf dns settings account views delete <view-id>` — Delete an existing Internal DNS View (supports --dry-run)\n- `cf dns zone-transfers acls delete <acl-id>` — Delete ACL. (supports --dry-run)\n- `cf dns zone-transfers incoming delete` — Delete secondary zone configuration for incoming zone transfers. (supports --dry-run)\n- `cf dns zone-transfers outgoing delete` — Delete primary zone configuration for outgoing zone transfers. (supports --dry-run)\n- `cf dns zone-transfers peers delete <peer-id>` — Delete Peer. (supports --dry-run)\n- `cf dns zone-transfers tsigs delete <tsig-id>` — Delete TSIG. (supports --dry-run)\n\n### Other Operations\n\n- `cf dns dnssec list zsks` — List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone. (supports --dry-run)\n- `cf dns records batch` — Send a Batch of DNS Record API calls to be executed together. Notes: - Although Cloudflare will execute the batched operations in a single database transaction, Cloudflare's distributed KV store must treat each record change as a single key-value pair. This means that the propagation of changes is not atomic. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/batch-record-changes/ \"Batch DNS records\") for more information. - The operations you specify within the /batch request body are always executed in the following order: - Deletes - Patches - Puts - Posts (supports --dry-run, --body)\n- `cf dns records import` — You can upload your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. It assumes that cURL is called from a location with bind_config.txt (valid BIND config) present. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information. (supports --dry-run, --body)\n- `cf dns records scan` — Scan for common DNS records on your domain and automatically add them to your zone. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns records scan-list` — Retrieves the list of DNS records discovered up to this point by the asynchronous scan. These records are temporary until explicitly accepted or rejected via `POST /scan/review`. Additional records may be discovered by the scan later. (supports --dry-run)\n- `cf dns records scan-review` — Accept or reject DNS records found by the DNS records scan. Accepted records will be permanently added to the zone, while rejected records will be permanently deleted. (supports --dry-run, --body)\n- `cf dns records scan-trigger` — Initiates an asynchronous scan for common DNS records on your domain. Note that this **does not** automatically add records to your zone. The scan runs in the background, and results can be reviewed later using the `/scan/review` endpoints. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns zone-transfers outgoing disable` — Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing enable` — Enable outgoing zone transfers for primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing force-notify` — Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"dns": "# dns — dns\n\n## Commands\n\n### Read Operations\n\n- `cf dns dnssec get` — Details about DNSSEC status and configuration.\n- `cf dns records export` — You can export your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information.\n- `cf dns records get <dns-record-id>` — Retrieves details for a specific DNS record in the zone.\n- `cf dns records list` — List, search, sort, and filter a zones' DNS records.\n- `cf dns settings account get` — Show DNS settings for an account or zone\n- `cf dns settings account views get <view-id>` — Get DNS Internal View\n- `cf dns settings account views list` — List DNS Internal Views for an Account\n- `cf dns usage account get` — Get the current DNS record usage and quota for an account or zone. May include internal DNS usage and quota.\n- `cf dns zone-transfers acls get <acl-id>` — Get ACL.\n- `cf dns zone-transfers acls list` — List ACLs.\n- `cf dns zone-transfers incoming get` — Get secondary zone configuration for incoming zone transfers.\n- `cf dns zone-transfers outgoing get` — Get primary zone configuration for outgoing zone transfers.\n- `cf dns zone-transfers outgoing status get` — Get primary zone transfer status.\n- `cf dns zone-transfers peers get <peer-id>` — Get Peer.\n- `cf dns zone-transfers peers list` — List Peers.\n- `cf dns zone-transfers tsigs get <tsig-id>` — Get TSIG.\n- `cf dns zone-transfers tsigs list` — List TSIGs.\n\n### Create Operations\n\n- `cf dns records create` — Create a new DNS record for a zone. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account views create` — Create Internal DNS View for an account (supports --dry-run, --body)\n- `cf dns zone-transfers acls create` — Create ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers force-axfr create` — Sends AXFR zone transfer request to primary nameserver(s). (supports --dry-run)\n- `cf dns zone-transfers incoming create` — Create secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing create` — Create primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers create` — Create Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs create` — Create TSIG. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns dnssec edit` — Enable or disable DNSSEC. (supports --dry-run, --body)\n- `cf dns records edit <dns-record-id>` — Update an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns records update <dns-record-id>` — Overwrite an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record. (supports --dry-run, --body)\n- `cf dns settings account edit` — Update DNS settings for an account or zone (supports --dry-run, --body)\n- `cf dns settings account views edit <view-id>` — Update an existing Internal DNS View (supports --dry-run, --body)\n- `cf dns zone-transfers acls update <acl-id>` — Modify ACL. (supports --dry-run, --body)\n- `cf dns zone-transfers incoming update` — Update secondary zone configuration for incoming zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers outgoing update` — Update primary zone configuration for outgoing zone transfers. (supports --dry-run, --body)\n- `cf dns zone-transfers peers update <peer-id>` — Modify Peer. (supports --dry-run, --body)\n- `cf dns zone-transfers tsigs update <tsig-id>` — Modify TSIG. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns dnssec delete` — Delete DNSSEC. (supports --dry-run)\n- `cf dns records delete <dns-record-id>` — Permanently removes a DNS record from the zone. (supports --dry-run)\n- `cf dns settings account views delete <view-id>` — Delete an existing Internal DNS View (supports --dry-run)\n- `cf dns zone-transfers acls delete <acl-id>` — Delete ACL. (supports --dry-run)\n- `cf dns zone-transfers incoming delete` — Delete secondary zone configuration for incoming zone transfers. (supports --dry-run)\n- `cf dns zone-transfers outgoing delete` — Delete primary zone configuration for outgoing zone transfers. (supports --dry-run)\n- `cf dns zone-transfers peers delete <peer-id>` — Delete Peer. (supports --dry-run)\n- `cf dns zone-transfers tsigs delete <tsig-id>` — Delete TSIG. (supports --dry-run)\n\n### Other Operations\n\n- `cf dns dnssec list zsks` — List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone. (supports --dry-run)\n- `cf dns records batch` — Send a Batch of DNS Record API calls to be executed together. Notes: - Although Cloudflare will execute the batched operations in a single database transaction, Cloudflare's distributed KV store must treat each record change as a single key-value pair. This means that the propagation of changes is not atomic. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/batch-record-changes/ \"Batch DNS records\") for more information. - The operations you specify within the /batch request body are always executed in the following order: - Deletes - Patches - Puts - Posts (supports --dry-run, --body)\n- `cf dns records import` — You can upload your [BIND config](https://en.wikipedia.org/wiki/Zone_file \"Zone file\") through this endpoint. It assumes that cURL is called from a location with bind_config.txt (valid BIND config) present. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ \"Import and export records\") for more information. (supports --dry-run, --body)\n- `cf dns records scan` — Scan for common DNS records on your domain and automatically add them to your zone. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns records scan-list` — Retrieves the list of DNS records discovered up to this point by the asynchronous scan. These records are temporary until explicitly accepted or rejected via `POST /scan/review`. Additional records may be discovered by the scan later. (supports --dry-run)\n- `cf dns records scan-review` — Accept or reject DNS records found by the DNS records scan. Accepted records will be permanently added to the zone, while rejected records will be permanently deleted. (supports --dry-run, --body)\n- `cf dns records scan-trigger` — Initiates an asynchronous scan for common DNS records on your domain. Note that this **does not** automatically add records to your zone. The scan runs in the background, and results can be reviewed later using the `/scan/review` endpoints. Useful if you haven't updated your nameservers yet. (supports --dry-run)\n- `cf dns zone-transfers outgoing disable` — Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing enable` — Enable outgoing zone transfers for primary zone. (supports --dry-run)\n- `cf dns zone-transfers outgoing force-notify` — Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dns-firewall": "# dns-firewall — dns-firewall\n\n## Commands\n\n### Read Operations\n\n- `cf dns-firewall get <dns-firewall-id>` — Show a single DNS Firewall cluster for an account\n- `cf dns-firewall list` — List DNS Firewall clusters for an account\n- `cf dns-firewall reverse-dns get <dns-firewall-id>` — Show reverse DNS configuration (PTR records) for a DNS Firewall cluster\n\n### Create Operations\n\n- `cf dns-firewall create` — Create a DNS Firewall cluster (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf dns-firewall edit <dns-firewall-id>` — Modify the configuration of a DNS Firewall cluster (supports --dry-run, --body)\n- `cf dns-firewall reverse-dns edit <dns-firewall-id>` — Update reverse DNS configuration (PTR records) for a DNS Firewall cluster (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dns-firewall delete <dns-firewall-id>` — Delete a DNS Firewall cluster (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"domain-info": "# domain-info — domain-info\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"durable-objects": "# durable-objects — durable-objects\n\n## Commands\n\n### Read Operations\n\n- `cf durable-objects namespaces list` — Returns the Durable Object namespaces owned by an account.\n- `cf durable-objects namespaces objects list` — Returns the Durable Objects in a given namespace.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email": "# email — email\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"email-auth": "# email-auth — email-auth\n\n## Commands\n\n### Read Operations\n\n- `cf email-auth dmarc-reports get` — Retrieves the current DMARC report configuration and status for a zone. Returns the RUA prefix, enabled status, approved sources, and DNS records.\n\n### Update Operations\n\n- `cf email-auth dmarc-reports edit` — Updates the DMARC report configuration for a zone. At least one of `enabled` or `skip_wizard` must be provided. When enabling, the handler will ensure the DMARC RUA record exists in DNS. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf email-auth spf inspect` — Inspects a specific SPF TXT record and returns a parsed tree structure in the spflimit-worker format. The record ID must be provided via the `id` query parameter. Returns a recursive tree showing: - Parsed components with their qualifiers and types - Nested includes recursively resolved within components - Per-component and total lookup counts - Detailed error information with context (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-routing": "# email-routing — Route incoming emails to destination addresses using custom rules, catch-all handlers, and DNS configuration\n\n## Commands\n\n### Read Operations\n\n- `cf email-routing addresses get <destination-address-identifier>` — Gets information for a specific destination email already created.\n- `cf email-routing addresses list` — Lists existing destination addresses.\n- `cf email-routing dns get` — Show the DNS records needed to configure your Email Routing zone.\n- `cf email-routing get` — Get information about the settings for your Email Routing zone.\n- `cf email-routing rules catch-alls get` — Get information on the default catch-all routing rule.\n- `cf email-routing rules get <rule-identifier>` — Get information for a specific routing rule already created.\n- `cf email-routing rules list` — Lists existing routing rules.\n\n### Create Operations\n\n- `cf email-routing addresses create` — Create a destination address to forward your emails to. Destination addresses need to be verified before they can be used. (supports --dry-run, --body)\n- `cf email-routing dns create` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run, --body)\n- `cf email-routing rules create` — Rules consist of a set of criteria for matching emails (such as an email being sent to a specific custom email address) plus a set of actions to take on the email (like forwarding it to a specific destination address). Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-routing addresses update <destination-address-identifier>` — Updates the status of a specific destination address. (supports --dry-run, --body)\n- `cf email-routing dns edit` — Unlock MX Records previously locked by Email Routing. (supports --dry-run, --body)\n- `cf email-routing edit` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n- `cf email-routing rules catch-alls update` — Enable or disable catch-all routing rule, or change action to forward to a specific destination address. Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n- `cf email-routing rules update <rule-identifier>` — Update actions and matches, or enable/disable specific routing rules. Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n- `cf email-routing update` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-routing addresses delete <destination-address-identifier>` — Deletes a specific destination address. (supports --dry-run)\n- `cf email-routing dns delete` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run, --body)\n- `cf email-routing rules delete <rule-identifier>` — Delete a specific routing rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-routing disable` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run)\n- `cf email-routing enable` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run)\n- `cf email-routing rules list-account` — Lists existing routing rules across all zones in the account. (supports --dry-run)\n- `cf email-routing rules plan` — Computes the Email Routing rule changes that would be needed to reconcile a Wrangler-managed desired ruleset. This endpoint is read-only and does not create, update, or delete rules. (supports --dry-run, --body)\n- `cf email-routing unlock` — Unlock MX records previously locked by Email Routing. Deprecated - use PATCH /zones/{zone_id}/email/routing/dns instead. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-security": "# email-security — Cloud email security — investigate threats, manage allow/block policies, and detect phishing\n\n## Commands\n\n### Read Operations\n\n- `cf email-security allow-policies get <policy-id>` — Retrieves details for a specific allow policy including its pattern, dispositions that are exempted, and whether it applies to all detections.\n- `cf email-security allow-policies list` — Returns a paginated list of email allow policies. These policies exempt matching emails from security detection, allowing them to bypass disposition actions. Supports filtering by pattern type and policy attributes.\n- `cf email-security block-senders get <pattern-id>` — Retrieves details for a specific blocked sender pattern including its pattern type, value, and metadata.\n- `cf email-security block-senders list` — Returns a paginated list of blocked email sender patterns. These patterns prevent emails from matching senders from being delivered. Supports filtering by pattern type and searching across patterns.\n- `cf email-security content-policies get <policy-id>` — Retrieves details for a specific content policy including its pattern, targets, and metadata.\n- `cf email-security content-policies list` — Returns a paginated list of content policies. These policies match against the subject or body of emails using a pattern. Supports filtering by name or enabled status, and searching across name and pattern fields.\n- `cf email-security domains get <domain-id>` — Retrieves detailed information for a specific protected email domain including its delivery configuration, SPF/DMARC status, and authorization state.\n- `cf email-security domains list` — Returns a paginated list of email domains protected by Email Security. Includes domain configuration, delivery modes, and authorization status. Supports filtering by delivery mode and integration ID.\n- `cf email-security domains verification get <domain-id>` — Returns DNS TXT verification details for a domain created through the Terraform API. Returns `200 OK` with the TXT record name and value when the domain uses `dns_txt` verification. Returns `204 No Content` for pre-existing domains or domains verified by other means (Cloudflare zone ownership, CASB integration).\n- `cf email-security impersonation-registry get <impersonation-registry-id>` — Retrieves details for a specific impersonation registry entry including the protected identity, email pattern, and synchronization source if directory-synced.\n- `cf email-security impersonation-registry list` — Returns a paginated list of protected identities in the impersonation registry. These entries define identities and email addresses to protect from impersonation attacks. Can be manually added or automatically synced from directory integrations.\n- `cf email-security investigate action-log get <investigate-id>` — Returns the list of post-delivery actions (moves, quarantine releases, previews, etc.) that have been applied to a specific email message.\n- `cf email-security investigate bulk get <job-id>` — Returns the status and details of a specific bulk action job.\n- `cf email-security investigate bulk list` — Returns a paginated list of bulk action jobs for the account.\n- `cf email-security investigate bulk messages list` — Returns the individual messages associated with a bulk action job, including their processing status.\n- `cf email-security investigate detections get <investigate-id>` — Returns detection details such as threat categories and sender information for non-benign messages.\n- `cf email-security investigate get <investigate-id>` — Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information.\n- `cf email-security investigate list` — Returns information for each email that matches the search parameter(s).\n- `cf email-security investigate preview get <investigate-id>` — Returns a preview of the message body as a base64 encoded PNG image for non-benign messages.\n- `cf email-security investigate raw get <investigate-id>` — Returns the raw eml of any non-benign message.\n- `cf email-security investigate trace get <investigate-id>` — Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues.\n- `cf email-security phishguard reports list` — Retrieves PhishGuard security alert reports for a specified date range. Reports include detected threats, dispositions, and contextual information. Use for security monitoring and threat analysis.\n- `cf email-security sending-domain-restrictions get <sending-domain-restriction-id>` — Retrieves details for a specific sending domain restriction including the domain requiring TLS and any excluded subdomains exempt from the TLS requirement.\n- `cf email-security sending-domain-restrictions list` — Returns a paginated list of sending domain restrictions. These restrictions enforce TLS requirements for emails from specific domains. Mail without TLS from restricted domains will be dropped unless the subdomain is in the exclude list. Supports sorting and searching.\n- `cf email-security submissions list` — Returns information for submissions made to reclassify emails. Shows the status, outcome, and disposition changes for reclassification requests made by users or the security team. Useful for tracking false positive/negative reports.\n- `cf email-security trusted-domains get <trusted-domain-id>` — Retrieves details for a specific trusted domain pattern including its pattern value, whether it uses regex matching, and which detection types it affects.\n- `cf email-security trusted-domains list` — Returns a paginated list of trusted domain patterns. Trusted domains prevent false positives for recently registered domains and lookalike domain detections. Patterns can use regular expressions for flexible matching.\n- `cf email-security url-ignore-patterns get <pattern-id>` — Returns a single URL rewrite ignore pattern by its identifier.\n- `cf email-security url-ignore-patterns list` — Returns a paginated list of URL rewrite ignore patterns for the account. URLs matching these patterns will not be rewritten.\n\n### Create Operations\n\n- `cf email-security allow-policies create` — Creates a new allow policy that exempts matching emails from security detections. Use with caution as this bypasses email security scanning. Policies can match on sender patterns and apply to specific detections or all detections. (supports --dry-run, --body)\n- `cf email-security block-senders create` — Creates a new blocked sender pattern. Emails matching this pattern will be blocked from delivery. Patterns can be email addresses, domains, or IP addresses, and support regular expressions. (supports --dry-run, --body)\n- `cf email-security content-policies create` — Creates a new content policy. Emails whose subject or body matches the pattern will be subject to the configured action. (supports --dry-run, --body)\n- `cf email-security domains create` — Protects a new email domain by adding it to Email Security. Accepts a flat configuration object covering all delivery modes. Returns the newly created domain configuration. (supports --dry-run, --body)\n- `cf email-security impersonation-registry create` — Creates a new entry in the impersonation registry to protect against impersonation. Emails attempting to impersonate this identity will be flagged. Supports regex patterns for flexible email matching. (supports --dry-run, --body)\n- `cf email-security investigate bulk cancel create <job-id>` — Cancels the job, marking it as cancelled and stopping any pending message processing. The job record remains visible in list and detail endpoints. (supports --dry-run)\n- `cf email-security investigate bulk create` — Creates a new bulk action job to move or release messages that match the provided search parameters. (supports --dry-run, --body)\n- `cf email-security investigate move create <investigate-id>` — Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. (supports --dry-run, --body)\n- `cf email-security investigate preview create` — Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body. (supports --dry-run, --body)\n- `cf email-security investigate reclassify create <investigate-id>` — Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously. (supports --dry-run, --body)\n- `cf email-security sending-domain-restrictions create` — Creates a new sending domain restriction to enforce TLS requirements for a domain. Emails without TLS from this domain will be dropped unless the subdomain is in the exclude list. (supports --dry-run, --body)\n- `cf email-security trusted-domains create` — Creates a new trusted domain pattern. Use for partner domains or approved senders that should bypass recent domain registration and similarity checks. Configure whether it prevents recent domain or spoof dispositions. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns create` — Creates a new URL rewrite ignore pattern. URLs matching this pattern will not be rewritten. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-security allow-policies edit <policy-id>` — Updates an existing allow policy. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n- `cf email-security allow-policies update <policy-id>` — Replaces an existing allow policy in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing policies declaratively. (supports --dry-run, --body)\n- `cf email-security block-senders edit <pattern-id>` — Updates an existing blocked sender pattern. Only provided fields will be modified. The pattern will continue blocking emails until deleted. (supports --dry-run, --body)\n- `cf email-security block-senders update <pattern-id>` — Replaces an existing blocked sender pattern in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing blocked senders declaratively. (supports --dry-run, --body)\n- `cf email-security content-policies edit <policy-id>` — Updates an existing content policy. Only provided fields will be modified. (supports --dry-run, --body)\n- `cf email-security domains edit <domain-id>` — Updates configuration for a protected email domain. Only provided fields will be modified. Changes affect delivery mode, security settings, and regional processing. (supports --dry-run, --body)\n- `cf email-security domains update <domain-id>` — Replaces all mutable fields of a protected email domain in a single atomic operation. Unlike PATCH, all non-computed fields are required. (supports --dry-run, --body)\n- `cf email-security impersonation-registry edit <impersonation-registry-id>` — Updates an existing impersonation registry entry. Only provided fields will be modified. Directory-synced entries can't be updated. (supports --dry-run, --body)\n- `cf email-security sending-domain-restrictions edit <sending-domain-restriction-id>` — Updates an existing sending domain restriction. Only provided fields will be modified. Changes affect which domains require TLS and which subdomains are excluded. (supports --dry-run, --body)\n- `cf email-security trusted-domains edit <trusted-domain-id>` — Updates an existing trusted domain pattern. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n- `cf email-security trusted-domains update <trusted-domain-id>` — Replaces an existing trusted domain in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing trusted domains declaratively. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns edit <pattern-id>` — Updates an existing URL rewrite ignore pattern. Only provided fields will be modified. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-security allow-policies delete <policy-id>` — Removes an allow policy. After deletion, emails matching this pattern will be subject to normal security scanning and disposition actions. (supports --dry-run)\n- `cf email-security block-senders delete <pattern-id>` — Removes a blocked sender pattern. After deletion, emails from this sender will no longer be automatically blocked based on this rule. (supports --dry-run)\n- `cf email-security content-policies delete <policy-id>` — Removes a content policy. After deletion, emails will no longer be evaluated against this pattern. (supports --dry-run)\n- `cf email-security domains delete <domain-id>` — Removes email security protection from a domain. After deletion, emails for this domain will no longer be processed by Email Security. This action cannot be undone. (supports --dry-run)\n- `cf email-security impersonation-registry delete <impersonation-registry-id>` — Removes an entry from the impersonation registry. After deletion, this identity will no longer be protected from impersonation. (supports --dry-run)\n- `cf email-security investigate bulk delete <job-id>` — Deletes the job, removing it from all list and detail endpoints. Only jobs in a terminal state (`COMPLETED`, `CANCELLED`, `FAILED`, or `SKIPPED`) can be deleted. To stop an in-progress job without removing it, use the cancel endpoint instead. (supports --dry-run)\n- `cf email-security sending-domain-restrictions delete <sending-domain-restriction-id>` — Removes a sending domain restriction. After deletion, TLS will no longer be enforced for emails from this domain. (supports --dry-run)\n- `cf email-security trusted-domains delete <trusted-domain-id>` — Removes a trusted domain pattern. After deletion, emails from this domain will be subject to normal recent domain and similarity checks. (supports --dry-run)\n- `cf email-security url-ignore-patterns delete <pattern-id>` — Removes a URL rewrite ignore pattern. After deletion, URLs matching this pattern will be rewritten again. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-security allow-policies batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security block-senders batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security content-policies batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security domains batch` — Executes multiple domain operations in a single request. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security investigate move bulk` — Moves multiple messages to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. (supports --dry-run, --body)\n- `cf email-security investigate release bulk` — Delivers one or more quarantined messages to their intended recipients, for cases where a message was incorrectly quarantined. The response includes delivery status for each recipient. (supports --dry-run, --body)\n- `cf email-security trusted-domains batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns batch` — Sends a batch of URL ignore patterns API calls to execute together. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"email-sending": "# email-sending — Send emails and manage sending subdomains\n\n## Commands\n\n### Read Operations\n\n- `cf email-sending get <message-id>` — Returns the raw RFC 5322 MIME message for the given account and message id.\n- `cf email-sending limits get` — Returns the current daily sending quota for the account and, when a quota is resolved, the account's current usage against it. Quota is null when not yet available; usage is null when there is no resolved quota or usage is temporarily unavailable.\n- `cf email-sending subdomains dns get <subdomain-id>` — Returns the expected DNS records for a sending subdomain.\n- `cf email-sending subdomains get <subdomain-id>` — Gets information for a specific sending subdomain.\n- `cf email-sending subdomains list` — Lists all sending-enabled subdomains for the zone.\n- `cf email-sending suppressions get <suppression-id>` — Gets an Email Sending suppression owned by the account.\n- `cf email-sending suppressions list` — Lists every active Email Sending suppression owned by the account, including legacy rows with internal zone memberships.\n\n### Create Operations\n\n- `cf email-sending subdomains create` — Creates a new sending subdomain or re-enables sending on an existing subdomain that had it disabled. If zone-level Email Sending has not been enabled yet, the zone flag is automatically set when the entitlement is present. A leftmost wildcard such as `*.example.com` is accepted only for accounts with wildcard Email Sending enabled. Wildcard senders share the base domain's DKIM signing identity and `cf-bounce.<base>` return path. (supports --dry-run, --body)\n- `cf email-sending suppressions create` — Creates an account-wide suppression. If a mutable legacy zone-linked row already exists, it is promoted without changing its identifier. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-sending subdomains update <subdomain-id>` — Updates the activity-log preview preference for a sending subdomain. (supports --dry-run, --body)\n- `cf email-sending suppressions edit <suppression-id>` — Updates expiry or advisory note fields without changing legacy internal zone memberships. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-sending subdomains delete <subdomain-id>` — Disables sending on a subdomain and removes its DNS records. If routing is still active on the subdomain, only sending is disabled. (supports --dry-run)\n- `cf email-sending suppressions delete <suppression-id>` — Deletes the suppression, its note, and every legacy internal zone membership, allowing future delivery attempts to the address. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-sending send` — Send an email for the specified account using the structured builder. Provide the sender, recipients, subject, and at least one of text or html; attachments are optional. (supports --dry-run, --body)\n- `cf email-sending send-raw` — Send a raw RFC 5322 (MIME) email for the specified account. Provide the full MIME message plus the SMTP envelope (from and recipients). (supports --dry-run, --body)\n- `cf email-sending subdomains dns fix <subdomain-id>` — Idempotently re-applies the sending DNS records (creates missing records, re-applies the email_routing lock on records whose lock has been cleared). Refuses with a 409 if foreign MX, multiple SPF, multiple DMARC, or multiple DKIM records exist at the relevant DNS names — those require manual cleanup. (supports --dry-run)\n- `cf email-sending subdomains dns get-status <subdomain-id>` — Returns the desired DNS records for a sending subdomain along with a live diff against actual DNS state. Use this to detect missing, unlocked, foreign, or multi-record conflicts before deciding whether to call the fix endpoint. For wildcard sending rows, each call also rechecks the governing organizational-domain DMARC policy and reports policy drift that DNS Fix cannot repair. (supports --dry-run)\n- `cf email-sending subdomains preview` — Returns the DNS records that would be created for a sending subdomain, flags which records are missing, and reports any conflicts with existing DNS records. This is a read-only dry-run — no records are created or modified. Use before or after creating a subdomain to check DNS status. A leftmost wildcard requires wildcard Email Sending to be enabled for the account and previews base-scoped DKIM and return-path records. (supports --dry-run, --body)\n- `cf email-sending subdomains reputation get-complaints <subdomain-id>` — Returns the matched complaint count for a sending subdomain in a half-open time window of up to seven days. (supports --dry-run)\n- `cf email-sending suppressions import` — Imports up to 1,000 account-level Email Sending suppressions in one request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"filters": "# filters — Filter expressions used by legacy firewall rules to match requests — prefer Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf filters get <filter-id>` — Fetches the details of a filter.\n- `cf filters list` — Fetches filters in a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf filters create` — Creates one or more filters. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf filters update <filter-id>` — Updates an existing filter. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf filters delete <filter-id>` — Deletes an existing filter. (supports --dry-run)\n\n### Other Operations\n\n- `cf filters bulk-delete` — Deletes one or more existing filters. (supports --dry-run)\n- `cf filters bulk-update` — Updates one or more existing filters. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"firewall": "# firewall — Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages\n\n## Commands\n\n### Read Operations\n\n- `cf firewall access-rules get <rule-id>` — Fetches the details of an IP Access rule defined at the account level.\n- `cf firewall access-rules list` — Fetches IP Access rules of an account. These rules apply to all the zones in the account. You can filter the results using several optional parameters.\n- `cf firewall lockdowns get <lock-downs-id>` — Fetches the details of a Zone Lockdown rule.\n- `cf firewall lockdowns list` — Fetches Zone Lockdown rules. You can filter the results using several optional parameters.\n- `cf firewall rules get <rule-id>` — Fetches the details of a firewall rule.\n- `cf firewall rules list` — Fetches firewall rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall ua-rules get <ua-rule-id>` — Fetches the details of a User Agent Blocking rule.\n- `cf firewall ua-rules list` — Fetches User Agent Blocking rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall waf overrides get <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the details of a URI-based WAF override.\n- `cf firewall waf overrides list` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the URI-based WAF overrides in a zone.\n- `cf firewall waf packages get <package-id>` — Fetches the details of a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages list` — Fetches WAF packages for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall zone-access-rules list` — Fetches IP Access rules of a zone. You can filter the results using several optional parameters.\n\n### Create Operations\n\n- `cf firewall access-rules create` — Creates a new IP Access rule for an account. The rule will apply to all zones in the account. Note: To create an IP Access rule that applies to a single zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf firewall lockdowns create` — Creates a new Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules create` — Create one or more firewall rules. (supports --dry-run, --body)\n- `cf firewall ua-rules create` — Creates a new User Agent Blocking rule in a zone. (supports --dry-run, --body)\n- `cf firewall waf overrides create` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously created a URI-based WAF override for a zone. (supports --dry-run, --body)\n- `cf firewall zone-access-rules create` — Creates a new IP Access rule for a zone. Note: To create an IP Access rule that applies to multiple zones, refer to [IP Access rules for a user](#ip-access-rules-for-a-user) or [IP Access rules for an account](#ip-access-rules-for-an-account) as appropriate. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf firewall access-rules edit <rule-id>` — Updates an IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run, --body)\n- `cf firewall lockdowns update <lock-downs-id>` — Updates an existing Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules edit <rule-id>` — Updates the priority of an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall rules update <rule-id>` — Updates an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules update <ua-rule-id>` — Updates an existing User Agent Blocking rule. (supports --dry-run, --body)\n- `cf firewall waf overrides update <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously updated an existing URI-based WAF override. (supports --dry-run, --body)\n- `cf firewall zone-access-rules edit <rule-id>` — Updates an IP Access rule defined at the zone level. You can only update the rule action (`mode` parameter) and notes. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf firewall access-rules delete <rule-id>` — Deletes an existing IP Access rule defined at the account level. Note: This operation will affect all zones in the account. (supports --dry-run)\n- `cf firewall lockdowns delete <lock-downs-id>` — Deletes an existing Zone Lockdown rule. (supports --dry-run)\n- `cf firewall rules delete <rule-id>` — Deletes an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules delete <ua-rule-id>` — Deletes an existing User Agent Blocking rule. (supports --dry-run)\n- `cf firewall waf overrides delete <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously deleted an existing URI-based WAF override. (supports --dry-run)\n- `cf firewall zone-access-rules delete <rule-id>` — Deletes an IP Access rule defined at the zone level. Optionally, you can use the `cascade` property to specify that you wish to delete similar rules in other zones managed by the same zone owner. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf firewall rules bulk-delete` — Deletes existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-edit` — Updates the priority of existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-update` — Updates one or more existing firewall rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"flagship": "# flagship — flagship\n\n## Commands\n\n### Read Operations\n\n- `cf flagship apps definitions get <app-id>` — Returns an app's evaluation-only flag definitions for SDKs that evaluate locally. Send the returned `ETag` in `If-None-Match` to avoid downloading unchanged definitions.\n- `cf flagship apps evaluate get <app-id>` — Evaluates a flag against the provided context. Pass context attributes as query parameters; values are forwarded as strings. For low-latency in-Worker evaluation, prefer the Flagship binding over this endpoint.\n- `cf flagship apps flags changelog list` — Returns the audit history for a flag, newest first. Each entry includes the event type and full flag state after the change; `update` entries include a field-level diff. Capped at 200 entries per flag.\n- `cf flagship apps flags get <flag-key>` — Returns the full flag definition including rules, variations, and audit fields.\n- `cf flagship apps flags list` — Lists an app's flags ordered by key. Pass `cursor` from `result_info` to page forward; a null cursor indicates the last page.\n- `cf flagship apps get <app-id>` — Returns an app's name and audit fields. Flag definitions are not included.\n- `cf flagship apps list` — Lists all apps in the account. Returns identity and audit fields only — flag definitions are not included.\n\n### Create Operations\n\n- `cf flagship apps create` — Creates an app. The returned `id` is used in all subsequent flag, changelog, and evaluation requests. (supports --dry-run, --body)\n- `cf flagship apps evaluate create <app-id>` — Evaluates a flag against the provided context, passed as a JSON request body (OFREP-shaped) rather than query parameters. Returns the same response shape as the GET variant. (supports --dry-run, --body)\n- `cf flagship apps flags create <app-id>` — Creates a flag. Returns 409 if the key already exists. `type` is inferred from variation values and may be omitted. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf flagship apps flags update <flag-key>` — Replaces the entire flag definition. Omitted fields are dropped, not preserved — read before writing. Each update appends a changelog entry. (supports --dry-run, --body)\n- `cf flagship apps update <app-id>` — Updates an app. Only `name` is mutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf flagship apps delete <app-id>` — Deletes an app and all its flags and changelog history. Returns 409 if any Worker still references this app via a Flagship binding. (supports --dry-run)\n- `cf flagship apps flags delete <flag-key>` — Deletes a flag permanently. Subsequent evaluations fall back to the caller-supplied default. Cannot be undone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-routing": "# email-routing — Route incoming emails to destination addresses using custom rules, catch-all handlers, and DNS configuration\n\n## Commands\n\n### Read Operations\n\n- `cf email-routing addresses get <destination-address-identifier>` — Gets information for a specific destination email already created.\n- `cf email-routing addresses list` — Lists existing destination addresses.\n- `cf email-routing dns get` — Show the DNS records needed to configure your Email Routing zone.\n- `cf email-routing get` — Get information about the settings for your Email Routing zone.\n- `cf email-routing rules catch-alls get` — Get information on the default catch-all routing rule.\n- `cf email-routing rules get <rule-identifier>` — Get information for a specific routing rule already created.\n\n### Create Operations\n\n- `cf email-routing addresses create` — Create a destination address to forward your emails to. Destination addresses need to be verified before they can be used. (supports --dry-run, --body)\n- `cf email-routing dns create` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run, --body)\n- `cf email-routing rules create` — Rules consist of a set of criteria for matching emails (such as an email being sent to a specific custom email address) plus a set of actions to take on the email (like forwarding it to a specific destination address). Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-routing addresses update <destination-address-identifier>` — Updates the status of a specific destination address. (supports --dry-run, --body)\n- `cf email-routing dns edit` — Unlock MX Records previously locked by Email Routing. (supports --dry-run, --body)\n- `cf email-routing edit` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n- `cf email-routing rules catch-alls update` — Enable or disable catch-all routing rule, or change action to forward to a specific destination address. Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n- `cf email-routing rules update <rule-identifier>` — Update actions and matches, or enable/disable specific routing rules. Forward actions require exactly one verified destination address. (supports --dry-run, --body)\n- `cf email-routing update` — Update the settings for your Email Routing zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-routing addresses delete <destination-address-identifier>` — Deletes a specific destination address. (supports --dry-run)\n- `cf email-routing dns delete` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run, --body)\n- `cf email-routing rules delete <rule-identifier>` — Delete a specific routing rule. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-routing disable` — Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work. (supports --dry-run)\n- `cf email-routing enable` — Enable you Email Routing zone. Add and lock the necessary MX and SPF records. (supports --dry-run)\n- `cf email-routing rules list-account` — Lists existing routing rules across all zones in the account or zone. (supports --dry-run)\n- `cf email-routing rules plan` — Computes the Email Routing rule changes that would be needed to reconcile a Wrangler-managed desired ruleset. This endpoint is read-only and does not create, update, or delete rules. (supports --dry-run, --body)\n- `cf email-routing unlock` — Unlock MX records previously locked by Email Routing. Deprecated - use PATCH /zones/{zone_id}/email/routing/dns instead. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-security": "# email-security — Cloud email security — investigate threats, manage allow/block policies, and detect phishing\n\n## Commands\n\n### Read Operations\n\n- `cf email-security allow-policies get <policy-id>` — Retrieves details for a specific allow policy including its pattern, dispositions that are exempted, and whether it applies to all detections.\n- `cf email-security allow-policies list` — Returns a paginated list of email allow policies. These policies exempt matching emails from security detection, allowing them to bypass disposition actions. Supports filtering by pattern type and policy attributes.\n- `cf email-security block-senders get <pattern-id>` — Retrieves details for a specific blocked sender pattern including its pattern type, value, and metadata.\n- `cf email-security block-senders list` — Returns a paginated list of blocked email sender patterns. These patterns prevent emails from matching senders from being delivered. Supports filtering by pattern type and searching across patterns.\n- `cf email-security content-policies get <policy-id>` — Retrieves details for a specific content policy including its pattern, targets, and metadata.\n- `cf email-security content-policies list` — Returns a paginated list of content policies. These policies match against the subject or body of emails using a pattern. Supports filtering by name or enabled status, and searching across name and pattern fields.\n- `cf email-security domains get <domain-id>` — Retrieves detailed information for a specific protected email domain including its delivery configuration, SPF/DMARC status, and authorization state.\n- `cf email-security domains list` — Returns a paginated list of email domains protected by Email Security. Includes domain configuration, delivery modes, and authorization status. Supports filtering by delivery mode and integration ID.\n- `cf email-security domains verification get <domain-id>` — Returns the DNS TXT record information when the domain ownership isn't verified through Cloudflare zone ownership or CASB integration.\n- `cf email-security impersonation-registry get <impersonation-registry-id>` — Retrieves details for a specific impersonation registry entry including the protected identity, email pattern, and synchronization source if directory-synced.\n- `cf email-security impersonation-registry list` — Returns a paginated list of protected identities in the impersonation registry. These entries define identities and email addresses to protect from impersonation attacks. Can be manually added or automatically synced from directory integrations.\n- `cf email-security investigate action-log get <investigate-id>` — Returns the list of post-delivery actions (moves, quarantine releases, previews, etc.) that have been applied to a specific email message.\n- `cf email-security investigate bulk get <job-id>` — Returns the status and details of a specific bulk action job.\n- `cf email-security investigate bulk list` — Returns a paginated list of bulk action jobs for the account.\n- `cf email-security investigate bulk messages list` — Returns the individual messages associated with a bulk action job, including their processing status.\n- `cf email-security investigate detections get <investigate-id>` — Returns detection details such as threat categories and sender information for non-benign messages.\n- `cf email-security investigate get <investigate-id>` — Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information.\n- `cf email-security investigate list` — Returns information for each email that matches the search parameter(s).\n- `cf email-security investigate preview get <investigate-id>` — Returns a preview of the message body as a base64 encoded PNG image for non-benign messages.\n- `cf email-security investigate raw get <investigate-id>` — Returns the raw eml of any non-benign message.\n- `cf email-security investigate trace get <investigate-id>` — Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues.\n- `cf email-security phishguard reports list` — Retrieves PhishGuard security alert reports for a specified date range. Reports include detected threats, dispositions, and contextual information. Use for security monitoring and threat analysis.\n- `cf email-security sending-domain-restrictions get <sending-domain-restriction-id>` — Retrieves details for a specific sending domain restriction including the domain requiring TLS and any excluded subdomains exempt from the TLS requirement.\n- `cf email-security sending-domain-restrictions list` — Returns a paginated list of sending domain restrictions. These restrictions enforce TLS requirements for emails from specific domains. Mail without TLS from restricted domains will be dropped unless the subdomain is in the exclude list. Supports sorting and searching.\n- `cf email-security submissions list` — Returns information for submissions made to reclassify emails. Shows the status, outcome, and disposition changes for reclassification requests made by users or the security team. Useful for tracking false positive/negative reports.\n- `cf email-security trusted-domains get <trusted-domain-id>` — Retrieves details for a specific trusted domain pattern including its pattern value, whether it uses regex matching, and which detection types it affects.\n- `cf email-security trusted-domains list` — Returns a paginated list of trusted domain patterns. Trusted domains prevent false positives for recently registered domains and lookalike domain detections. Patterns can use regular expressions for flexible matching.\n- `cf email-security url-ignore-patterns get <pattern-id>` — Returns a single URL rewrite ignore pattern by its identifier.\n- `cf email-security url-ignore-patterns list` — Returns a paginated list of URL rewrite ignore patterns for the account. URLs matching these patterns will not be rewritten.\n\n### Create Operations\n\n- `cf email-security allow-policies create` — Creates a new allow policy that exempts matching emails from security detections. Use with caution as this bypasses email security scanning. Policies can match on sender patterns and apply to specific detections or all detections. (supports --dry-run, --body)\n- `cf email-security block-senders create` — Creates a new blocked sender pattern. Emails matching this pattern will be blocked from delivery. Patterns can be email addresses, domains, or IP addresses, and support regular expressions. (supports --dry-run, --body)\n- `cf email-security content-policies create` — Creates a new content policy. Emails whose subject or body matches the pattern will be subject to the configured action. (supports --dry-run, --body)\n- `cf email-security domains create` — Protects a new email domain by adding it to Email Security. Accepts a flat configuration object covering all delivery modes. Returns the newly created domain configuration. (supports --dry-run, --body)\n- `cf email-security impersonation-registry create` — Creates a new entry in the impersonation registry to protect against impersonation. Emails attempting to impersonate this identity will be flagged. Supports regex patterns for flexible email matching. (supports --dry-run, --body)\n- `cf email-security investigate bulk cancel create <job-id>` — Cancels the job, marking it as cancelled and stopping any pending message processing. The job record remains visible in list and detail endpoints. (supports --dry-run)\n- `cf email-security investigate bulk create` — Creates a new bulk action job to move or release messages that match the provided search parameters. (supports --dry-run, --body)\n- `cf email-security investigate move create <investigate-id>` — Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. (supports --dry-run, --body)\n- `cf email-security investigate preview create` — Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body. (supports --dry-run, --body)\n- `cf email-security investigate reclassify create <investigate-id>` — Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously. (supports --dry-run, --body)\n- `cf email-security sending-domain-restrictions create` — Creates a new sending domain restriction to enforce TLS requirements for a domain. Emails without TLS from this domain will be dropped unless the subdomain is in the exclude list. (supports --dry-run, --body)\n- `cf email-security trusted-domains create` — Creates a new trusted domain pattern. Use for partner domains or approved senders that should bypass recent domain registration and similarity checks. Configure whether it prevents recent domain or spoof dispositions. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns create` — Creates a new URL rewrite ignore pattern. URLs matching this pattern will not be rewritten. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-security allow-policies edit <policy-id>` — Updates an existing allow policy. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n- `cf email-security allow-policies update <policy-id>` — Replaces an existing allow policy in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing policies declaratively. (supports --dry-run, --body)\n- `cf email-security block-senders edit <pattern-id>` — Updates an existing blocked sender pattern. Only provided fields will be modified. The pattern will continue blocking emails until deleted. (supports --dry-run, --body)\n- `cf email-security block-senders update <pattern-id>` — Replaces an existing blocked sender pattern in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing blocked senders declaratively. (supports --dry-run, --body)\n- `cf email-security content-policies edit <policy-id>` — Updates an existing content policy. Only provided fields will be modified. (supports --dry-run, --body)\n- `cf email-security domains edit <domain-id>` — Updates configuration for a protected email domain. Only provided fields will be modified. Changes affect delivery mode, security settings, and regional processing. (supports --dry-run, --body)\n- `cf email-security domains update <domain-id>` — Replaces all mutable fields of a protected email domain in a single atomic operation. Unlike PATCH, all non-computed fields are required. (supports --dry-run, --body)\n- `cf email-security impersonation-registry edit <impersonation-registry-id>` — Updates an existing impersonation registry entry. Only provided fields will be modified. Directory-synced entries can't be updated. (supports --dry-run, --body)\n- `cf email-security sending-domain-restrictions edit <sending-domain-restriction-id>` — Updates an existing sending domain restriction. Only provided fields will be modified. Changes affect which domains require TLS and which subdomains are excluded. (supports --dry-run, --body)\n- `cf email-security trusted-domains edit <trusted-domain-id>` — Updates an existing trusted domain pattern. Only provided fields will be modified. Changes take effect for new emails matching the pattern. (supports --dry-run, --body)\n- `cf email-security trusted-domains update <trusted-domain-id>` — Replaces an existing trusted domain in full. Unlike PATCH, every field is taken from the request body, so optional fields that are omitted are reset rather than left untouched. Use this when managing trusted domains declaratively. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns edit <pattern-id>` — Updates an existing URL rewrite ignore pattern. Only provided fields will be modified. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-security allow-policies delete <policy-id>` — Removes an allow policy. After deletion, emails matching this pattern will be subject to normal security scanning and disposition actions. (supports --dry-run)\n- `cf email-security block-senders delete <pattern-id>` — Removes a blocked sender pattern. After deletion, emails from this sender will no longer be automatically blocked based on this rule. (supports --dry-run)\n- `cf email-security content-policies delete <policy-id>` — Removes a content policy. After deletion, emails will no longer be evaluated against this pattern. (supports --dry-run)\n- `cf email-security domains delete <domain-id>` — Removes email security protection from a domain. After deletion, emails for this domain will no longer be processed by Email Security. This action cannot be undone. (supports --dry-run)\n- `cf email-security impersonation-registry delete <impersonation-registry-id>` — Removes an entry from the impersonation registry. After deletion, this identity will no longer be protected from impersonation. (supports --dry-run)\n- `cf email-security investigate bulk delete <job-id>` — Deletes the job, removing it from all list and detail endpoints. Only jobs in a terminal state (`COMPLETED`, `CANCELLED`, `FAILED`, or `SKIPPED`) can be deleted. To stop an in-progress job without removing it, use the cancel endpoint instead. (supports --dry-run)\n- `cf email-security sending-domain-restrictions delete <sending-domain-restriction-id>` — Removes a sending domain restriction. After deletion, TLS will no longer be enforced for emails from this domain. (supports --dry-run)\n- `cf email-security trusted-domains delete <trusted-domain-id>` — Removes a trusted domain pattern. After deletion, emails from this domain will be subject to normal recent domain and similarity checks. (supports --dry-run)\n- `cf email-security url-ignore-patterns delete <pattern-id>` — Removes a URL rewrite ignore pattern. After deletion, URLs matching this pattern will be rewritten again. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-security allow-policies batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security block-senders batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security content-policies batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security domains batch` — Executes multiple domain operations in a single request. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security investigate move bulk` — Moves multiple messages to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration. (supports --dry-run, --body)\n- `cf email-security investigate release bulk` — Delivers one or more quarantined messages to their intended recipients, for cases where a message was incorrectly quarantined. The response includes delivery status for each recipient. (supports --dry-run, --body)\n- `cf email-security trusted-domains batch` — Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations. (supports --dry-run, --body)\n- `cf email-security url-ignore-patterns batch` — Sends a batch of URL ignore patterns API calls to execute together. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"email-sending": "# email-sending — Send emails and manage sending subdomains\n\n## Commands\n\n### Read Operations\n\n- `cf email-sending get <message-id>` — Returns the raw RFC 5322 MIME message for the given account and message id.\n- `cf email-sending limits get` — Returns the current daily sending quota for the account and, when a quota is resolved, the account's current usage against it. Quota is null when not yet available; usage is null when there is no resolved quota or usage is temporarily unavailable.\n- `cf email-sending reputation get` — Returns the authoritative Email Sending reputation state and active evaluation policy. Accounts without an evaluation are Healthy with null evaluation timestamps.\n- `cf email-sending subdomains dns get <subdomain-id>` — Returns the expected DNS records for a sending subdomain.\n- `cf email-sending subdomains get <subdomain-id>` — Gets information for a specific sending subdomain.\n- `cf email-sending subdomains list` — Lists all sending-enabled subdomains for the zone.\n- `cf email-sending suppressions get <suppression-id>` — Gets an Email Sending suppression owned by the account.\n- `cf email-sending suppressions list` — Lists every active Email Sending suppression owned by the account, including legacy rows with internal zone memberships.\n\n### Create Operations\n\n- `cf email-sending subdomains create` — Creates a new sending subdomain or re-enables sending on an existing subdomain that had it disabled. If zone-level Email Sending has not been enabled yet, the zone flag is automatically set when the entitlement is present. A leftmost wildcard such as `*.example.com` is accepted only for accounts with wildcard Email Sending enabled. Wildcard senders share the base domain's DKIM signing identity and `cf-bounce.<base>` return path. (supports --dry-run, --body)\n- `cf email-sending suppressions create` — Creates an account-wide suppression. If a mutable legacy zone-linked row already exists, it is promoted without changing its identifier. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf email-sending subdomains update <subdomain-id>` — Updates the activity-log preview preference for a sending subdomain. (supports --dry-run, --body)\n- `cf email-sending suppressions edit <suppression-id>` — Updates expiry or advisory note fields without changing legacy internal zone memberships. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf email-sending subdomains delete <subdomain-id>` — Disables sending on a subdomain and removes its DNS records. If routing is still active on the subdomain, only sending is disabled. (supports --dry-run)\n- `cf email-sending suppressions delete <suppression-id>` — Deletes the suppression, its note, and every legacy internal zone membership, allowing future delivery attempts to the address. (supports --dry-run)\n\n### Other Operations\n\n- `cf email-sending send` — Send an email for the specified account using the structured builder. Provide the sender, recipients, subject, and at least one of text or html; attachments are optional. (supports --dry-run, --body)\n- `cf email-sending send-raw` — Send a raw RFC 5322 (MIME) email for the specified account. Provide the full MIME message plus the SMTP envelope (from and recipients). (supports --dry-run, --body)\n- `cf email-sending subdomains dns fix <subdomain-id>` — Idempotently re-applies the sending DNS records (creates missing records, re-applies the email_routing lock on records whose lock has been cleared). Refuses with a 409 if foreign MX, multiple SPF, multiple DMARC, or multiple DKIM records exist at the relevant DNS names — those require manual cleanup. (supports --dry-run)\n- `cf email-sending subdomains dns get-status <subdomain-id>` — Returns the desired DNS records for a sending subdomain along with a live diff against actual DNS state. Use this to detect missing, unlocked, foreign, or multi-record conflicts before deciding whether to call the fix endpoint. For wildcard sending rows, each call also rechecks the governing organizational-domain DMARC policy and reports policy drift that DNS Fix cannot repair. (supports --dry-run)\n- `cf email-sending subdomains preview` — Returns the DNS records that would be created for a sending subdomain, flags which records are missing, and reports any conflicts with existing DNS records. This is a read-only dry-run — no records are created or modified. Use before or after creating a subdomain to check DNS status. A leftmost wildcard requires wildcard Email Sending to be enabled for the account and previews base-scoped DKIM and return-path records. (supports --dry-run, --body)\n- `cf email-sending subdomains reputation get-complaints <subdomain-id>` — Returns the matched complaint count for a sending subdomain in a half-open time window of up to seven days. (supports --dry-run)\n- `cf email-sending suppressions import` — Imports up to 1,000 account-level Email Sending suppressions in one request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"fieldExtractors": "# fieldExtractors — fieldExtractors\n\n## Commands\n\n### Read Operations\n\n- `cf fieldExtractors get <extractor>` — Retrieves the custom extraction rules configured for a given extractor type.\n\n### Update Operations\n\n- `cf fieldExtractors update <extractor>` — Replaces all custom extraction rules for an extractor type. Omitted rules are deleted. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf fieldExtractors delete <extractor>` — Deletes all custom extraction rules for an extractor type. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"firewall": "# firewall — Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages\n\n## Commands\n\n### Read Operations\n\n- `cf firewall access-rules get <rule-id>` — Fetches the details of an IP Access rule defined.\n- `cf firewall access-rules list` — Fetches IP Access rules of an account or zone. These rules apply to all the zones in the account or zone. You can filter the results using several optional parameters.\n- `cf firewall filters get <filter-id>` — Fetches the details of a filter.\n- `cf firewall filters list` — Fetches filters in a zone. You can filter the results using several optional parameters.\n- `cf firewall lockdowns get <lock-downs-id>` — Fetches the details of a Zone Lockdown rule.\n- `cf firewall lockdowns list` — Fetches Zone Lockdown rules. You can filter the results using several optional parameters.\n- `cf firewall rules get <rule-id>` — Fetches the details of a firewall rule.\n- `cf firewall rules list` — Fetches firewall rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall ua-rules get <ua-rule-id>` — Fetches the details of a User Agent Blocking rule.\n- `cf firewall ua-rules list` — Fetches User Agent Blocking rules in a zone. You can filter the results using several optional parameters.\n- `cf firewall waf overrides get <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the details of a URI-based WAF override.\n- `cf firewall waf overrides list` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the URI-based WAF overrides in a zone.\n- `cf firewall waf packages get <package-id>` — Fetches the details of a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n- `cf firewall waf packages list` — Fetches WAF packages for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).\n\n### Create Operations\n\n- `cf firewall access-rules create` — Creates a new IP Access rule for an account or zone. The rule will apply to all zones in the account or zone. Note: To create an IP Access rule that applies to a single zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints. (supports --dry-run, --body)\n- `cf firewall filters create` — Creates one or more filters. (supports --dry-run, --body)\n- `cf firewall lockdowns create` — Creates a new Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules create` — Create one or more firewall rules. (supports --dry-run, --body)\n- `cf firewall ua-rules create` — Creates a new User Agent Blocking rule in a zone. (supports --dry-run, --body)\n- `cf firewall waf overrides create` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously created a URI-based WAF override for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf firewall access-rules edit <rule-id>` — Updates an IP Access rule defined. Note: This operation will affect all zones in the account or zone. (supports --dry-run, --body)\n- `cf firewall filters update <filter-id>` — Updates an existing filter. (supports --dry-run, --body)\n- `cf firewall lockdowns update <lock-downs-id>` — Updates an existing Zone Lockdown rule. (supports --dry-run, --body)\n- `cf firewall rules edit <rule-id>` — Updates the priority of an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall rules update <rule-id>` — Updates an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules update <ua-rule-id>` — Updates an existing User Agent Blocking rule. (supports --dry-run, --body)\n- `cf firewall waf overrides update <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously updated an existing URI-based WAF override. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf firewall access-rules delete <rule-id>` — Deletes an existing IP Access rule defined. Note: This operation will affect all zones in the account or zone. (supports --dry-run)\n- `cf firewall filters delete <filter-id>` — Deletes an existing filter. (supports --dry-run)\n- `cf firewall lockdowns delete <lock-downs-id>` — Deletes an existing Zone Lockdown rule. (supports --dry-run)\n- `cf firewall rules delete <rule-id>` — Deletes an existing firewall rule. (supports --dry-run, --body)\n- `cf firewall ua-rules delete <ua-rule-id>` — Deletes an existing User Agent Blocking rule. (supports --dry-run)\n- `cf firewall waf overrides delete <overrides-id>` — **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously deleted an existing URI-based WAF override. (supports --dry-run)\n\n### Other Operations\n\n- `cf firewall filters bulk-delete` — Deletes one or more existing filters. (supports --dry-run)\n- `cf firewall filters bulk-update` — Updates one or more existing filters. (supports --dry-run, --body)\n- `cf firewall rules bulk-delete` — Deletes existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-edit` — Updates the priority of existing firewall rules. (supports --dry-run, --body)\n- `cf firewall rules bulk-update` — Updates one or more existing firewall rules. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"flagship": "# flagship — flagship\n\n## Commands\n\n### Read Operations\n\n- `cf flagship apps definitions get <app-id>` — Returns an app's evaluation-only flag definitions for SDKs that evaluate locally. Send the returned `ETag` in `If-None-Match` to avoid downloading unchanged definitions.\n- `cf flagship apps evaluate get <app-id>` — Evaluates a flag against the provided context. Pass context attributes as query parameters; values are forwarded as strings. For low-latency in-Worker evaluation, prefer the Flagship binding over this endpoint.\n- `cf flagship apps flags changelog list` — Returns the audit history for a flag, newest first. Each entry includes the event type and full flag state after the change; `update` entries include a field-level diff. Capped at 200 entries per flag.\n- `cf flagship apps flags get <flag-key>` — Returns the full flag definition including rules, variations, and audit fields.\n- `cf flagship apps flags list` — Lists an app's flags ordered by key. Pass `cursor` from `result_info` to page forward; a null cursor indicates the last page.\n- `cf flagship apps get <app-id>` — Returns an app's name and audit fields. Flag definitions are not included.\n- `cf flagship apps list` — Lists all apps in the account. Returns identity and audit fields only — flag definitions are not included.\n\n### Create Operations\n\n- `cf flagship apps create` — Creates an app. The returned `id` is used in all subsequent flag, changelog, and evaluation requests. (supports --dry-run, --body)\n- `cf flagship apps evaluate create <app-id>` — Evaluates a flag against the provided context, passed as a JSON request body (OFREP-shaped) rather than query parameters. Returns the same response shape as the GET variant. (supports --dry-run, --body)\n- `cf flagship apps flags create <app-id>` — Creates a flag. Returns 409 if the key already exists. `type` is always inferred from variation values; legacy request-side values are ignored. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf flagship apps flags update <flag-key>` — Replaces the entire flag definition. Omitted fields are dropped, not preserved — read before writing. Each update appends a changelog entry. (supports --dry-run, --body)\n- `cf flagship apps update <app-id>` — Updates an app. Only `name` is mutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf flagship apps delete <app-id>` — Deletes an app and all its flags and changelog history. Returns 409 if any Worker still references this app via a Flagship binding. (supports --dry-run)\n- `cf flagship apps flags delete <flag-key>` — Deletes a flag permanently. Subsequent evaluations fall back to the caller-supplied default. Cannot be undone. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"fraud": "# fraud — fraud\n\n## Commands\n\n### Read Operations\n\n- `cf fraud get` — Retrieve Fraud Detection settings for a zone.\n\n### Update Operations\n\n- `cf fraud update` — Update Fraud Detection settings for a zone. Notes on `username_expressions` behavior: - If omitted or set to null, expressions are not modified. - If provided as an empty array `[]`, all expressions will be cleared. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"google-tag-gateway": "# google-tag-gateway — Google Tag Gateway operations\n\n## Commands\n\n### Read Operations\n\n- `cf google-tag-gateway config get` — Gets the Google Tag Gateway configuration for a zone.\n\n### Update Operations\n\n- `cf google-tag-gateway config update` — Updates the Google Tag Gateway configuration for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"health": "# health — health\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -87,19 +88,18 @@
 		"kv": "# kv — kv\n\n## Commands\n\n### Read Operations\n\n- `cf kv bulk get <namespace-id>` — Retrieve up to 100 KV pairs from the namespace. Keys must contain text-based values. JSON values can optionally be parsed instead of being returned as a string value. Metadata can be included if `withMetadata` is true. (supports --body)\n- `cf kv keys get <key-name>` — Returns the value associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. If the KV-pair is set to expire at some point, the expiration time as measured in seconds since the UNIX epoch will be returned in the `expiration` response header.\n- `cf kv keys list` — Lists a namespace's keys.\n- `cf kv metadata get <key-name>` — Returns the metadata associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.\n- `cf kv namespaces get <namespace-id>` — Get the namespace corresponding to the given ID.\n- `cf kv namespaces list` — Returns the namespaces owned by an account.\n\n### Create Operations\n\n- `cf kv namespaces create` — Creates a namespace under the given title. A `400` is returned if the account already owns a namespace with this title. A namespace must be explicitly deleted to be replaced. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf kv bulk update <namespace-id>` — Write multiple keys and values at once. Body should be an array of up to 10,000 key-value pairs to be stored, along with optional expiration information. Existing values and expirations will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. The entire request size must be 100 megabytes or less. (supports --dry-run, --body)\n- `cf kv keys update <key-name>` — Write a value identified by a key. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. Body should be the value to be stored. If JSON metadata to be associated with the key/value pair is needed, use `multipart/form-data` content type for your PUT request (see dropdown below in `REQUEST BODY SCHEMA`). Existing values, expirations, and metadata will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. (supports --dry-run, --body)\n- `cf kv namespaces update <namespace-id>` — Modifies a namespace's title. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf kv bulk delete <namespace-id>` — Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed. (supports --dry-run, --body)\n- `cf kv keys delete <key-name>` — Remove a KV pair from the namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. (supports --dry-run)\n- `cf kv namespaces delete <namespace-id>` — Deletes the namespace corresponding to the given ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"leaked-credential-checks": "# leaked-credential-checks — Detect compromised credentials in login requests by checking against known breach databases\n\n## Commands\n\n### Read Operations\n\n- `cf leaked-credential-checks detections get <detection-id>` — Get the username and password expressions of a single user-defined detection location, identified by its detection ID.\n- `cf leaked-credential-checks detections list` — List the user-defined detection locations configured for Leaked Credential Checks, each with its own identifier. A custom detection location tells the WAF where to find the username and password in requests to your application.\n- `cf leaked-credential-checks get` — Get the current Leaked Credential Checks status for the zone. While enabled, Cloudflare scans incoming requests for usernames and passwords that were exposed in known data breaches.\n\n### Create Operations\n\n- `cf leaked-credential-checks detections create` — Create a detection location for credentials that the default scan locations do not cover, using Rules language expressions such as `lookup_json_string(http.request.body.raw, \"user\")`. Only the username expression is required, and Leaked Credential Checks must be enabled on the zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf leaked-credential-checks detections update <detection-id>` — Update the username and password expressions of an existing detection location, identified by its detection ID. Both expressions are overwritten, so omitting the password expression clears it. (supports --dry-run, --body)\n- `cf leaked-credential-checks update` — Update the Leaked Credential Checks status for the zone, enabling or disabling the detection. While enabled, the detection populates the `cf.waf.credential_check.*` fields, which you can reference in custom rules and rate limiting rules to challenge or block requests carrying compromised credentials. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf leaked-credential-checks detections delete <detection-id>` — Delete a user-defined detection location, identified by its detection ID. Incoming requests are then scanned using only the default scan locations and the detection locations that remain. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"live": "# live — live\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"load-balancers": "# load-balancers — Distribute traffic across origin pools with health monitoring, geo-steering, and failover\n\n## Commands\n\n### Read Operations\n\n- `cf load-balancers account get <load-balancer-id>` — Fetch a single configured account-scoped load balancer.\n- `cf load-balancers account list` — List configured account-scoped load balancers.\n- `cf load-balancers account usage list` — Get current load balancer resource usage counts for an account.\n- `cf load-balancers get <load-balancer-id>` — Fetch a single configured load balancer.\n- `cf load-balancers list` — List configured load balancers.\n- `cf load-balancers monitor-groups get <monitor-group-id>` — Fetch a single configured monitor group.\n- `cf load-balancers monitor-groups list` — List configured monitor groups.\n- `cf load-balancers monitor-groups references list` — Get the list of resources that reference the provided monitor group.\n- `cf load-balancers monitors get <monitor-id>` — List a single configured monitor for an account.\n- `cf load-balancers monitors list` — List configured monitors for an account.\n- `cf load-balancers monitors references get <monitor-id>` — Get the list of resources that reference the provided monitor.\n- `cf load-balancers pools get <pool-id>` — Fetch a single configured pool.\n- `cf load-balancers pools health get <pool-id>` — Fetch the latest pool health status for a single pool.\n- `cf load-balancers pools list` — List configured pools.\n- `cf load-balancers pools references get <pool-id>` — Get the list of resources that reference the provided pool.\n- `cf load-balancers previews get <preview-id>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf load-balancers regions get <region-id>` — Get a single region mapping.\n- `cf load-balancers regions list` — List all region mappings.\n- `cf load-balancers searches list` — Search for Load Balancing resources.\n\n### Create Operations\n\n- `cf load-balancers account create` — Create a new account-scoped load balancer. (supports --dry-run, --body)\n- `cf load-balancers create` — Create a new load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups create` — Create a new monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers monitors previews create <monitor-id>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf load-balancers pools health create <pool-id>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf load-balancers account edit <load-balancer-id>` — Apply changes to an existing account-scoped load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers account update <load-balancer-id>` — Update a configured account-scoped load balancer. (supports --dry-run, --body)\n- `cf load-balancers edit <load-balancer-id>` — Apply changes to an existing load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups edit <monitor-group-id>` — Apply changes to an existing monitor group, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups update <monitor-group-id>` — Modify a configured monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors edit <monitor-id>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitors update <monitor-id>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools edit <pool-id>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers pools update <pool-id>` — Modify a configured pool. (supports --dry-run, --body)\n- `cf load-balancers update <load-balancer-id>` — Update a configured load balancer. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf load-balancers account delete <load-balancer-id>` — Delete a configured account-scoped load balancer. (supports --dry-run)\n- `cf load-balancers delete <load-balancer-id>` — Delete a configured load balancer. (supports --dry-run)\n- `cf load-balancers monitor-groups delete <monitor-group-id>` — Delete a configured monitor group. (supports --dry-run)\n- `cf load-balancers monitors delete <monitor-id>` — Delete a configured monitor. (supports --dry-run)\n- `cf load-balancers pools delete <pool-id>` — Delete a configured pool. (supports --dry-run)\n\n### Other Operations\n\n- `cf load-balancers pools bulk-edit` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"logexplorer": "# logexplorer — logexplorer\n\n## Commands\n\n### Read Operations\n\n- `cf logexplorer account datasets get <dataset-id>` — Retrieve a single Log Explorer dataset by ID for the account.\n- `cf logexplorer account datasets list` — Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n- `cf logexplorer zone datasets get <dataset-id>` — Retrieve a single Log Explorer dataset by ID for the zone.\n- `cf logexplorer zone datasets list` — Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n\n### Create Operations\n\n- `cf logexplorer account datasets create` — Create a new Log Explorer dataset for the account. List available account datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n- `cf logexplorer zone datasets create` — Create a new Log Explorer dataset for the zone. List available zone datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logexplorer account datasets update <dataset-id>` — Updates the enabled state and/or field configuration of an account dataset. (supports --dry-run, --body)\n- `cf logexplorer zone datasets update <dataset-id>` — Updates the enabled state and/or field configuration of a zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logexplorer account datasets delete <dataset-id>` — Deletes a Log Explorer dataset for the account. Dataset deletion must not be protected. (supports --dry-run)\n- `cf logexplorer zone datasets delete <dataset-id>` — Deletes a Log Explorer dataset for the zone. Dataset deletion must not be protected. (supports --dry-run)\n\n### Other Operations\n\n- `cf logexplorer account datasets available` — Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error. (supports --dry-run)\n- `cf logexplorer account query` — Run a SQL query against account-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured account datasets to see enabled account-level datasets. Zone-level datasets will not appear here. List available account datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n- `cf logexplorer zone datasets available` — Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error. (supports --dry-run)\n- `cf logexplorer zone query` — Run a SQL query against zone-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured zone datasets to see enabled zone-level datasets. List available zone datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"load-balancers": "# load-balancers — Distribute traffic across origin pools with health monitoring, geo-steering, and failover\n\n## Commands\n\n### Read Operations\n\n- `cf load-balancers account get <load-balancer-id>` — Fetch a single configured account or zone-scoped load balancer.\n- `cf load-balancers account list` — List configured account or zone-scoped load balancers.\n- `cf load-balancers account usage list` — Get current load balancer resource usage counts for an account.\n- `cf load-balancers monitor-groups get <monitor-group-id>` — Fetch a single configured monitor group.\n- `cf load-balancers monitor-groups list` — List configured monitor groups.\n- `cf load-balancers monitor-groups references list` — Get the list of resources that reference the provided monitor group.\n- `cf load-balancers monitors get <monitor-id>` — List a single configured monitor for an account.\n- `cf load-balancers monitors list` — List configured monitors for an account.\n- `cf load-balancers monitors references get <monitor-id>` — Get the list of resources that reference the provided monitor.\n- `cf load-balancers pools get <pool-id>` — Fetch a single configured pool.\n- `cf load-balancers pools health get <pool-id>` — Fetch the latest pool health status for a single pool.\n- `cf load-balancers pools list` — List configured pools.\n- `cf load-balancers pools references get <pool-id>` — Get the list of resources that reference the provided pool.\n- `cf load-balancers previews get <preview-id>` — Get the result of a previous preview operation using the provided preview_id.\n- `cf load-balancers regions get <region-id>` — Get a single region mapping.\n- `cf load-balancers regions list` — List all region mappings.\n- `cf load-balancers searches list` — Search for Load Balancing resources.\n\n### Create Operations\n\n- `cf load-balancers account create` — Create a new account or zone-scoped load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups create` — Create a new monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors create` — Create a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers monitors previews create <monitor-id>` — Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n- `cf load-balancers pools create` — Create a new pool. (supports --dry-run, --body)\n- `cf load-balancers pools health create <pool-id>` — Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf load-balancers account edit <load-balancer-id>` — Apply changes to an existing account or zone-scoped load balancer, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers account update <load-balancer-id>` — Update a configured account or zone-scoped load balancer. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups edit <monitor-group-id>` — Apply changes to an existing monitor group, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitor-groups update <monitor-group-id>` — Modify a configured monitor group. (supports --dry-run, --body)\n- `cf load-balancers monitors edit <monitor-id>` — Apply changes to an existing monitor, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers monitors update <monitor-id>` — Modify a configured monitor. (supports --dry-run, --body)\n- `cf load-balancers pools edit <pool-id>` — Apply changes to an existing pool, overwriting the supplied properties. (supports --dry-run, --body)\n- `cf load-balancers pools update <pool-id>` — Modify a configured pool. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf load-balancers account delete <load-balancer-id>` — Delete a configured account or zone-scoped load balancer. (supports --dry-run)\n- `cf load-balancers monitor-groups delete <monitor-group-id>` — Delete a configured monitor group. (supports --dry-run)\n- `cf load-balancers monitors delete <monitor-id>` — Delete a configured monitor. (supports --dry-run)\n- `cf load-balancers pools delete <pool-id>` — Delete a configured pool. (supports --dry-run)\n\n### Other Operations\n\n- `cf load-balancers pools bulk-edit` — Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"logexplorer": "# logexplorer — logexplorer\n\n## Commands\n\n### Read Operations\n\n- `cf logexplorer account datasets get <dataset-id>` — Retrieve a single Log Explorer dataset by ID for the account or zone.\n- `cf logexplorer account datasets list` — Returns all Log Explorer datasets configured for the account or zone. Pass `include_zones=true` to also include zone-level datasets that belong to this account or zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.\n\n### Create Operations\n\n- `cf logexplorer account datasets create` — Create a new Log Explorer dataset for the account or zone. List available account or zone datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logexplorer account datasets update <dataset-id>` — Updates the enabled state and/or field configuration of an account or zone dataset. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logexplorer account datasets delete <dataset-id>` — Deletes a Log Explorer dataset for the account or zone. Dataset deletion must not be protected. (supports --dry-run)\n\n### Other Operations\n\n- `cf logexplorer account datasets available` — Returns all dataset types that this account or zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account or zone. When creating or updating a dataset, only fields available to your account or zone can be enabled. If you request a field that is not available, you will receive an error. (supports --dry-run)\n- `cf logexplorer account query` — Run a SQL query against account or zone-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured account or zone datasets to see enabled account or zone-level datasets. Zone-level datasets will not appear here. List available account or zone datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/ (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"logo-matches": "# logo-matches — logo-matches\n\n## Commands\n\n### Read Operations\n\n- `cf logo-matches download get` — Return matches as CSV for logo queries based on ID\n- `cf logo-matches get` — Return matches for logo queries based on ID\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"logos": "# logos — logos\n\n## Commands\n\n### Create Operations\n\n- `cf logos create` — Return new saved logo queries created from image files (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logos delete <logo-id>` — Return a success message after deleting saved logo queries by ID (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"logpush": "# logpush — logpush\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <dataset-id>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <dataset-id>` — Lists Logpush jobs for an account for a dataset.\n- `cf logpush account-jobs get <job-id>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account.\n- `cf logpush datasets fields get <dataset-id>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush datasets jobs get <dataset-id>` — Lists Logpush jobs for a zone for a dataset.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush jobs get <job-id>` — Gets the details of a Logpush job.\n- `cf logpush jobs list` — Lists Logpush jobs for a zone.\n- `cf logpush transformers content get <transformer-id>` — Returns the SQL query content for a transformer. Without query params, returns the latest version. With `version_id`, returns the specified version.\n- `cf logpush transformers get <transformer-id>` — Gets a single custom log transformer by ID.\n- `cf logpush transformers list` — Lists all custom log transformers for an account.\n- `cf logpush transformers versions list` — Returns version metadata for a transformer, newest first. Each version corresponds to a SQL query update.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush jobs create` — Creates a new Logpush job for a zone. (supports --dry-run, --body)\n- `cf logpush ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush transformers create` — Creates a new custom log transformer for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <job-id>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush jobs update <job-id>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush transformers update <transformer-id>` — Updates an existing custom log transformer. When `code` is provided, the SQL query is validated and a new version is created. When `code` is omitted, only the name and description are updated. Omitting `description` clears the existing description. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <job-id>` — Deletes a Logpush job. (supports --dry-run)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush jobs delete <job-id>` — Deletes a Logpush job. (supports --dry-run)\n- `cf logpush transformers delete <transformer-id>` — Deletes a custom log transformer. Returns 409 Conflict if any active logpush jobs reference the transformer. (supports --dry-run)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush ownership validate` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush transformers preview` — Executes a SQL transformer against a single input record and returns the transformed output. This is a stateless endpoint — nothing is persisted. (supports --dry-run, --body)\n- `cf logpush validate destination` — Validates destination. (supports --dry-run, --body)\n- `cf logpush validate destination-exists` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush validate origin` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"logpush": "# logpush — logpush\n\n## Commands\n\n### Read Operations\n\n- `cf logpush account-datasets fields get <dataset-id>` — Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logpush account-datasets jobs get <dataset-id>` — Lists Logpush jobs for an account or zone for a dataset.\n- `cf logpush account-jobs get <job-id>` — Gets the details of a Logpush job.\n- `cf logpush account-jobs list` — Lists Logpush jobs for an account or zone.\n- `cf logpush edge get` — Lists Instant Logs jobs for a zone.\n- `cf logpush transformers content get <transformer-id>` — Returns the SQL query content for a transformer. Without query params, returns the latest version. With `version_id`, returns the specified version.\n- `cf logpush transformers get <transformer-id>` — Gets a single custom log transformer by ID.\n- `cf logpush transformers list` — Lists all custom log transformers for an account.\n- `cf logpush transformers versions list` — Returns version metadata for a transformer, newest first. Each version corresponds to a SQL query update.\n\n### Create Operations\n\n- `cf logpush account-jobs create` — Creates a new Logpush job for an account or zone. (supports --dry-run, --body)\n- `cf logpush account-ownership create` — Gets a new ownership challenge sent to your destination. (supports --dry-run, --body)\n- `cf logpush account-ownership validate create` — Validates ownership challenge of the destination. (supports --dry-run, --body)\n- `cf logpush account-validate origin create` — Validates logpull origin with logpull_options. (supports --dry-run, --body)\n- `cf logpush edge create` — Creates a new Instant Logs job for a zone. (supports --dry-run, --body)\n- `cf logpush transformers create` — Creates a new custom log transformer for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf logpush account-jobs update <job-id>` — Updates a Logpush job. (supports --dry-run, --body)\n- `cf logpush transformers update <transformer-id>` — Updates an existing custom log transformer. When `code` is provided, the SQL query is validated and a new version is created. When `code` is omitted, only the name and description are updated. Omitting `description` clears the existing description. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logpush account-jobs delete <job-id>` — Deletes a Logpush job. (supports --dry-run)\n- `cf logpush account-validate destination delete` — Validates destination. (supports --dry-run, --body)\n- `cf logpush transformers delete <transformer-id>` — Deletes a custom log transformer. Returns 409 Conflict if any active logpush jobs reference the transformer. (supports --dry-run)\n\n### Other Operations\n\n- `cf logpush account-validate destination-exists-delete` — Checks if there is an existing job with a destination. (supports --dry-run, --body)\n- `cf logpush transformers preview` — Executes a SQL transformer against a single input record and returns the transformed output. This is a stateless endpoint — nothing is persisted. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"logs": "# logs — Log control, retention, and raw log access — CMB config, ray ID lookups, and received fields\n\n## Commands\n\n### Read Operations\n\n- `cf logs control cmb config get` — Gets CMB config.\n- `cf logs control retention get` — Gets log retention flag for Logpull API.\n- `cf logs list get` — Lists R2 objects containing logs matching the provided query parameters.\n- `cf logs rayid get <ray-id>` — The `/rayids` api route allows lookups by specific rayid. The rayids route will return zero, one, or more records (ray ids are not unique).\n- `cf logs received fields get` — Lists all fields available. The response is json object with key-value pairs, where keys are field names, and values are descriptions.\n- `cf logs received get` — The `/received` api route allows customers to retrieve their edge HTTP logs. The basic access pattern is \"give me all the logs for zone Z for minute M\", where the minute M refers to the time records were received at Cloudflare's central data center. `start` is inclusive, and `end` is exclusive. Because of that, to get all data, at minutely cadence, starting at 10AM, the proper values are: `start=2018-05-20T10:00:00Z&end=2018-05-20T10:01:00Z`, then `start=2018-05-20T10:01:00Z&end=2018-05-20T10:02:00Z` and so on; the overlap will be handled properly.\n- `cf logs retrieve get` — Returns logs stored in R2 that match the provided query parameters.\n\n### Create Operations\n\n- `cf logs control cmb config create` — Updates CMB config. (supports --dry-run, --body)\n- `cf logs control retention create` — Updates log retention flag for Logpull API. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf logs control cmb config delete` — Deletes CMB config. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"magic-cloud-networking": "# magic-cloud-networking — magic-cloud-networking\n\n## Commands\n\n### Read Operations\n\n- `cf magic-cloud-networking catalog-syncs get <sync-id>` — Read a Catalog Sync (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs list` — List Catalog Syncs (Closed Beta).\n- `cf magic-cloud-networking catalog-syncs prebuilt-policies list` — List prebuilt catalog sync policies (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations get <provider-id>` — Read a Cloud Integration (Closed Beta).\n- `cf magic-cloud-networking cloud-integrations list` — List Cloud Integrations (Closed Beta).\n- `cf magic-cloud-networking on-ramps address-spaces list` — Read the Magic WAN Address Space (Closed Beta).\n- `cf magic-cloud-networking on-ramps export <onramp-id>` — Export an On-ramp to terraform ready file(s) (Closed Beta).\n- `cf magic-cloud-networking on-ramps get <onramp-id>` — Read an On-ramp (Closed Beta).\n- `cf magic-cloud-networking on-ramps list` — List On-ramps (Closed Beta).\n- `cf magic-cloud-networking resources export` — Export resources in the Resource Catalog as a JSON file (Closed Beta).\n- `cf magic-cloud-networking resources get <resource-id>` — Read an resource from the Resource Catalog (Closed Beta).\n- `cf magic-cloud-networking resources list` — List resources in the Resource Catalog (Closed Beta).\n\n### Create Operations\n\n- `cf magic-cloud-networking catalog-syncs create` — Create a new Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations create` — Create a new Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps create` — Create a new On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-cloud-networking catalog-syncs edit <sync-id>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking catalog-syncs update <sync-id>` — Update a Catalog Sync (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations edit <provider-id>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking cloud-integrations update <provider-id>` — Update a Cloud Integration (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces edit` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps address-spaces update` — Update the Magic WAN Address Space (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps edit <onramp-id>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n- `cf magic-cloud-networking on-ramps update <onramp-id>` — Update an On-ramp (Closed Beta). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-cloud-networking catalog-syncs delete <sync-id>` — Delete a Catalog Sync (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations delete <provider-id>` — Delete a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps delete <onramp-id>` — Delete an On-ramp (Closed Beta). (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-cloud-networking catalog-syncs refresh <sync-id>` — Refresh a Catalog Sync's destination by running the sync policy against latest resource catalog (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover <provider-id>` — Run discovery for a Cloud Integration (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations discover-all` — Run discovery for all Cloud Integrations in an account (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking cloud-integrations initial-setup <provider-id>` — Get initial configuration to complete Cloud Integration setup (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps apply <onramp-id>` — Apply an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking on-ramps plan <onramp-id>` — Plan an On-ramp (Closed Beta). (supports --dry-run)\n- `cf magic-cloud-networking resources policy-preview` — Preview Rego query result against the latest resource catalog (Closed Beta). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"magic-network-monitoring": "# magic-network-monitoring — Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion\n\n## Commands\n\n### Read Operations\n\n- `cf magic-network-monitoring configs full get` — Lists default sampling, router IPs, warp devices, and rules for account.\n- `cf magic-network-monitoring configs get` — Lists default sampling, router IPs and warp devices for account.\n- `cf magic-network-monitoring rules get <rule-id>` — List a single network monitoring rule for account.\n- `cf magic-network-monitoring rules list` — Lists network monitoring rules for account.\n\n### Create Operations\n\n- `cf magic-network-monitoring configs create` — Create a new network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules create` — Create network monitoring rules for account. Currently only supports creating a single rule per API request. (supports --dry-run, --body)\n- `cf magic-network-monitoring vpc-flows tokens create` — Generate authentication token for VPC flow logs export. (supports --dry-run)\n\n### Update Operations\n\n- `cf magic-network-monitoring configs edit` — Update fields in an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring configs update` — Update an existing network monitoring configuration, requires the entire configuration to be updated at once. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules advertisements edit <rule-id>` — Update advertisement for rule. (supports --dry-run)\n- `cf magic-network-monitoring rules update` — Update network monitoring rules for account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-network-monitoring configs delete` — Delete an existing network monitoring configuration. (supports --dry-run)\n- `cf magic-network-monitoring rules delete <rule-id>` — Delete a network monitoring rule for account. (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-network-monitoring rules magicNetworkMonitoringRulesUpdateRule <rule-id>` — Update a network monitoring rule for account. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules magicNetworkMonitoringRulesUpdateRulesBulk` — Update multiple network monitoring rules for account in a single request. Supports up to 100 rules per request. All rules in a single request must be of the same type. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"magic-network-monitoring": "# magic-network-monitoring — Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion\n\n## Commands\n\n### Read Operations\n\n- `cf magic-network-monitoring configs full get` — Lists default sampling, router IPs, warp devices, and rules for account.\n- `cf magic-network-monitoring configs get` — Lists default sampling, router IPs and warp devices for account.\n- `cf magic-network-monitoring rules get <rule-id>` — List a single network monitoring rule for account.\n- `cf magic-network-monitoring rules list` — Lists network monitoring rules for account.\n\n### Create Operations\n\n- `cf magic-network-monitoring configs create` — Create a new network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules bulk create` — Create multiple network monitoring rules for account in a single request. Supports up to 100 rules per request. All rules in a single request must be of the same type. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules create` — Create network monitoring rules for account. Currently only supports creating a single rule per API request. (supports --dry-run, --body)\n- `cf magic-network-monitoring vpc-flows tokens create` — Generate authentication token for VPC flow logs export. (supports --dry-run)\n\n### Update Operations\n\n- `cf magic-network-monitoring configs edit` — Update fields in an existing network monitoring configuration. (supports --dry-run, --body)\n- `cf magic-network-monitoring configs update` — Update an existing network monitoring configuration, requires the entire configuration to be updated at once. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules advertisements edit <rule-id>` — Update advertisement for rule. (supports --dry-run)\n- `cf magic-network-monitoring rules bulk update` — Update multiple network monitoring rules for account in a single request. Supports up to 100 rules per request. All rules in a single request must be of the same type. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules edit <rule-id>` — Update a network monitoring rule for account. (supports --dry-run, --body)\n- `cf magic-network-monitoring rules update` — Update network monitoring rules for account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-network-monitoring configs delete` — Delete an existing network monitoring configuration. (supports --dry-run)\n- `cf magic-network-monitoring rules delete <rule-id>` — Delete a network monitoring rule for account. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"magic-transit": "# magic-transit — DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures\n\n## Commands\n\n### Read Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules get <rule-id>` — Get a DNS Protection rule specified by the given UUID.\n- `cf magic-transit advanced-dns-protection configs dns protection rules list` — List all DNS Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs allowlist get <prefix-id>` — Get an allowlist prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs allowlist list` — List all allowlist prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs prefixes get <prefix-id>` — Get a prefix specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs prefixes list` — List all prefixes for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters get <filter-id>` — Get a SYN Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection filters list` — List all SYN Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules get <rule-id>` — Get a SYN Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs syn protection rules list` — List all SYN Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters get <filter-id>` — Get a TCP Flow Protection filter specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters list` — List all TCP Flow Protection filters for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules get <rule-id>` — Get a TCP Flow Protection rule specified by the given UUID.\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules list` — List all TCP Flow Protection rules for an account.\n- `cf magic-transit advanced-tcp-protection configs tcp protection status get` — Get the protection status of the account.\n- `cf magic-transit apps list` — Lists Apps associated with an account.\n- `cf magic-transit bgp-filter-profiles get <profile-id>` — Gets a specific BGP filter profile for an account.\n- `cf magic-transit bgp-filter-profiles list` — Lists all BGP filter profiles for an account.\n- `cf magic-transit bgp-settings get` — Gets the BGP settings for an account, including the default ASN and redistribution configuration.\n- `cf magic-transit cf-interconnects get <cf-interconnect-id>` — Lists details for a specific interconnect.\n- `cf magic-transit cf-interconnects list` — Lists interconnects associated with an account.\n- `cf magic-transit cf1-sites get <cf1-site-id>` — Gets a specific CF1 Site for an account.\n- `cf magic-transit cf1-sites list` — Lists CF1 Sites associated with an account. A CF1 Site represents a physical customer network location with optional geographic coordinates.\n- `cf magic-transit cf1-sites ramps get <ramp-id>` — Gets a specific ramp for a CF1 Site.\n- `cf magic-transit cf1-sites ramps list` — Lists ramps (network connections) associated with a CF1 Site. Ramps represent GRE tunnels, IPsec tunnels, interconnects, or MCONN links.\n- `cf magic-transit gre-tunnels get <gre-tunnel-id>` — Lists informtion for a specific GRE tunnel.\n- `cf magic-transit gre-tunnels list` — Lists GRE tunnels associated with an account.\n- `cf magic-transit ipsec-tunnels get <ipsec-tunnel-id>` — Lists details for a specific IPsec tunnel.\n- `cf magic-transit ipsec-tunnels list` — Lists IPsec tunnels associated with an account.\n- `cf magic-transit pcaps download get <pcap-id>` — Download PCAP information into a file. Response is a binary PCAP file.\n- `cf magic-transit pcaps get <pcap-id>` — Get information for a PCAP request by id.\n- `cf magic-transit pcaps list` — Lists all packet capture requests for an account.\n- `cf magic-transit pcaps ownership get` — List all buckets configured for use with PCAPs API.\n- `cf magic-transit redundancy-groups get <redundancy-group-id>` — Gets details for a specific redundancy group, including full member tunnel data.\n- `cf magic-transit redundancy-groups list` — Lists redundancy groups associated with an account, including full member tunnel data.\n- `cf magic-transit routes get <route-id>` — Get a specific Magic static route.\n- `cf magic-transit routes list` — List all Magic static routes.\n- `cf magic-transit sites acls get <acl-id>` — Get a specific Site ACL.\n- `cf magic-transit sites acls list` — Lists Site ACLs associated with an account.\n- `cf magic-transit sites app-configuration list` — Lists App Configs associated with a site.\n- `cf magic-transit sites get <site-id>` — Get a specific Site.\n- `cf magic-transit sites lans get <lan-id>` — Get a specific Site LAN.\n- `cf magic-transit sites lans list` — Lists Site LANs associated with an account.\n- `cf magic-transit sites list` — Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.\n- `cf magic-transit sites netflow-config get <site-id>` — Get NetFlow configuration for a site.\n- `cf magic-transit sites wans get <wan-id>` — Get a specific Site WAN.\n- `cf magic-transit sites wans list` — Lists Site WANs associated with an account.\n\n### Create Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules create` — Create a DNS Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist create` — Create an allowlist prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes bulk create` — Create multiple prefixes for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes create` — Create a prefix for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters create` — Create a SYN Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules create` — Create a SYN Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters create` — Create a TCP Flow Protection filter for an account. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules create` — Create a TCP Flow Protection rule for an account. (supports --dry-run, --body)\n- `cf magic-transit apps create` — Creates a new App for an account (supports --dry-run, --body)\n- `cf magic-transit bgp-filter-profiles create` — Creates a new BGP filter profile for an account. (supports --dry-run, --body)\n- `cf magic-transit cf1-sites create` — Creates new CF1 Sites for an account. Each site must have a unique name within the account. (supports --dry-run, --body)\n- `cf magic-transit cf1-sites ramps create <cf1-site-id>` — Creates ramps (network connections) for a CF1 Site. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels create` — Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels create` — Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit pcaps create` — Create new PCAP request for account. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership create` — Adds an AWS or GCP bucket to use with full packet captures. (supports --dry-run, --body)\n- `cf magic-transit redundancy-groups create` — Creates a new redundancy group, optionally with tunnel members. (supports --dry-run, --body)\n- `cf magic-transit routes create` — Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls create <site-id>` — Creates a new Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration create <site-id>` — Creates a new App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites create` — Creates a new Site (supports --dry-run, --body)\n- `cf magic-transit sites lans create <site-id>` — Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config create <site-id>` — Creates a NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites wans create <site-id>` — Creates a new Site WAN. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules update <rule-id>` — Update a DNS Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs allowlist update <prefix-id>` — Update an allowlist prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs prefixes update <prefix-id>` — Update a prefix specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters update <filter-id>` — Update a SYN Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules update <rule-id>` — Update a SYN Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters update <filter-id>` — Update a TCP Flow Protection filter specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules update <rule-id>` — Update a TCP Flow Protection rule specified by the given UUID. (supports --dry-run, --body)\n- `cf magic-transit advanced-tcp-protection configs tcp protection status update` — Update the protection status of the account. (supports --dry-run, --body)\n- `cf magic-transit apps edit <account-app-id>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit apps update <account-app-id>` — Updates an Account App (supports --dry-run, --body)\n- `cf magic-transit bgp-filter-profiles update <profile-id>` — Updates a BGP filter profile. Omitted properties are left unchanged. To clear an existing description send `description: \"\"`. (supports --dry-run, --body)\n- `cf magic-transit bgp-settings update` — Modifies the BGP settings for an account, including the default ASN and redistribution configuration. (supports --dry-run, --body)\n- `cf magic-transit cf-interconnects update <cf-interconnect-id>` — Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit cf1-sites update <cf1-site-id>` — Partially updates a specific CF1 Site for an account. Only the fields included in the request body are modified; omitted fields retain their existing values. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels update <gre-tunnel-id>` — Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels update <ipsec-tunnel-id>` — Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit redundancy-groups update <redundancy-group-id>` — Replaces the name, description, and full set of members for an existing redundancy group. (supports --dry-run, --body)\n- `cf magic-transit routes update <route-id>` — Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit sites acls edit <acl-id>` — Patch a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites acls update <acl-id>` — Update a specific Site ACL. (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration edit <app-config-id>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites app-configuration update <app-config-id>` — Updates an App Config for a site (supports --dry-run, --body)\n- `cf magic-transit sites edit <site-id>` — Patch a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites lans edit <lan-id>` — Patch a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites lans update <lan-id>` — Update a specific Site LAN. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config edit <site-id>` — Updates NetFlow configuration for a site. (supports --dry-run, --body)\n- `cf magic-transit sites netflow-config update <site-id>` — Updates NetFlow configuration for a site (partial update). (supports --dry-run, --body)\n- `cf magic-transit sites update <site-id>` — Update a specific Site. (supports --dry-run, --body)\n- `cf magic-transit sites wans edit <wan-id>` — Patch a specific Site WAN. (supports --dry-run, --body)\n- `cf magic-transit sites wans update <wan-id>` — Update a specific Site WAN. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf magic-transit advanced-tcp-protection configs prefixes delete <prefix-id>` — Delete the prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit apps delete <account-app-id>` — Deletes specific Account App. (supports --dry-run)\n- `cf magic-transit bgp-filter-profiles delete <profile-id>` — Deletes a BGP filter profile. (supports --dry-run)\n- `cf magic-transit cf1-sites delete <cf1-site-id>` — Deletes a specific CF1 Site for an account. (supports --dry-run)\n- `cf magic-transit cf1-sites ramps delete <ramp-id>` — Deletes a specific ramp from a CF1 Site. (supports --dry-run)\n- `cf magic-transit gre-tunnels delete <gre-tunnel-id>` — Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run)\n- `cf magic-transit ipsec-tunnels delete <ipsec-tunnel-id>` — Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run)\n- `cf magic-transit pcaps ownership delete <ownership-id>` — Deletes buckets added to the packet captures API. (supports --dry-run)\n- `cf magic-transit redundancy-groups delete <redundancy-group-id>` — Deletes a redundancy group. Member tunnels are not deleted — their redundancy_group_id is cleared. (supports --dry-run)\n- `cf magic-transit routes delete <route-id>` — Disable and remove a specific Magic static route. (supports --dry-run)\n- `cf magic-transit sites acls delete <acl-id>` — Remove a specific Site ACL. (supports --dry-run)\n- `cf magic-transit sites app-configuration delete <app-config-id>` — Deletes specific App Config associated with a site. (supports --dry-run)\n- `cf magic-transit sites delete <site-id>` — Remove a specific Site. (supports --dry-run)\n- `cf magic-transit sites lans delete <lan-id>` — Remove a specific Site LAN. (supports --dry-run)\n- `cf magic-transit sites netflow-config delete <site-id>` — Remove NetFlow configuration for a site. (supports --dry-run)\n- `cf magic-transit sites wans delete <wan-id>` — Remove a specific Site WAN. (supports --dry-run)\n\n### Other Operations\n\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete for account` — Delete all DNS Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule <rule-id>` — Delete a DNS Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix <prefix-id>` — Delete the allowlist prefix for an account given a UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs allowlist delete for account` — Delete all allowlist prefixes for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete for account` — Delete all SYN Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection filters delete protection filter <filter-id>` — Delete a SYN Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete for account` — Delete all SYN Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs syn protection rules delete protection rule <rule-id>` — Delete a SYN Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete for account` — Delete all TCP Flow Protection filters for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete protection filter <filter-id>` — Delete a TCP Flow Protection filter specified by the given UUID. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete for account` — Delete all TCP Flow Protection rules for an account. (supports --dry-run)\n- `cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete protection rule <rule-id>` — Delete a TCP Flow Protection rule specified by the given UUID. (supports --dry-run)\n- `cf magic-transit cf-interconnects bulk-update` — Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit gre-tunnels bulk-update` — Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels bulk-update` — Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. (supports --dry-run, --body)\n- `cf magic-transit ipsec-tunnels psk-generate <ipsec-tunnel-id>` — Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a safe place. (supports --dry-run)\n- `cf magic-transit ipsec-tunnels psk-set` — Sets Pre-Shared Keys for multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After PSKs are applied, they are immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSKs in a safe place. (supports --dry-run, --body)\n- `cf magic-transit pcaps ownership validate` — Validates buckets added to the packet captures API. (supports --dry-run, --body)\n- `cf magic-transit pcaps stop <pcap-id>` — Stop full PCAP. (supports --dry-run)\n- `cf magic-transit routes bulk-update` — Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided. (supports --dry-run, --body)\n- `cf magic-transit routes empty` — Delete multiple Magic static routes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"managed-transforms": "# managed-transforms — managed-transforms\n\n## Commands\n\n### Read Operations\n\n- `cf managed-transforms list` — Fetches a list of all Managed Transforms.\n\n### Update Operations\n\n- `cf managed-transforms update` — Updates the status of one or more Managed Transforms. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf managed-transforms delete` — Disables all Managed Transforms. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"matches": "# matches — matches\n\n## Commands\n\n### Read Operations\n\n- `cf matches download get` — Return matches as CSV for string queries based on ID\n- `cf matches get` — Return matches for string queries based on ID\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"mcp": "# mcp — mcp\n\n## Commands\n\n### Read Operations\n\n- `cf mcp portals list` — Lists all MCP portals configured for the account.\n- `cf mcp servers list` — Lists all MCP servers configured for the account.\n\n### Create Operations\n\n- `cf mcp portals create` — Creates a new MCP portal for managing AI tool access through Cloudflare Access. (supports --dry-run, --body)\n- `cf mcp servers create` — Creates a new MCP server for connecting to an upstream MCP endpoint. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf mcp portals update <id>` — Updates an MCP portal configuration. (supports --dry-run, --body)\n- `cf mcp servers update <id>` — Updates an MCP server's configuration and credentials. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mcp portals delete <id>` — Deletes an MCP portal from the account. (supports --dry-run)\n- `cf mcp servers delete <id>` — Deletes an MCP server from the account. (supports --dry-run)\n\n### Other Operations\n\n- `cf mcp portals account-tool-call-timeseries` — Returns daily or monthly tool-call counts across the account. (supports --dry-run)\n- `cf mcp portals portal-tool-call-timeseries <portal-id>` — Returns daily or monthly tool-call counts for a portal. (supports --dry-run)\n- `cf mcp portals read <id>` — Read the details of a single MCP Portal, including its configured servers. (supports --dry-run)\n- `cf mcp servers read <id>` — Retrieves an MCP server's configuration and capability sync state. (supports --dry-run)\n- `cf mcp servers server-tool-call-timeseries <server-id>` — Returns daily or monthly tool-call counts for a server. (supports --dry-run)\n- `cf mcp servers sync <id>` — Syncs an MCP server's capabilities and returns the updated server state, including any connection errors. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"media": "# media — media\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"mesh": "# mesh — mesh\n\n## Commands\n\n### Read Operations\n\n- `cf mesh nodes configurations get <tunnel-id>` — Gets the high-availability configuration for a WARP Connector tunnel.\n- `cf mesh nodes connections list` — Fetches connection details for a WARP Connector Tunnel.\n- `cf mesh nodes connectors get <connector-id>` — Fetches connector and connection details for a WARP Connector Tunnel.\n- `cf mesh nodes get <tunnel-id>` — Fetches a single Warp Connector Tunnel.\n- `cf mesh nodes list` — Lists and filters Warp Connector Tunnels in an account.\n- `cf mesh nodes token get <tunnel-id>` — Gets the token used to associate warp device with a specific Warp Connector tunnel.\n\n### Create Operations\n\n- `cf mesh nodes create` — Creates a new Warp Connector Tunnel in an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf mesh nodes configurations update <tunnel-id>` — Adds or updates the high-availability configuration for a WARP Connector tunnel. (supports --dry-run, --body)\n- `cf mesh nodes edit <tunnel-id>` — Updates an existing Warp Connector Tunnel. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mesh nodes delete <tunnel-id>` — Deletes a Warp Connector Tunnel from an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf mesh nodes failover <tunnel-id>` — Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"moq": "# moq — MoQ relays: provision a relay, then issue tokens for publishers and subscribers\n\n## Commands\n\n### Read Operations\n\n- `cf moq relays get <relay-id>` — Retrieves a single MoQ relay including config and status. Tokens are NOT included.\n- `cf moq relays list` — Lists all MoQ relays for the account. Returns only metadata. Config, status, and tokens are omitted. Results are cursor-paginated (keyset on the `created` timestamp). Use `created_before` / `created_after` with the `created` value of the first/last item in a page to fetch the adjacent page. `result_info` reports the page `count` and the `total` matching the cursor filters.\n- `cf moq relays tokens list` — Returns metadata for every token the relay accepts. Secrets are never returned, so a token that has been lost cannot be recovered here. There is no expiry filter: compare each token's `expires` to the current time to tell which ones have lapsed.\n\n### Create Operations\n\n- `cf moq relays create` — Provisions a new MoQ relay instance. Auto-creates a publish+subscribe token and a subscribe-only token. Token values are included in the response (shown once). Config is always set to defaults (upstreams off) and cannot be supplied here — sending a non-empty `config` is rejected (21014); `null` or `{}` is accepted as absent. Use PUT to configure the relay after it exists. (supports --dry-run, --body)\n- `cf moq relays tokens create <relay-id>` — Mints a new relay-scoped token and adds it to the relay's accepted-auth registry. The token value (secret) is shown once in the response. A relay may hold up to 10 tokens; creating an 11th is rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf moq relays update <relay-id>` — Updates a relay's name and/or configuration. The relay ID goes in the URL path — `PUT /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level update endpoint. This is also the only way to set a relay's config (config cannot be set at create time). Partial updates: omitted fields are preserved; config sub-objects replace as whole objects when present. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf moq relays delete <relay-id>` — Soft-deletes a MoQ relay. The relay ID goes in the URL path — `DELETE /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level delete endpoint. (supports --dry-run)\n- `cf moq relays tokens delete <jti>` — Revokes a token by removing it from the set the relay accepts. Relays cache that set, so revocation takes effect within seconds rather than instantly, and connections already established with the token are not closed. Revoking an unknown token succeeds, so the call is idempotent. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"mtls-certificates": "# mtls-certificates — mtls-certificates\n\n## Commands\n\n### Read Operations\n\n- `cf mtls-certificates associations get <mtls-certificate-id>` — Lists all active associations between the certificate and Cloudflare services.\n- `cf mtls-certificates get <mtls-certificate-id>` — Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/).\n- `cf mtls-certificates list` — Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/).\n\n### Create Operations\n\n- `cf mtls-certificates create` — Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mtls-certificates delete <mtls-certificate-id>` — Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -107,7 +107,7 @@
 		"network-interconnects": "# network-interconnects — Physical and virtual private interconnects between your infrastructure and Cloudflare's network\n\n## Commands\n\n### Read Operations\n\n- `cf network-interconnects cnis get <cni>` — Retrieves configuration details for a specific Cloud Network Interconnect (CNI), including connection status and parameters.\n- `cf network-interconnects cnis list` — Lists all Cloud Network Interconnects (CNIs) configured for the account, showing connection status and parameters.\n- `cf network-interconnects interconnects get <icon>` — Retrieves configuration and status details for a specific network interconnect.\n- `cf network-interconnects interconnects list` — Lists all network interconnects configured for the account, including physical and virtual connections.\n- `cf network-interconnects interconnects status <icon>` — Gets the current operational status of a network interconnect, including link state and traffic metrics.\n- `cf network-interconnects settings get` — Retrieves current settings configuration for the specified resource or service.\n- `cf network-interconnects slots get <slot>` — Gets information about a specific infrastructure slot allocation.\n- `cf network-interconnects slots list` — Lists all available infrastructure slots for the account, showing allocation status and capacity.\n\n### Create Operations\n\n- `cf network-interconnects cnis create` — Creates a new Cloud Network Interconnect (CNI) for private network connectivity between Cloudflare and your infrastructure. CNIs enable dedicated, high-performance network links. (supports --dry-run, --body)\n- `cf network-interconnects interconnects create` — Creates a new network interconnect for connecting Cloudflare's network to external networks. Interconnects provide dedicated bandwidth and reduced latency for traffic exchange. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network-interconnects cnis update <cni>` — Updates the configuration of an existing Cloud Network Interconnect (CNI), including connection parameters and routing settings. (supports --dry-run, --body)\n- `cf network-interconnects settings update` — Updates configuration settings for the specified resource or service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network-interconnects cnis delete <cni>` — Permanently removes a Cloud Network Interconnect (CNI) configuration. The private network connection will be terminated. (supports --dry-run)\n- `cf network-interconnects interconnects delete <icon>` — Permanently removes a network interconnect configuration. The physical or virtual connection will be terminated. (supports --dry-run)\n\n### Other Operations\n\n- `cf network-interconnects interconnects loa <icon>` — Downloads the Letter of Authorization (LOA) for a network interconnect, required for physical cross-connect provisioning. (supports --dry-run)\n- `cf network-interconnects interconnects loa-default-name <icon>` — Retrieves the default customer name that will be used in the LOA if no name is provided to the `/accounts/{account_id}/cni/interconnects/{icon}/loa` endpoint. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"oauth-clients": "# oauth-clients — oauth-clients\n\n## Commands\n\n### Read Operations\n\n- `cf oauth-clients get <oauth-client-id>` — Get details of a specific OAuth client.\n- `cf oauth-clients list` — List all OAuth clients for an account.\n\n### Create Operations\n\n- `cf oauth-clients create` — Create a new OAuth client for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf oauth-clients update <oauth-client-id>` — Update an existing OAuth client. Only include fields you want to update. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf oauth-clients delete <oauth-client-id>` — Delete an OAuth client. (supports --dry-run)\n\n### Other Operations\n\n- `cf oauth-clients delete-rotated-secret <oauth-client-id>` — Removes the old client secret after a rotation, keeping only the new one. Use this after you have updated your client configuration to use the new secret. The `has_rotated_secret` field on the client indicates whether there is an old secret to delete. (supports --dry-run)\n- `cf oauth-clients rotate-secret <oauth-client-id>` — Creates a second client secret so you can update your client configuration before deleting the old one. The `has_rotated_secret` field on the client will be set to `true`. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"oauth-scopes": "# oauth-scopes — oauth-scopes\n\n## Commands\n\n### Read Operations\n\n- `cf oauth-scopes list` — List all available OAuth scopes. This endpoint requires authentication but has no authorization role requirements.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"observability": "# observability — observability\n\n## Commands\n\n### Read Operations\n\n- `cf observability destinations list` — List your Workers Observability Telemetry Destinations.\n- `cf observability queries get <queryId>` — Retrieve a saved query.\n- `cf observability queries list` — List saved queries.\n- `cf observability shared-queries get <id>` — Shared queries store the results of a previously run query, allowing you to share the results with others.\n\n### Create Operations\n\n- `cf observability destinations create` — Create a new Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries create` — Persist query for later use. (supports --dry-run, --body)\n- `cf observability shared-queries create` — Shared queries store the results of a previously run query, allowing you to share the results with others. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf observability destinations update <slug>` — Update an existing Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries edit <queryId>` — Update saved query. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf observability destinations delete <slug>` — Delete a Workers Observability Telemetry Destination. (supports --dry-run)\n- `cf observability queries delete <queryId>` — Delete a saved query. (supports --dry-run)\n\n### Other Operations\n\n- `cf observability telemetry keys` — List all the keys in your telemetry events. (supports --dry-run, --body)\n- `cf observability telemetry query` — Run a temporary or saved query. (supports --dry-run, --body)\n- `cf observability telemetry values` — List unique values found in your events. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"observability": "# observability — observability\n\n## Commands\n\n### Read Operations\n\n- `cf observability destinations list` — List your Workers Observability Telemetry Destinations.\n- `cf observability queries get <queryId>` — Retrieve a saved query.\n- `cf observability queries list` — List saved queries.\n- `cf observability shared-queries get <id>` — Shared queries store the results of a previously run query, allowing you to share the results with others.\n- `cf observability tracing rules get` — Retrieve the ordered sampling overrides for a zone's managed Cloudflare Traces ruleset.\n- `cf observability tracing settings get` — Retrieve the zone-level Cloudflare Traces settings.\n\n### Create Operations\n\n- `cf observability destinations create` — Create a new Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries create` — Persist query for later use. (supports --dry-run, --body)\n- `cf observability shared-queries create` — Shared queries store the results of a previously run query, allowing you to share the results with others. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf observability destinations update <slug>` — Update an existing Workers Observability Telemetry Destination. (supports --dry-run, --body)\n- `cf observability queries edit <queryId>` — Update saved query. (supports --dry-run, --body)\n- `cf observability tracing rules update` — Replace all sampling overrides in a zone's managed Cloudflare Traces ruleset. Rules are evaluated in the supplied order. (supports --dry-run, --body)\n- `cf observability tracing settings update` — Update the zone-level Cloudflare Traces settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf observability destinations delete <slug>` — Delete a Workers Observability Telemetry Destination. (supports --dry-run)\n- `cf observability queries delete <queryId>` — Delete a saved query. (supports --dry-run)\n\n### Other Operations\n\n- `cf observability telemetry keys` — List all the keys in your telemetry events. (supports --dry-run, --body)\n- `cf observability telemetry query` — Run a temporary or saved query. (supports --dry-run, --body)\n- `cf observability telemetry values` — List unique values found in your events. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"organization": "# organization — organization\n\n## Commands\n\n### Read Operations\n\n- `cf organization account list` — Retrieve a list of accounts that belong to a specific organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization get <organization-id>` — Retrieve the details of a certain organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization list` — Retrieve a list of organizations a particular user has access to. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization member get <member-id>` — Retrieve a single membership from an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization member list` — List memberships for an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization profile get <organization-id>` — Get an organizations profile if it exists. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)\n- `cf organization share list` — Lists all organization shares.\n\n### Create Operations\n\n- `cf organization create` — Create a new organization for a user. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organization member batch create <organization-id>` — Batch create multiple memberships that grant access to a specific Organization. (supports --dry-run, --body)\n- `cf organization member create <organization-id>` — Create a membership that grants access to a specific Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf organization profile update <organization-id>` — Modify organization profile. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n- `cf organization update <organization-id>` — Modify organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf organization delete <organization-id>` — Delete an organization. The organization MUST be empty before deleting. It must not contain any sub-organizations, accounts, members or users. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) **Access Control:** Restricted to enterprise organizations. (supports --dry-run)\n- `cf organization member delete <member-id>` — Delete a membership to a particular Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"organizations": "# organizations — Multi-user organizations that group accounts, members, and shared settings under a single entity\n\n## Commands\n\n### Read Operations\n\n- `cf organizations billing usage get <organization-id>` — Returns cost and usage data for all accounts within an organization, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. The response includes usage for every account belonging to the specified organization. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days.\n- `cf organizations logs audit get <organization-id>` — Gets a list of audit logs for an organization.\n\n### Other Operations\n\n- `cf organizations logs audit history <id>` — Returns the chronological change history for the resource identified by the given organization-scoped audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"origin-ca-certificates": "# origin-ca-certificates — origin-ca-certificates\n\n## Commands\n\n### Read Operations\n\n- `cf origin-ca-certificates get <certificate-id>` — Get an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n- `cf origin-ca-certificates list` — List all existing Origin CA certificates for a given zone. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).\n\n### Create Operations\n\n- `cf origin-ca-certificates create` — Create an Origin CA certificate. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf origin-ca-certificates delete <certificate-id>` — Revoke an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -122,11 +122,11 @@
 		"queues": "# queues — Reliable message queuing between Workers — produce, consume, and batch-process messages at scale\n\n## Commands\n\n### Read Operations\n\n- `cf queues consumers get <consumer-id>` — Fetches the consumer for a queue by consumer id\n- `cf queues consumers list` — Returns the consumers for a Queue\n- `cf queues get <queue-id>` — Get details about a specific queue.\n- `cf queues list` — Returns the queues owned by an account.\n- `cf queues metrics get <queue-id>` — Return best-effort metrics for a queue. Values may be approximate due to the distributed nature of queues.\n- `cf queues purge status <queue-id>` — Get details about a Queue's purge status.\n- `cf queues subscriptions get <subscription-id>` — Get details about an existing event subscription\n- `cf queues subscriptions list` — Get a paginated list of event subscriptions with optional sorting and filtering\n\n### Create Operations\n\n- `cf queues consumers create <queue-id>` — Creates a new consumer for a Queue (supports --dry-run, --body)\n- `cf queues create` — Create a new queue (supports --dry-run, --body)\n- `cf queues subscriptions create` — Create a new event subscription for a queue (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf queues consumers update <consumer-id>` — Updates the consumer for a queue, or creates one if it does not exist. (supports --dry-run, --body)\n- `cf queues edit <queue-id>` — Updates a Queue. (supports --dry-run, --body)\n- `cf queues subscriptions update <subscription-id>` — Update an existing event subscription (supports --dry-run, --body)\n- `cf queues update <queue-id>` — Updates a Queue. Note that this endpoint does not support partial updates. If successful, the Queue's configuration is overwritten with the supplied configuration. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf queues consumers delete <consumer-id>` — Deletes the consumer for a queue. (supports --dry-run)\n- `cf queues delete <queue-id>` — Deletes a queue (supports --dry-run)\n- `cf queues subscriptions delete <subscription-id>` — Delete an existing event subscription (supports --dry-run)\n\n### Other Operations\n\n- `cf queues messages ack <queue-id>` — Acknowledge + Retry messages from a Queue (supports --dry-run, --body)\n- `cf queues messages ack-preview <queue-id>` — Delete previewed messages from a Queue. Note that messages acknowledged this way aren't considered delivered, they are instantly deleted from this queue and do not affect metrics. (supports --dry-run, --body)\n- `cf queues messages bulk-push` — Push a batch of message to a Queue (supports --dry-run, --body)\n- `cf queues messages extendLeases <queue-id>` — Extend the lease on a message. This creates a new lease ID on your message without incrementing the message's `attempts` counter. (supports --dry-run, --body)\n- `cf queues messages peek <queue-id>` — Peek messages from a Queue without leasing them. Messages remain available for subsequent peek or pull operations. (supports --dry-run, --body)\n- `cf queues messages preview <queue-id>` — Preview messages from a Queue without leasing them. Messages remain available for subsequent preview or pull operations. (supports --dry-run, --body)\n- `cf queues messages pull <queue-id>` — Pull a batch of messages from a Queue (supports --dry-run, --body)\n- `cf queues messages purge <queue-id>` — Delete peeked messages from a Queue by their ref. Purged messages aren't considered delivered, they are instantly deleted from this queue and do not affect metrics. (supports --dry-run, --body)\n- `cf queues messages push <queue-id>` — Push a message to a Queue (supports --dry-run, --body)\n- `cf queues purge start <queue-id>` — Deletes all messages from the Queue. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"r2": "# r2 — S3-compatible object storage with zero egress fees — buckets, lifecycle rules, event notifications, and data migration\n\n## Commands\n\n### Read Operations\n\n- `cf r2 buckets cors get <bucket-name>` — Get the CORS policy for a bucket.\n- `cf r2 buckets domains custom get <domain>` — Get the configuration for a custom domain on an existing R2 bucket.\n- `cf r2 buckets domains custom list` — Gets a list of all custom domains registered with an existing R2 bucket.\n- `cf r2 buckets domains managed list` — Gets state of public access over the bucket's R2-managed (r2.dev) domain.\n- `cf r2 buckets event-notifications get <queue-id>` — Get a single event notification rule.\n- `cf r2 buckets event-notifications list` — List all event notification rules for a bucket.\n- `cf r2 buckets get <bucket-name>` — Gets properties of an existing R2 bucket.\n- `cf r2 buckets jobs get <job-id>` — Gets the current status of a background job for an R2 bucket. Poll this endpoint with the job identifier returned when the operation was submitted until the status is `COMPLETED`, `FAILED`, or `CANCELLED`.\n- `cf r2 buckets jobs list` — Lists background jobs for an R2 bucket. Use this endpoint to poll jobs returned by asynchronous operations such as deleting objects by prefix or emptying a bucket.\n- `cf r2 buckets lifecycle get <bucket-name>` — Get object lifecycle rules for a bucket.\n- `cf r2 buckets list` — Lists all R2 buckets on your account.\n- `cf r2 buckets local-uploads get <bucket-name>` — Get the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region.\n- `cf r2 buckets locks get <bucket-name>` — Get lock rules for a bucket.\n- `cf r2 buckets metrics list` — Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.\n- `cf r2 buckets objects get <object-key>` — Retrieves an object from an R2 bucket. Returns the object body along with metadata headers. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.\n- `cf r2 buckets objects list` — Lists objects in an R2 bucket. Returns object metadata including key, size, etag, last modified date, HTTP metadata, and custom metadata. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.\n- `cf r2 buckets sippy get <bucket-name>` — Gets configuration for Sippy for an existing R2 bucket.\n- `cf r2 super-slurper jobs get <job-id>` — Retrieves detailed status and configuration for a specific R2 Super Slurper migration job.\n- `cf r2 super-slurper jobs list` — Lists all R2 Super Slurper migration jobs for the account with their status.\n- `cf r2 super-slurper jobs logs list` — Gets log entries for an R2 Super Slurper migration job, showing migration status changes, errors, etc.\n\n### Create Operations\n\n- `cf r2 buckets create` — Creates a new R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom create <bucket-name>` — Register a new custom domain for an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 super-slurper jobs create` — Creates a new R2 Super Slurper migration job to transfer objects from a source bucket (e.g. S3, GCS, R2) to R2. (supports --dry-run, --body)\n- `cf r2 temporary-credentials create` — Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2 buckets cors update <bucket-name>` — Set the CORS policy for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains custom update <domain>` — Edit the configuration for a custom domain on an existing R2 bucket. (supports --dry-run, --body)\n- `cf r2 buckets domains managed update <bucket-name>` — Updates state of public access over the bucket's R2-managed (r2.dev) domain. (supports --dry-run, --body)\n- `cf r2 buckets edit <bucket-name>` — Updates properties of an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications update <queue-id>` — Create event notification rule. (supports --dry-run, --body)\n- `cf r2 buckets lifecycle update <bucket-name>` — Set the object lifecycle rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets local-uploads update <bucket-name>` — Set the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region. (supports --dry-run, --body)\n- `cf r2 buckets locks update <bucket-name>` — Set lock rules for a bucket. (supports --dry-run, --body)\n- `cf r2 buckets sippy update <bucket-name>` — Sets configuration for Sippy for an existing R2 bucket. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf r2 buckets cors delete <bucket-name>` — Delete the CORS policy for a bucket. (supports --dry-run)\n- `cf r2 buckets delete <bucket-name>` — Deletes an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets domains custom delete <domain>` — Remove custom domain registration from an existing R2 bucket. (supports --dry-run)\n- `cf r2 buckets event-notifications delete <queue-id>` — Delete an event notification rule. **If no body is provided, all rules for specified queue will be deleted**. (supports --dry-run, --body)\n- `cf r2 buckets objects delete <object-key>` — Deletes an object from an R2 bucket. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead. (supports --dry-run)\n- `cf r2 buckets sippy delete <bucket-name>` — Disables Sippy on this bucket. (supports --dry-run)\n- `cf r2 super-slurper jobs delete <job-id>` — Deletes a completed, aborted, or errored R2 Super Slurper migration job. Active jobs cannot be deleted. (supports --dry-run)\n\n### Other Operations\n\n- `cf r2 buckets createByName <bucket-name>` — Creates a new R2 bucket using the name from the URL path. Similar to `r2-create-bucket` (POST), but the bucket name comes from the path and the optional storage class is supplied via the `cf-r2-storage-class` header. There is no request body. Unlike the POST variant, this endpoint does not accept a location hint — the bucket is placed in the R2 region for the caller's edge colo. Use the POST variant if you need to set a `locationHint`. (supports --dry-run)\n- `cf r2 buckets objects bulk-delete` — Deletes objects from an R2 bucket. Three modes are supported: 1. **Delete by list** (default): Provide a JSON array of object keys in the request body. All listed objects are deleted; per-key errors are reported in the response. 2. **Delete by prefix**: Provide a non-empty `prefix` query parameter and no request body to delete every object whose key begins with that prefix. 3. **Empty bucket**: Provide the `prefix` query parameter with an empty value (`?prefix=`) and no request body to delete all objects in the bucket. Prefix and empty-bucket requests return a job descriptor. Small jobs can finish synchronously and return `COMPLETED`; larger jobs continue in the background. Poll the returned `id` with the Get Bucket Job endpoint. Objects uploaded after a background job starts are not deleted by that job. Abort active multipart uploads before submitting the request; a synchronously completed job does not abort them. Avoid writing objects or starting multipart uploads while a bucket-emptying job is in progress. Each repeated or concurrent request creates a distinct job. The number of active jobs is limited per bucket; wait for an existing job to finish before retrying a request rejected with HTTP 429. A bucket cannot be emptied while event notifications are configured. Remove the event notification rules and retry requests rejected with HTTP 409 / error code 10034. To protect a bucket with R2 Data Catalog enabled, send the `cf-r2-data-catalog-check` header; a conflict is returned with HTTP 409 / error code 10081. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead. (supports --dry-run, --body)\n- `cf r2 buckets objects upload <object-key>` — Uploads an object to an R2 bucket. The object body is provided as the request body. Returns metadata about the uploaded object. The maximum upload size for this endpoint is 300 MB. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead. (supports --dry-run, --body)\n- `cf r2 super-slurper connectivity-precheck source` — Check whether tokens are valid against the source bucket (supports --dry-run, --body)\n- `cf r2 super-slurper connectivity-precheck target` — Check whether tokens are valid against the target bucket (supports --dry-run, --body)\n- `cf r2 super-slurper jobs abort <job-id>` — Cancels a specific R2 Super Slurper migration job. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs abort-all` — Cancels all running R2 Super Slurper migration jobs for the account. Any objects in the middle of a transfer will finish, but no new objects will start transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs pause <job-id>` — Pauses a running R2 Super Slurper migration job. The job can be resumed later to continue transferring. (supports --dry-run)\n- `cf r2 super-slurper jobs progress <job-id>` — Retrieves current progress metrics for an R2 Super Slurper migration job (supports --dry-run)\n- `cf r2 super-slurper jobs resume <job-id>` — Resumes a paused R2 Super Slurper migration job, continuing the transfer from where it stopped. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"r2-data-catalog": "# r2-data-catalog — Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines\n\n## Commands\n\n### Read Operations\n\n- `cf r2-data-catalog get <bucket-name>` — Retrieve detailed information about a specific R2 catalog by bucket name. Returns catalog status, maintenance configuration, and credential status.\n- `cf r2-data-catalog list` — Returns a list of R2 buckets that have been enabled as Apache Iceberg catalogs for the specified account. Each catalog represents an R2 bucket configured to store Iceberg metadata and data files.\n- `cf r2-data-catalog maintenance-configs get <bucket-name>` — Retrieve the maintenance configuration for a specific catalog, including compaction settings and credential status.\n- `cf r2-data-catalog namespaces list` — Returns a list of namespaces in the specified R2 catalog. Supports hierarchical filtering and pagination for efficient traversal of large namespace hierarchies.\n- `cf r2-data-catalog namespaces tables get <table-name>` — Returns full Apache Iceberg metadata for a single table: schema, partition specs, sort orders, properties, and recent snapshot history. Designed for catalog introspection UIs that need per-table details without holding R2 credentials. The `metadata.snapshots`, `metadata.snapshot-log`, and `metadata.metadata-log` arrays are pruned to the most recent 10 entries by `timestamp-ms`. Use `total_snapshots` and `returned_snapshots` to surface the truncation to end users.\n- `cf r2-data-catalog namespaces tables list` — Returns a list of tables in the specified namespace within an R2 catalog. Supports pagination for efficient traversal of large table collections.\n- `cf r2-data-catalog namespaces tables maintenance-configs get <table-name>` — Retrieve the maintenance configuration for a specific table, including compaction settings.\n\n### Create Operations\n\n- `cf r2-data-catalog credentials create <bucket-name>` — Store authentication credentials for a catalog. These credentials are used to authenticate with R2 storage when performing catalog operations. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf r2-data-catalog maintenance-configs update <bucket-name>` — Update the maintenance configuration for a catalog. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n- `cf r2-data-catalog namespaces tables maintenance-configs update <table-name>` — Update the maintenance configuration for a specific table. This allows you to enable or disable compaction and adjust target file sizes for optimization. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf r2-data-catalog delete <bucket-name>` — Removes the catalog from the control plane without deleting R2 bucket objects. Set force=true to remove catalog namespaces, tables, views, and maintenance metadata. Force deletion is limited to a configured catalog object count. (supports --dry-run)\n\n### Other Operations\n\n- `cf r2-data-catalog disable <bucket-name>` — Disable an R2 bucket as a catalog. This operation deactivates the catalog but preserves existing metadata and data files. The catalog can be re-enabled later. (supports --dry-run)\n- `cf r2-data-catalog enable <bucket-name>` — Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"radar": "# radar — Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights\n\n## Commands\n\n### Read Operations\n\n- `cf radar annotations list` — Retrieves the latest annotations.\n- `cf radar annotations outages get` — Retrieves the latest Internet outages and anomalies.\n- `cf radar bgp hijacks events list` — Retrieves the BGP hijack events.\n- `cf radar bgp leaks events list` — Retrieves the BGP route leak events.\n- `cf radar bgp routes paths list` — Retrieves the paths an AS uses to reach the tier-1 clique, derived from RouteViews RIB snapshots. Each entry is an ordered AS-path segment (from the queried AS toward a tier-1) with the number of observed paths and peers, and the collectors that observed it. By default segments are merged across all active collectors; pass \"collector\" to scope to one. The response also includes an \"asnInfo\" map (keyed by ASN) with the name and country for every ASN in the returned segments plus the queried ASN (best-effort; null when unavailable).\n- `cf radar bgp top ases get` — Retrieves the top autonomous systems by BGP updates (announcements only).\n- `cf radar bots get <bot-slug>` — Retrieves the requested bot information.\n- `cf radar bots list` — Retrieves a list of bots.\n- `cf radar ct authorities get <ca-slug>` — Retrieves the requested CA information.\n- `cf radar ct authorities list` — Retrieves a list of certificate authorities.\n- `cf radar ct logs get <log-slug>` — Retrieves the requested certificate log information.\n- `cf radar ct logs list` — Retrieves a list of certificate logs.\n- `cf radar datasets get <alias>` — Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.\n- `cf radar datasets list` — Retrieves a list of datasets.\n- `cf radar email security top tlds get` — Retrieves the top TLDs by number of email messages.\n- `cf radar email security top tlds malicious get <malicious>` — Retrieves the top TLDs by emails classified as malicious or not.\n- `cf radar email security top tlds spam get <spam>` — Retrieves the top TLDs by emails classified as spam or not.\n- `cf radar email security top tlds spoof get <spoof>` — Retrieves the top TLDs by emails classified as spoof or not.\n- `cf radar entities asns get <asn>` — Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).\n- `cf radar entities asns list` — Retrieves a list of autonomous systems.\n- `cf radar entities get` — Retrieves IP address information.\n- `cf radar entities locations get <location>` — Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).\n- `cf radar entities locations list` — Retrieves a list of locations.\n- `cf radar geolocations get <geo-id>` — Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar geolocations list` — Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar http ases bot-class get <bot-class>` — Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.\n- `cf radar http ases browser-family get <browser-family>` — Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.\n- `cf radar http ases device-type get <device-type>` — Retrieves the top autonomous systems, by HTTP requests, of the requested device type.\n- `cf radar http ases get` — Retrieves the top autonomous systems by HTTP requests.\n- `cf radar http ases http-method get <http-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.\n- `cf radar http ases http-protocol get <http-protocol>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http ases ip-version get <ip-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.\n- `cf radar http ases os get <os>` — Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.\n- `cf radar http ases tls-version get <tls-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.\n- `cf radar http locations bot-class get <bot-class>` — Retrieves the top locations, by HTTP requests, of the requested bot class.\n- `cf radar http locations browser-family get <browser-family>` — Retrieves the top locations, by HTTP requests, of the requested browser family.\n- `cf radar http locations device-type get <device-type>` — Retrieves the top locations, by HTTP requests, of the requested device type.\n- `cf radar http locations get` — Retrieves the top locations by HTTP requests.\n- `cf radar http locations http-method get <http-version>` — Retrieves the top locations, by HTTP requests, of the requested HTTP version.\n- `cf radar http locations http-protocol get <http-protocol>` — Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http locations ip-version get <ip-version>` — Retrieves the top locations, by HTTP requests, of the requested IP version.\n- `cf radar http locations os get <os>` — Retrieves the top locations, by HTTP requests, of the requested operating system.\n- `cf radar http locations tls-version get <tls-version>` — Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.\n- `cf radar origins get <slug>` — Retrieves the requested origin information with its regions.\n- `cf radar origins list` — Retrieves a list of origins with their regions.\n- `cf radar ranking domain get <domain>` — Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.\n- `cf radar tlds get <tld>` — Retrieves the requested TLD information.\n- `cf radar tlds list` — Retrieves a list of TLDs.\n- `cf radar traffic-anomalies get` — Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.\n- `cf radar traffic-anomalies locations get` — Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.\n\n### Other Operations\n\n- `cf radar agent-readiness summary <dimension>` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts. (supports --dry-run)\n- `cf radar ai bots timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai inference summary-v2 <dimension>` — Retrieves an aggregated summary of the number of inferences run on Workers AI, grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference timeseries-groups-v2 <dimension>` — Retrieves the distribution of the number of inferences run on Workers AI, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai markdown-for-agents summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. (supports --dry-run)\n- `cf radar ai markdown-for-agents timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. (supports --dry-run)\n- `cf radar ai timeseries-groups summary <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar annotations outages locations` — Retrieves the number of outages by location. (supports --dry-run)\n- `cf radar as112 summary-v2 <dimension>` — Retrieves the distribution of AS112 queries by the specified dimension. (supports --dry-run)\n- `cf radar as112 timeseries` — Retrieves the AS112 DNS queries over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups-v2 <dimension>` — Retrieves the distribution of AS112 queries grouped by dimension over time. (supports --dry-run)\n- `cf radar as112 top dnssec <dnssec>` — Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 top edns <edns>` — Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 top ip-version <ip-version>` — Retrieves the top locations of DNS queries to AS112 for an IP version. (supports --dry-run)\n- `cf radar as112 top locations` — Retrieves the top locations by AS112 DNS queries. (supports --dry-run)\n- `cf radar attacks layer3 summary-v2 <dimension>` — Retrieves the distribution of layer 3 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer3 timeseries` — Retrieves layer 3 attacks over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer3 top attacks` — Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer3 top locations origin` — Retrieves the origin locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top locations target` — Retrieves the target locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer7 summary-v2 <dimension>` — Retrieves the distribution of layer 7 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer7 timeseries` — Retrieves layer 7 attacks over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer7 top ases origin` — Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top attacks` — Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer7 top locations origin` — Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top locations target` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. (supports --dry-run)\n- `cf radar bgp ips timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. (supports --dry-run)\n- `cf radar bgp ips top ases` — Returns the top-N autonomous systems by announced IP space at the nearest 8-hour RIB boundary at or before the requested date. The snapped boundary is returned as `anchor_ts`. (supports --dry-run)\n- `cf radar bgp routes ases` — Retrieves all ASes in the current global routing tables with routing statistics. (supports --dry-run)\n- `cf radar bgp routes moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. (supports --dry-run)\n- `cf radar bgp routes pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. (supports --dry-run)\n- `cf radar bgp routes realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). (supports --dry-run)\n- `cf radar bgp routes stats` — Retrieves the BGP routing table stats. (supports --dry-run)\n- `cf radar bgp routes upstreams timeseries <asn>` — Retrieves the share of an AS’s observed paths carried by each direct upstream over time, derived from RouteViews RIB snapshots across all collectors (the combined product). Each upstream ASN is returned as its own series of shares (0–1); the least-significant upstreams beyond the requested limit are grouped into an \"OTHER\" series. Series share a common set of timestamps. (supports --dry-run)\n- `cf radar bgp rpki aspa changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. (supports --dry-run)\n- `cf radar bgp rpki aspa snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. (supports --dry-run)\n- `cf radar bgp rpki aspa timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. (supports --dry-run)\n- `cf radar bgp rpki roas timeseries` — Retrieves RPKI ROA (Route Origin Authorization) validation ratios over time. Returns the selected metric as a time series. Supports filtering by ASN or location (country code) — multiple values of the same filter type produce one series per value. If no ASN or location is specified, returns the global aggregate. (supports --dry-run)\n- `cf radar bgp timeseries` — Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. (supports --dry-run)\n- `cf radar bgp top ases prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. (supports --dry-run)\n- `cf radar bgp top prefixes` — Retrieves the top network prefixes by BGP updates. (supports --dry-run)\n- `cf radar bots summary <dimension>` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots timeseries` — Retrieves bots HTTP request volume over time. (supports --dry-run)\n- `cf radar bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar bots web-crawlers summary <dimension>` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots web-crawlers timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ct summary <dimension>` — Retrieves an aggregated summary of certificates grouped by the specified dimension. (supports --dry-run)\n- `cf radar ct timeseries` — Retrieves certificate volume over time. (supports --dry-run)\n- `cf radar ct timeseries-groups <dimension>` — Retrieves the distribution of certificates grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar datasets download` — Retrieves an URL to download a single dataset. (supports --dry-run, --body)\n- `cf radar dns summary-v2 <dimension>` — Retrieves the distribution of DNS queries by the specified dimension. (supports --dry-run)\n- `cf radar dns timeseries` — Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. (supports --dry-run)\n- `cf radar dns timeseries-groups-v2 <dimension>` — Retrieves the distribution of DNS queries grouped by dimension over time. (supports --dry-run)\n- `cf radar dns top ases` — Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar dns top locations` — Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar email routing summary-v2 <dimension>` — Retrieves the distribution of email routing metrics by the specified dimension. (supports --dry-run)\n- `cf radar email routing timeseries-groups-v2 <dimension>` — Retrieves the distribution of email routing metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar email security summary-v2 <dimension>` — Retrieves the distribution of email security metrics by the specified dimension. (supports --dry-run)\n- `cf radar email security timeseries-groups-v2 <dimension>` — Retrieves the distribution of email security metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar entities asns as-set <asn>` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. (supports --dry-run)\n- `cf radar entities asns botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. (supports --dry-run)\n- `cf radar entities asns ip` — Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). (supports --dry-run)\n- `cf radar entities asns rel <asn>` — Retrieves AS-level relationship for given networks. (supports --dry-run)\n- `cf radar http summary-v2 <dimension>` — Retrieves the distribution of HTTP requests by the specified dimension. (supports --dry-run)\n- `cf radar http timeseries` — Retrieves the HTTP requests over time. (supports --dry-run)\n- `cf radar http timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP requests grouped by dimension. (supports --dry-run)\n- `cf radar leaked-credentials summary-v2 <dimension>` — Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows summary-v2 <dimension>` — Retrieves the distribution of network traffic (NetFlows) by the specified dimension. (supports --dry-run)\n- `cf radar netflows timeseries` — Retrieves network traffic (NetFlows) over time. (supports --dry-run)\n- `cf radar netflows timeseries-groups <dimension>` — Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows top ases` — Retrieves the top autonomous systems by network traffic (NetFlows). (supports --dry-run)\n- `cf radar netflows top locations` — Retrieves the top locations by network traffic (NetFlows). (supports --dry-run)\n- `cf radar origins summary <dimension>` — Retrieves an aggregated summary of origin metrics grouped by the specified dimension. (supports --dry-run)\n- `cf radar origins timeseries` — Retrieves the time series of origin metrics for the specified origin. (supports --dry-run)\n- `cf radar origins timeseries-groups <dimension>` — Retrieves the distribution of origin metrics grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar post-quantum origin summary <dimension>` — Returns a summary of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum origin timeseries-groups <dimension>` — Returns a timeseries of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum tls support` — Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm, whether it uses PQ cryptography, and any detected TLS implementation bugs (Split ClientHello, HRR failure, etc.). (supports --dry-run)\n- `cf radar quality iqi summary` — Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality iqi timeseries-groups` — Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality speed histogram` — Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. (supports --dry-run)\n- `cf radar quality speed summary` — Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top ases` — Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top locations` — Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar ranking internet-services categories` — Retrieves the list of Internet services categories. (supports --dry-run)\n- `cf radar ranking internet-services timeseries-groups` — Retrieves Internet Services rank update changes over time. (supports --dry-run)\n- `cf radar ranking internet-services top` — Retrieves top Internet services based on their rank. (supports --dry-run)\n- `cf radar ranking timeseries-groups` — Retrieves domains rank over time. (supports --dry-run)\n- `cf radar ranking top` — Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. (supports --dry-run)\n- `cf radar robots-txt top domain-categories` — Retrieves the top domain categories by the number of robots.txt files parsed. (supports --dry-run)\n- `cf radar robots-txt top user-agents directive` — Retrieves the top user agents on robots.txt files. (supports --dry-run)\n- `cf radar search global` — Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). (supports --dry-run)\n- `cf radar tcp-resets-timeouts summary` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. (supports --dry-run)\n- `cf radar tcp-resets-timeouts timeseries-groups` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. (supports --dry-run)\n- `cf radar tlds performance summary <dimension>` — Returns a summary of TLD authoritative nameserver performance grouped by the specified dimension. (supports --dry-run)\n- `cf radar tlds performance timeseries-groups <dimension>` — Returns a timeseries of TLD authoritative nameserver performance grouped by the specified dimension. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"radar": "# radar — Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights\n\n## Commands\n\n### Read Operations\n\n- `cf radar annotations get <id>` — Retrieves a single annotation by ID.\n- `cf radar annotations list` — Retrieves the latest annotations.\n- `cf radar annotations outages get` — Retrieves the latest Internet outages and anomalies.\n- `cf radar bgp hijacks events list` — Retrieves the BGP hijack events.\n- `cf radar bgp leaks events list` — Retrieves the BGP route leak events.\n- `cf radar bgp routes paths list` — Retrieves the paths an AS uses to reach the tier-1 clique, derived from RouteViews RIB snapshots. Each entry is an ordered AS-path segment (from the queried AS toward a tier-1) with the number of observed paths and peers, and the collectors that observed it. By default segments are merged across all active collectors; pass \"collector\" to scope to one. The response also includes an \"asnInfo\" map (keyed by ASN) with the name and country for every ASN in the returned segments plus the queried ASN (best-effort; null when unavailable).\n- `cf radar bgp top ases get` — Retrieves the top autonomous systems by BGP updates (announcements only).\n- `cf radar bots get <bot-slug>` — Retrieves the requested bot information.\n- `cf radar bots list` — Retrieves a list of bots.\n- `cf radar ct authorities get <ca-slug>` — Retrieves the requested CA information.\n- `cf radar ct authorities list` — Retrieves a list of certificate authorities.\n- `cf radar ct logs get <log-slug>` — Retrieves the requested certificate log information.\n- `cf radar ct logs list` — Retrieves a list of certificate logs.\n- `cf radar datasets get <alias>` — Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.\n- `cf radar datasets list` — Retrieves a list of datasets.\n- `cf radar email security top tlds get` — Retrieves the top TLDs by number of email messages.\n- `cf radar email security top tlds malicious get <malicious>` — Retrieves the top TLDs by emails classified as malicious or not.\n- `cf radar email security top tlds spam get <spam>` — Retrieves the top TLDs by emails classified as spam or not.\n- `cf radar email security top tlds spoof get <spoof>` — Retrieves the top TLDs by emails classified as spoof or not.\n- `cf radar entities asns get <asn>` — Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).\n- `cf radar entities asns list` — Retrieves a list of autonomous systems.\n- `cf radar entities get` — Retrieves IP address information.\n- `cf radar entities locations get <location>` — Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).\n- `cf radar entities locations list` — Retrieves a list of locations.\n- `cf radar geolocations get <geo-id>` — Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar geolocations list` — Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).\n- `cf radar http ases bot-class get <bot-class>` — Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.\n- `cf radar http ases browser-family get <browser-family>` — Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.\n- `cf radar http ases device-type get <device-type>` — Retrieves the top autonomous systems, by HTTP requests, of the requested device type.\n- `cf radar http ases get` — Retrieves the top autonomous systems by HTTP requests.\n- `cf radar http ases http-method get <http-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.\n- `cf radar http ases http-protocol get <http-protocol>` — Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http ases ip-version get <ip-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.\n- `cf radar http ases os get <os>` — Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.\n- `cf radar http ases tls-version get <tls-version>` — Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.\n- `cf radar http locations bot-class get <bot-class>` — Retrieves the top locations, by HTTP requests, of the requested bot class.\n- `cf radar http locations browser-family get <browser-family>` — Retrieves the top locations, by HTTP requests, of the requested browser family.\n- `cf radar http locations device-type get <device-type>` — Retrieves the top locations, by HTTP requests, of the requested device type.\n- `cf radar http locations get` — Retrieves the top locations by HTTP requests.\n- `cf radar http locations http-method get <http-version>` — Retrieves the top locations, by HTTP requests, of the requested HTTP version.\n- `cf radar http locations http-protocol get <http-protocol>` — Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.\n- `cf radar http locations ip-version get <ip-version>` — Retrieves the top locations, by HTTP requests, of the requested IP version.\n- `cf radar http locations os get <os>` — Retrieves the top locations, by HTTP requests, of the requested operating system.\n- `cf radar http locations tls-version get <tls-version>` — Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.\n- `cf radar origins get <slug>` — Retrieves the requested origin information with its regions.\n- `cf radar origins list` — Retrieves a list of origins with their regions.\n- `cf radar ranking domain get <domain>` — Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.\n- `cf radar tlds get <tld>` — Retrieves the requested TLD information.\n- `cf radar tlds list` — Retrieves a list of TLDs.\n- `cf radar traffic-anomalies get` — Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.\n- `cf radar traffic-anomalies locations get` — Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.\n\n### Other Operations\n\n- `cf radar agent-readiness summary <dimension>` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts. (supports --dry-run)\n- `cf radar ai bots timeseries` — Retrieves AI bots HTTP request volume over time. (supports --dry-run)\n- `cf radar ai bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai inference summary-v2 <dimension>` — Retrieves an aggregated summary of the number of inferences run on Workers AI, grouped by the specified dimension. (supports --dry-run)\n- `cf radar ai inference timeseries-groups-v2 <dimension>` — Retrieves the distribution of the number of inferences run on Workers AI, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ai markdown-for-agents summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. (supports --dry-run)\n- `cf radar ai markdown-for-agents timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. (supports --dry-run)\n- `cf radar ai timeseries-groups summary <dimension>` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar annotations outages locations` — Retrieves the number of outages by location. (supports --dry-run)\n- `cf radar as112 summary-v2 <dimension>` — Retrieves the distribution of AS112 queries by the specified dimension. (supports --dry-run)\n- `cf radar as112 timeseries` — Retrieves the AS112 DNS queries over time. (supports --dry-run)\n- `cf radar as112 timeseries-groups-v2 <dimension>` — Retrieves the distribution of AS112 queries grouped by dimension over time. (supports --dry-run)\n- `cf radar as112 top dnssec <dnssec>` — Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support. (supports --dry-run)\n- `cf radar as112 top edns <edns>` — Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support. (supports --dry-run)\n- `cf radar as112 top ip-version <ip-version>` — Retrieves the top locations of DNS queries to AS112 for an IP version. (supports --dry-run)\n- `cf radar as112 top locations` — Retrieves the top locations by AS112 DNS queries. (supports --dry-run)\n- `cf radar attacks layer3 summary-v2 <dimension>` — Retrieves the distribution of layer 3 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer3 timeseries` — Retrieves layer 3 attacks over time. (supports --dry-run)\n- `cf radar attacks layer3 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer3 top attacks` — Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer3 top locations origin` — Retrieves the origin locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer3 top locations target` — Retrieves the target locations of layer 3 attacks. (supports --dry-run)\n- `cf radar attacks layer7 summary-v2 <dimension>` — Retrieves the distribution of layer 7 attacks by the specified dimension. (supports --dry-run)\n- `cf radar attacks layer7 timeseries` — Retrieves layer 7 attacks over time. (supports --dry-run)\n- `cf radar attacks layer7 timeseries-groups-v2 <dimension>` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. (supports --dry-run)\n- `cf radar attacks layer7 top ases origin` — Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top attacks` — Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location). (supports --dry-run)\n- `cf radar attacks layer7 top locations origin` — Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address. (supports --dry-run)\n- `cf radar attacks layer7 top locations target` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available. (supports --dry-run)\n- `cf radar bgp ips timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN. (supports --dry-run)\n- `cf radar bgp ips top ases` — Returns the top-N autonomous systems by announced IP space at the nearest 8-hour RIB boundary at or before the requested date. The snapped boundary is returned as `anchor_ts`. (supports --dry-run)\n- `cf radar bgp routes ases` — Retrieves all ASes in the current global routing tables with routing statistics. (supports --dry-run)\n- `cf radar bgp routes moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. (supports --dry-run)\n- `cf radar bgp routes pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. (supports --dry-run)\n- `cf radar bgp routes realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). (supports --dry-run)\n- `cf radar bgp routes stats` — Retrieves the BGP routing table stats. (supports --dry-run)\n- `cf radar bgp routes upstreams timeseries <asn>` — Retrieves the share of an AS’s observed paths carried by each direct upstream over time, derived from RouteViews RIB snapshots across all collectors (the combined product). Each upstream ASN is returned as its own series of shares (0–1); the least-significant upstreams beyond the requested limit are grouped into an \"OTHER\" series. Series share a common set of timestamps. (supports --dry-run)\n- `cf radar bgp rpki aspa changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects. (supports --dry-run)\n- `cf radar bgp rpki aspa snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN. (supports --dry-run)\n- `cf radar bgp rpki aspa timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count. (supports --dry-run)\n- `cf radar bgp rpki roas timeseries` — Retrieves RPKI ROA (Route Origin Authorization) validation ratios over time. Returns the selected metric as a time series. Supports filtering by ASN or location (country code) — multiple values of the same filter type produce one series per value. If no ASN or location is specified, returns the global aggregate. (supports --dry-run)\n- `cf radar bgp timeseries` — Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned. (supports --dry-run)\n- `cf radar bgp top ases prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours. (supports --dry-run)\n- `cf radar bgp top prefixes` — Retrieves the top network prefixes by BGP updates. (supports --dry-run)\n- `cf radar bots summary <dimension>` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots timeseries` — Retrieves bots HTTP request volume over time. (supports --dry-run)\n- `cf radar bots timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar bots web-crawlers summary <dimension>` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. (supports --dry-run)\n- `cf radar bots web-crawlers timeseries-groups <dimension>` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar ct summary <dimension>` — Retrieves an aggregated summary of certificates grouped by the specified dimension. (supports --dry-run)\n- `cf radar ct timeseries` — Retrieves certificate volume over time. (supports --dry-run)\n- `cf radar ct timeseries-groups <dimension>` — Retrieves the distribution of certificates grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar datasets download` — Retrieves an URL to download a single dataset. (supports --dry-run, --body)\n- `cf radar dns summary-v2 <dimension>` — Retrieves the distribution of DNS queries by the specified dimension. (supports --dry-run)\n- `cf radar dns timeseries` — Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time. (supports --dry-run)\n- `cf radar dns timeseries-groups-v2 <dimension>` — Retrieves the distribution of DNS queries grouped by dimension over time. (supports --dry-run)\n- `cf radar dns top ases` — Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar dns top locations` — Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver. (supports --dry-run)\n- `cf radar email routing summary-v2 <dimension>` — Retrieves the distribution of email routing metrics by the specified dimension. (supports --dry-run)\n- `cf radar email routing timeseries-groups-v2 <dimension>` — Retrieves the distribution of email routing metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar email security summary-v2 <dimension>` — Retrieves the distribution of email security metrics by the specified dimension. (supports --dry-run)\n- `cf radar email security timeseries-groups-v2 <dimension>` — Retrieves the distribution of email security metrics grouped by dimension over time. (supports --dry-run)\n- `cf radar entities asns as-set <asn>` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. (supports --dry-run)\n- `cf radar entities asns botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes. (supports --dry-run)\n- `cf radar entities asns ip` — Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526). (supports --dry-run)\n- `cf radar entities asns rel <asn>` — Retrieves AS-level relationship for given networks. (supports --dry-run)\n- `cf radar http summary-v2 <dimension>` — Retrieves the distribution of HTTP requests by the specified dimension. (supports --dry-run)\n- `cf radar http timeseries` — Retrieves the HTTP requests over time. (supports --dry-run)\n- `cf radar http timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP requests grouped by dimension. (supports --dry-run)\n- `cf radar leaked-credentials summary-v2 <dimension>` — Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension. (supports --dry-run)\n- `cf radar leaked-credentials timeseries-groups-v2 <dimension>` — Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows summary-v2 <dimension>` — Retrieves the distribution of network traffic (NetFlows) by the specified dimension. (supports --dry-run)\n- `cf radar netflows timeseries` — Retrieves network traffic (NetFlows) over time. (supports --dry-run)\n- `cf radar netflows timeseries-groups <dimension>` — Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar netflows top ases` — Retrieves the top autonomous systems by network traffic (NetFlows). (supports --dry-run)\n- `cf radar netflows top locations` — Retrieves the top locations by network traffic (NetFlows). (supports --dry-run)\n- `cf radar origins summary <dimension>` — Retrieves an aggregated summary of origin metrics grouped by the specified dimension. (supports --dry-run)\n- `cf radar origins timeseries` — Retrieves the time series of origin metrics for the specified origin. (supports --dry-run)\n- `cf radar origins timeseries-groups <dimension>` — Retrieves the distribution of origin metrics grouped by the specified dimension over time. (supports --dry-run)\n- `cf radar post-quantum origin summary <dimension>` — Returns a summary of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum origin timeseries-groups <dimension>` — Returns a timeseries of origin post-quantum data grouped by the specified dimension. (supports --dry-run)\n- `cf radar post-quantum tls support` — Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm, whether it uses PQ cryptography, and any detected TLS implementation bugs (Split ClientHello, HRR failure, etc.). (supports --dry-run)\n- `cf radar quality iqi summary` — Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality iqi timeseries-groups` — Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI). (supports --dry-run)\n- `cf radar quality speed histogram` — Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets. (supports --dry-run)\n- `cf radar quality speed summary` — Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top ases` — Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar quality speed top locations` — Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data. (supports --dry-run)\n- `cf radar ranking internet-services categories` — Retrieves the list of Internet services categories. (supports --dry-run)\n- `cf radar ranking internet-services timeseries-groups` — Retrieves Internet Services rank update changes over time. (supports --dry-run)\n- `cf radar ranking internet-services top` — Retrieves top Internet services based on their rank. (supports --dry-run)\n- `cf radar ranking timeseries-groups` — Retrieves domains rank over time. (supports --dry-run)\n- `cf radar ranking top` — Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/. (supports --dry-run)\n- `cf radar robots-txt top domain-categories` — Retrieves the top domain categories by the number of robots.txt files parsed. (supports --dry-run)\n- `cf radar robots-txt top user-agents directive` — Retrieves the top user agents on robots.txt files. (supports --dry-run)\n- `cf radar search global` — Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`). (supports --dry-run)\n- `cf radar tcp-resets-timeouts summary` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout. (supports --dry-run)\n- `cf radar tcp-resets-timeouts timeseries-groups` — Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time. (supports --dry-run)\n- `cf radar tlds performance summary <dimension>` — Returns a summary of TLD authoritative nameserver performance grouped by the specified dimension. (supports --dry-run)\n- `cf radar tlds performance timeseries-groups <dimension>` — Returns a timeseries of TLD authoritative nameserver performance grouped by the specified dimension. (supports --dry-run)\n- `cf radar traffic-anomalies getById <uuid>` — Retrieves a single Internet traffic anomaly by UUID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rate-limit-analytics": "# rate-limit-analytics — rate-limit-analytics\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rate-limits": "# rate-limits — Legacy per-zone rate limiting rules — prefer Advanced Rate Limiting in Rulesets for new configurations\n\n## Commands\n\n### Read Operations\n\n- `cf rate-limits get <rate-limit-id>` — **Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.\n- `cf rate-limits list` — **Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.\n\n### Create Operations\n\n- `cf rate-limits create` — **Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rate-limits edit <rate-limit-id>` — **Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rate-limits delete <rate-limit-id>` — **Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ready": "# ready — ready\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"realtimekit": "# realtimekit — SDK-backed meetings, participants, recordings, livestreams, and webhooks\n\n## Commands\n\n### Read Operations\n\n- `cf realtimekit analytics livestreams daily get <app-id>` — Returns day-wise livestream analytics for the specified time range.\n- `cf realtimekit analytics livestreams get <app-id>` — Returns livestream analytics for the specified time range.\n- `cf realtimekit analytics usage get <app-id>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date.\n- `cf realtimekit apps get <app-id>` — Fetch details for an app in your account.\n- `cf realtimekit apps list` — Fetch all apps for your account\n- `cf realtimekit livestreams get <livestream-id>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API.\n- `cf realtimekit livestreams list` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter.\n- `cf realtimekit livestreams sessions get <livestream-session-id>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API.\n- `cf realtimekit meetings active get <meeting-id>` — Returns details of an ongoing active session for the given meeting ID.\n- `cf realtimekit meetings get <meeting-id>` — Returns a meeting details in an App for the given meeting ID.\n- `cf realtimekit meetings list` — Returns all meetings for the given App ID.\n- `cf realtimekit meetings livestream get <meeting-id>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtimekit meetings participants get <participant-id>` — Returns a participant details for the given meeting and participant ID.\n- `cf realtimekit meetings participants list` — Returns all participants detail for the given meeting ID.\n- `cf realtimekit presets get <preset-id>` — Fetches details of a preset using the provided preset ID\n- `cf realtimekit presets list` — Fetches all the presets belonging to an App.\n- `cf realtimekit recordings active get <meeting-id>` — Returns the active recording details for the given meeting ID.\n- `cf realtimekit recordings get <recording-id>` — Returns details of a recording for the given recording ID.\n- `cf realtimekit recordings list` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID.\n- `cf realtimekit sessions chat export <session-id>` — Returns a URL to download all chat messages of the session ID in CSV format.\n- `cf realtimekit sessions get <session-id>` — Returns data of the given session ID including recording details.\n- `cf realtimekit sessions list` — Returns details of all sessions of an App.\n- `cf realtimekit sessions livestreams get <session-id>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtimekit sessions participants get <participant-id>` — Returns details of the given participant ID along with call statistics for the given session ID.\n- `cf realtimekit sessions participants list` — Returns a list of participants for the given session ID.\n- `cf realtimekit sessions peers get <peer-id>` — Returns participant details for the given peer ID along with call statistics.\n- `cf realtimekit sessions summaries export <session-id>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text.\n- `cf realtimekit sessions transcripts export <session-id>` — Returns a URL to download the transcript for the session ID in CSV format.\n- `cf realtimekit webhooks events list` — Returns the list of webhook event names supported by RealtimeKit.\n- `cf realtimekit webhooks get <webhook-id>` — Returns webhook details for the given webhook ID.\n- `cf realtimekit webhooks list` — Returns details of all webhooks for an App.\n\n### Create Operations\n\n- `cf realtimekit apps create` — Create new app for your account (supports --dry-run, --body)\n- `cf realtimekit livestreams create <app-id>` — Creates a livestream for the given App ID and returns ingest server, stream key, and playback URL. You can pass custom input to the ingest server and stream key, and freely distribute the content using the playback URL on any player that supports HLS/LHLS. (supports --dry-run, --body)\n- `cf realtimekit meetings active polls create <meeting-id>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings create <app-id>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants create <meeting-id>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets create <app-id>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n- `cf realtimekit webhooks create <app-id>` — Adds a new webhook to an App. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtimekit meetings participants update <participant-id>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings update <meeting-id>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets update <preset-id>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n- `cf realtimekit webhooks update <webhook-id>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtimekit meetings participants delete <participant-id>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit presets delete <preset-id>` — Deletes a preset using the provided preset ID (supports --dry-run)\n- `cf realtimekit webhooks delete <webhook-id>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n\n### Other Operations\n\n- `cf realtimekit livestreams sessions list-active <livestream-id>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtimekit livestreams start <meeting-id>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtimekit livestreams stop <meeting-id>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run)\n- `cf realtimekit meetings active kick <meeting-id>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active kick-all <meeting-id>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings active mute <meeting-id>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active mute-all <meeting-id>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings livestream list-active <meeting-id>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings participants replace <participant-id>` — Replaces a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants tokens refresh <participant-id>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit meetings replace <meeting-id>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets replace <preset-id>` — Replace all details for the preset using the provided preset ID. (supports --dry-run, --body)\n- `cf realtimekit recordings control <recording-id>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtimekit recordings start <app-id>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtimekit recordings tracks start <app-id>` — Starts track recording for a meeting. Track recording currently records separate participant audio tracks as WebM files in the RealtimeKit bucket. Video track recording is in development. For more information, refer to [Track recording](/realtime/realtimekit/recording-guide/track-recording/). (supports --dry-run, --body)\n- `cf realtimekit sessions summaries generate <session-id>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtimekit webhooks replace <webhook-id>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"realtimekit": "# realtimekit — SDK-backed meetings, participants, recordings, livestreams, and webhooks\n\n## Commands\n\n### Read Operations\n\n- `cf realtimekit analytics livestreams daily get <app-id>` — Returns day-wise livestream analytics for the specified time range.\n- `cf realtimekit analytics livestreams get <app-id>` — Returns livestream analytics for the specified time range.\n- `cf realtimekit analytics usage get <app-id>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date.\n- `cf realtimekit apps get <app-id>` — Fetch details for an app in your account.\n- `cf realtimekit apps list` — Fetch all apps for your account\n- `cf realtimekit livestreams get <livestream-id>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API.\n- `cf realtimekit livestreams list` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter.\n- `cf realtimekit livestreams sessions get <livestream-session-id>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API.\n- `cf realtimekit meetings active get <meeting-id>` — Returns details of an ongoing active session for the given meeting ID.\n- `cf realtimekit meetings get <meeting-id>` — Returns a meeting details in an App for the given meeting ID.\n- `cf realtimekit meetings list` — Returns all meetings for the given App ID.\n- `cf realtimekit meetings livestream get <meeting-id>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtimekit meetings participants get <participant-id>` — Returns a participant details for the given meeting and participant ID.\n- `cf realtimekit meetings participants list` — Returns all participants detail for the given meeting ID.\n- `cf realtimekit presets get <preset-id>` — Fetches details of a preset using the provided preset ID\n- `cf realtimekit presets list` — Fetches all the presets belonging to an App.\n- `cf realtimekit recordings active get <meeting-id>` — Returns the active recording details for the given meeting ID.\n- `cf realtimekit recordings get <recording-id>` — Returns details of a recording for the given recording ID.\n- `cf realtimekit recordings list` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID.\n- `cf realtimekit sessions chat export <session-id>` — Returns a URL to download all chat messages of the session ID in CSV format.\n- `cf realtimekit sessions get <session-id>` — Returns data of the given session ID including recording details.\n- `cf realtimekit sessions list` — Returns details of all sessions of an App.\n- `cf realtimekit sessions livestreams get <session-id>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtimekit sessions participants get <participant-id>` — Returns details of the given participant ID along with call statistics for the given session ID.\n- `cf realtimekit sessions participants list` — Returns a list of participants for the given session ID.\n- `cf realtimekit sessions peers get <peer-id>` — Returns participant details for the given peer ID along with call statistics.\n- `cf realtimekit sessions summaries export <session-id>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text.\n- `cf realtimekit sessions transcripts export <session-id>` — Returns a URL to download the transcript for the session ID in CSV format.\n- `cf realtimekit webhooks events list` — Returns the list of webhook event names supported by RealtimeKit.\n- `cf realtimekit webhooks get <webhook-id>` — Returns webhook details for the given webhook ID.\n- `cf realtimekit webhooks list` — Returns details of all webhooks for an App.\n\n### Create Operations\n\n- `cf realtimekit apps create` — Create new app for your account (supports --dry-run, --body)\n- `cf realtimekit meetings active polls create <meeting-id>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings create <app-id>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants create <meeting-id>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets create <app-id>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n- `cf realtimekit webhooks create <app-id>` — Adds a new webhook to an App. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtimekit meetings participants update <participant-id>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings update <meeting-id>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets update <preset-id>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n- `cf realtimekit webhooks update <webhook-id>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtimekit meetings participants delete <participant-id>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit presets delete <preset-id>` — Deletes a preset using the provided preset ID (supports --dry-run)\n- `cf realtimekit webhooks delete <webhook-id>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n\n### Other Operations\n\n- `cf realtimekit livestreams sessions list-active <livestream-id>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtimekit livestreams start <meeting-id>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtimekit livestreams stop <meeting-id>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run)\n- `cf realtimekit meetings active kick <meeting-id>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active kick-all <meeting-id>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings active mute <meeting-id>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active mute-all <meeting-id>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings livestream list-active <meeting-id>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings participants replace <participant-id>` — Replaces a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants tokens refresh <participant-id>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit meetings replace <meeting-id>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets replace <preset-id>` — Replace all details for the preset using the provided preset ID. (supports --dry-run, --body)\n- `cf realtimekit recordings control <recording-id>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtimekit recordings start <app-id>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtimekit recordings tracks start <app-id>` — Starts track recording for a meeting. Track recording currently records separate participant audio tracks as WebM files in the RealtimeKit bucket. Video track recording is in development. For more information, refer to [Track recording](/realtime/realtimekit/recording-guide/track-recording/). (supports --dry-run, --body)\n- `cf realtimekit sessions summaries generate <session-id>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtimekit webhooks replace <webhook-id>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"recent-submissions": "# recent-submissions — recent-submissions\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"refute": "# refute — refute\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"registrar": "# registrar — registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar extensions get <extension>` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar extensions list` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar registrations get <domain-name>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create [domain-name]` — Register a domain. Billable and non-refundable — a successful registration charges the account's default payment method. Input fields are extension-specific: they come from the extension's registration schema (`GET /registrar/extensions/{name}`) at run time, so run `cf registrar registrations create <domain> --help` to list the fields for that domain's extension, or pass a complete payload with --body. Required fields are prompted for interactively. Check availability and pricing first with `cf registrar domain-check`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domain-name>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar registrations check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar registrations get-registration-status <domain-name>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domain-name>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n- `cf registrar registrations search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -136,14 +136,14 @@
 		"resource-sharing": "# resource-sharing — Share Cloudflare resources (zones, accounts) across organizations with granular access controls\n\n## Commands\n\n### Read Operations\n\n- `cf resource-sharing excluded-recipients get <excluded-recipient-id>` — Gets a single excluded recipient of a share by its identifier tag.\n- `cf resource-sharing excluded-recipients list` — Lists the accounts excluded from an organization-targeted share. Only valid for shares with `target_type=organization`.\n\n### Create Operations\n\n- `cf resource-sharing excluded-recipients create <share-id>` — Excludes a single account from an organization-targeted share. The share continues to target the entire organization, but the excluded account is skipped during reconciliation. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf resource-sharing excluded-recipients update <share-id>` — Reconciles a share's excluded recipients to match the given list. Only valid for shares with `target_type=organization`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf resource-sharing excluded-recipients delete <excluded-recipient-id>` — Removes a single account from a share's excluded-recipient list. The account becomes eligible to receive the share again on the next reconciliation cycle. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"resource-tagging": "# resource-tagging — resource-tagging\n\n## Commands\n\n### Read Operations\n\n- `cf resource-tagging summary get` — Lists all distinct tag keys and their distinct values across resources in an account.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rules": "# rules — Account-level IP lists, hostname lists, and other reusable lists referenced by firewall rules and rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rules lists bulk-operations get <operation-id>` — Gets the current status of an asynchronous operation on a list. The `status` property can have one of the following values: `pending`, `running`, `completed`, or `failed`. If the status is `failed`, the `error` property will contain a message describing the error.\n- `cf rules lists get <list-id>` — Fetches the details of a list.\n- `cf rules lists items get <item-id>` — Fetches a list item in the list.\n- `cf rules lists items list` — Fetches all the items in the list.\n- `cf rules lists list` — Fetches all lists in the account.\n\n### Create Operations\n\n- `cf rules lists create` — Creates a new list of the specified kind. (supports --dry-run, --body)\n- `cf rules lists items create <list-id>` — Appends new items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rules lists items update <list-id>` — Removes all existing items from the list and adds the provided items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n- `cf rules lists update <list-id>` — Updates the description of a list. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rules lists delete <list-id>` — Deletes a specific list and all its items. (supports --dry-run)\n- `cf rules lists items delete <list-id>` — Removes one or more items from a list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"rulesets": "# rulesets — rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rulesets account-rulesets get <ruleset-id>` — Fetches the latest version of an account ruleset.\n- `cf rulesets account-rulesets list` — Fetches all rulesets at the account level.\n- `cf rulesets account-rulesets phases get <ruleset-phase>` — Fetches the latest version of the account entry point ruleset for a given phase.\n- `cf rulesets account-rulesets phases versions get <ruleset-version>` — Fetches a specific version of an account entry point ruleset.\n- `cf rulesets account-rulesets phases versions list` — Fetches the versions of an account entry point ruleset.\n- `cf rulesets account-rulesets versions by-tag list` — Fetches the rules of a managed account ruleset version for a given tag.\n- `cf rulesets account-rulesets versions get <ruleset-version>` — Fetches a specific version of an account ruleset.\n- `cf rulesets account-rulesets versions list` — Fetches the versions of an account ruleset.\n- `cf rulesets get <ruleset-id>` — Fetches the latest version of a zone ruleset.\n- `cf rulesets list` — Fetches all rulesets at the zone level.\n- `cf rulesets phases get <ruleset-phase>` — Fetches the latest version of the zone entry point ruleset for a given phase.\n- `cf rulesets phases versions get <ruleset-version>` — Fetches a specific version of a zone entry point ruleset.\n- `cf rulesets phases versions list` — Fetches the versions of a zone entry point ruleset.\n- `cf rulesets versions get <ruleset-version>` — Fetches a specific version of a zone ruleset.\n- `cf rulesets versions list` — Fetches the versions of a zone ruleset.\n\n### Create Operations\n\n- `cf rulesets account-rulesets create` — Creates a ruleset at the account level. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules create <ruleset-id>` — Adds a new rule to an account ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n- `cf rulesets create` — Creates a ruleset at the zone level. (supports --dry-run, --body)\n- `cf rulesets rules create <ruleset-id>` — Adds a new rule to a zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rulesets account-rulesets phases update <ruleset-phase>` — Updates an account entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules update <rule-id>` — Updates an existing rule in an account ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets update <ruleset-id>` — Updates an account ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets phases update <ruleset-phase>` — Updates a zone entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets rules update <rule-id>` — Updates an existing rule in a zone ruleset. (supports --dry-run, --body)\n- `cf rulesets update <ruleset-id>` — Updates a zone ruleset, creating a new version. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rulesets account-rulesets delete <ruleset-id>` — Deletes all versions of an existing account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets rules delete <rule-id>` — Deletes an existing rule from an account ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets versions delete <ruleset-version>` — Deletes an existing version of an account ruleset. (supports --dry-run)\n- `cf rulesets delete <ruleset-id>` — Deletes all versions of an existing zone ruleset. (supports --dry-run)\n- `cf rulesets rules delete <rule-id>` — Deletes an existing rule from a zone ruleset. (supports --dry-run)\n- `cf rulesets versions delete <ruleset-version>` — Deletes an existing version of a zone ruleset. (supports --dry-run)\n\n### Other Operations\n\n- `cf rulesets account-rulesets versions zone-by-tag tag <rule-tag>` — Fetches the rules of a managed zone ruleset version for a given tag. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"rulesets": "# rulesets — rulesets\n\n## Commands\n\n### Read Operations\n\n- `cf rulesets account-rulesets get <ruleset-id>` — Fetches the latest version of an account or zone ruleset.\n- `cf rulesets account-rulesets list` — Fetches all rulesets.\n- `cf rulesets account-rulesets phases get <ruleset-phase>` — Fetches the latest version of the account or zone entry point ruleset for a given phase.\n- `cf rulesets account-rulesets phases versions get <ruleset-version>` — Fetches a specific version of an account or zone entry point ruleset.\n- `cf rulesets account-rulesets phases versions list` — Fetches the versions of an account or zone entry point ruleset.\n- `cf rulesets account-rulesets versions by-tag list` — Fetches the rules of a managed account or zone ruleset version for a given tag.\n- `cf rulesets account-rulesets versions get <ruleset-version>` — Fetches a specific version of an account or zone ruleset.\n- `cf rulesets account-rulesets versions list` — Fetches the versions of an account or zone ruleset.\n\n### Create Operations\n\n- `cf rulesets account-rulesets create` — Creates a ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules create <ruleset-id>` — Adds a new rule to an account or zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rulesets account-rulesets phases update <ruleset-phase>` — Updates an account or zone entry point ruleset, creating a new version. (supports --dry-run, --body)\n- `cf rulesets account-rulesets rules update <rule-id>` — Updates an existing rule in an account or zone ruleset. (supports --dry-run, --body)\n- `cf rulesets account-rulesets update <ruleset-id>` — Updates an account or zone ruleset, creating a new version. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rulesets account-rulesets delete <ruleset-id>` — Deletes all versions of an existing account or zone ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets rules delete <rule-id>` — Deletes an existing rule from an account or zone ruleset. (supports --dry-run)\n- `cf rulesets account-rulesets versions delete <ruleset-version>` — Deletes an existing version of an account or zone ruleset. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"rum": "# rum — Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics\n\n## Commands\n\n### Read Operations\n\n- `cf rum rules list` — Lists all the rules in a Web Analytics ruleset.\n- `cf rum site-info get <site-id>` — Retrieves a Web Analytics site.\n- `cf rum site-info list` — Lists all Web Analytics sites of an account.\n\n### Create Operations\n\n- `cf rum rules create <ruleset-id>` — Creates a new rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info create` — Creates a new Web Analytics site. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rum rules update <rule-id>` — Updates a rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info update <site-id>` — Updates an existing Web Analytics site. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rum rules delete <rule-id>` — Deletes an existing rule from a Web Analytics ruleset. (supports --dry-run)\n- `cf rum site-info delete <site-id>` — Deletes an existing Web Analytics site. (supports --dry-run)\n\n### Other Operations\n\n- `cf rum rules bulk-create` — Modifies one or more rules in a Web Analytics ruleset with a single request. (supports --dry-run, --body)\n- `cf rum site-info list-site-tags` — Returns all site tags for an account as an array of site tag strings. This endpoint returns all results without pagination. (supports --dry-run)\n- `cf rum site-info list-zone-tags` — Returns all zone tags associated with Web Analytics sites for an account. These can be used to filter or exclude zones in the zone selection input. This endpoint returns all results without pagination. (supports --dry-run)\n- `cf rum site-info validate-hostname <hostname>` — Validates that the provided hostname is well-formed, does not contain wildcards, and has a valid TLD. Returns an empty result on success. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scan-logo": "# scan-logo — scan-logo\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scan-page": "# scan-page — scan-page\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scim": "# scim — SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account\n\n## Commands\n\n### Read Operations\n\n- `cf scim groups get <group-id>` — Retrieves a single SCIM Group resource by group ID.\n- `cf scim groups list` — Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.\n- `cf scim resource-types get <resource-type-id>` — Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.\n- `cf scim resource-types list` — Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.\n- `cf scim schemas get <schema-id>` — Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.\n- `cf scim schemas list` — Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.\n- `cf scim service-provider-config get` — Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.\n- `cf scim users get <user-id>` — Retrieves a single account member as a SCIM User resource by user tag.\n- `cf scim users list` — Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq \"user@example.com\"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.\n\n### Create Operations\n\n- `cf scim groups create` — Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups). (supports --dry-run, --body)\n- `cf scim users create` — Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf scim groups edit <group-id>` — Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported. (supports --dry-run, --body)\n- `cf scim users edit <user-id>` — Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq \"work\"].value` is also accepted as an alias for `userName`. (supports --dry-run, --body)\n- `cf scim users update <user-id>` — Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf scim groups delete <group-id>` — Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success. (supports --dry-run)\n- `cf scim users delete <user-id>` — Deprovisions a SCIM User by removing their membership from this account (RFC 7644 Section 3.6). This does not delete the global Cloudflare user. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"search": "# search — search\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"secrets-store": "# secrets-store — Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products\n\n## Commands\n\n### Read Operations\n\n- `cf secrets-store quota get` — Lists the number of secrets used in the account.\n- `cf secrets-store secrets get <secret-id>` — Returns details of a single secret.\n- `cf secrets-store secrets list` — Lists all store secrets.\n- `cf secrets-store stores list` — Lists all the stores in an account.\n\n### Create Operations\n\n- `cf secrets-store secrets bulk create <store-id>` — Creates a secret in the account. (supports --dry-run, --body)\n- `cf secrets-store stores create` — Creates a store in the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf secrets-store secrets edit <secret-id>` — Updates a single secret. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf secrets-store secrets bulk delete <store-id>` — Deletes one or more secrets. (supports --dry-run, --body)\n- `cf secrets-store secrets delete <secret-id>` — Deletes a single secret. (supports --dry-run)\n- `cf secrets-store stores delete <store-id>` — Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the \"store_not_empty\" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter. (supports --dry-run)\n\n### Other Operations\n\n- `cf secrets-store secrets duplicate <secret-id>` — Creates a duplicate of the secret, keeping the value. (supports --dry-run, --body)\n- `cf secrets-store system-stores get by id <store-id>` — Returns details of a single store. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"security-center": "# security-center — Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-center audit-logs get <issue-id>` — Lists audit log entries for a specific Security Center insight, showing changes to its status and classification over time.\n- `cf security-center audit-logs list` — Lists audit log entries for all Security Center insights in the account, showing changes to insight status and classification.\n- `cf security-center insights class get` — Retrieves Security Center insight counts aggregated by classification class.\n- `cf security-center insights list` — Lists all Security Center insights for the account, showing security findings and recommendations.\n- `cf security-center insights severity get` — Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).\n- `cf security-center insights type get` — Retrieves Security Center insight counts aggregated by insight type.\n- `cf security-center scans list` — Returns the most recent on-demand scans for the account, up to a maximum of 5. Each scan includes its ID, start time, and current status. This includes both account-wide and zone-scoped scans. Also returns quota information showing how many scans have been used and how many remain in the current 24-hour window.\n- `cf security-center state get` — Returns account-level Security Center state: whether scans are enabled for the account and whether the account was recently reactivated from a dormant state.\n- `cf security-center zone-audit-logs get <issue-id>` — Lists audit log entries for a specific Security Center insight within a zone, showing changes to its status and classification over time.\n- `cf security-center zone-audit-logs list` — Lists audit log entries for all Security Center insights in a specific zone, showing changes to insight status and classification.\n- `cf security-center zone-insights class get` — Retrieves zone-specific Security Center insight counts aggregated by classification class.\n- `cf security-center zone-insights context get <issue-id>` — Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.\n- `cf security-center zone-insights get` — Lists Security Center insights for a specific zone, showing zone-level security findings.\n- `cf security-center zone-insights severity get` — Retrieves zone-specific Security Center insight counts aggregated by severity level.\n- `cf security-center zone-insights type get` — Retrieves zone-specific Security Center insight counts aggregated by insight type.\n- `cf security-center zone-scans list` — Returns the most recent on-demand scans for a specific zone, up to a maximum of 5. Each scan includes its ID, start time, and current status. Results include both zone-specific scans and account-wide scans (which cover all zones). Also returns quota information showing how many scans have been used and how many remain in the current 24-hour window.\n\n### Update Operations\n\n- `cf security-center state update` — Updates account-level Security Center state. Currently supports enabling or disabling scans for the account. Returns the account's state after the update. (supports --dry-run, --body)\n- `cf security-center zone-insights dismiss update <issue-id>` — Archives a zone-specific Security Center insight, removing it from the active zone insights while preserving historical data. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf security-center insights dismiss <issue-id>` — Archives a Security Center insight for an account, removing it from the active insights list while preserving historical data. (supports --dry-run, --body)\n- `cf security-center insights update-classification <issue-id>` — Updates the user classification for a Security Center insight. Valid values are 'false_positive' or 'accept_risk'. To reset, set classification to null. Cannot change directly between classification values - must reset to null first. (supports --dry-run, --body)\n- `cf security-center scans start` — Initiates an on-demand security scan for the entire account, scanning all zones associated with the account. Rate limited to 5 scans per account per 24-hour window. (supports --dry-run, --body)\n- `cf security-center zone-insights update-classification <issue-id>` — Updates the user classification for a zone-specific Security Center insight. Valid values are 'false_positive' or 'accept_risk'. To reset, set classification to null. Cannot change directly between classification values - must reset to null first. (supports --dry-run, --body)\n- `cf security-center zone-scans start` — Initiates an on-demand security scan for a specific zone. Rate limited to 5 scans per account per 24-hour window (shared with account-level scans). (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"security-center": "# security-center — Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-center audit-logs get <issue-id>` — Lists audit log entries for a specific Security Center insight, showing changes to its status and classification over time.\n- `cf security-center audit-logs list` — Lists audit log entries for all Security Center insights in the account or zone, showing changes to insight status and classification.\n- `cf security-center insights class get` — Retrieves Security Center insight counts aggregated by classification class.\n- `cf security-center insights list` — Lists all Security Center insights for the account or zone, showing security findings and recommendations.\n- `cf security-center insights severity get` — Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).\n- `cf security-center insights type get` — Retrieves Security Center insight counts aggregated by insight type.\n- `cf security-center scans list` — Returns the most recent on-demand scans for the account or zone, up to a maximum of 5. Each scan includes its ID, start time, and current status. This includes both account or zone-wide and zone-scoped scans. Also returns quota information showing how many scans have been used and how many remain in the current 24-hour window.\n- `cf security-center state get` — Returns account-level Security Center state: whether scans are enabled for the account and whether the account was recently reactivated from a dormant state.\n- `cf security-center zone-insights context get <issue-id>` — Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.\n\n### Update Operations\n\n- `cf security-center state update` — Updates account-level Security Center state. Currently supports enabling or disabling scans for the account. Returns the account's state after the update. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf security-center insights dismiss <issue-id>` — Archives a Security Center insight for an account or zone, removing it from the active insights list while preserving historical data. (supports --dry-run, --body)\n- `cf security-center insights update-classification <issue-id>` — Updates the user classification for a Security Center insight. Valid values are 'false_positive' or 'accept_risk'. To reset, set classification to null. Cannot change directly between classification values - must reset to null first. (supports --dry-run, --body)\n- `cf security-center scans start` — Initiates an on-demand security scan for the entire account or zone, scanning all zones associated with the account or zone. Rate limited to 5 scans per account or zone per 24-hour window. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"security-txt": "# security-txt — Manage the /.well-known/security.txt file that tells security researchers how to report vulnerabilities\n\n## Commands\n\n### Read Operations\n\n- `cf security-txt get` — Retrieves the current security.txt file configuration for a zone, used for security vulnerability reporting.\n\n### Update Operations\n\n- `cf security-txt update` — Updates the security.txt file configuration for a zone, which provides security researchers with vulnerability reporting information. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf security-txt delete` — Removes the security.txt file configuration for a zone. The /.well-known/security.txt endpoint will no longer be served. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"share": "# share — share\n\n## Commands\n\n### Read Operations\n\n- `cf share get <share-id>` — Fetches share by ID.\n- `cf share list` — Lists all account shares.\n- `cf share recipient get <recipient-id>` — Get share recipient by ID.\n- `cf share recipient list` — List share recipients by share ID. Returns **all** recipients regardless of their `association_status` (associating, associated, disassociating, disassociated). Callers that want only \"active\" recipients must filter client-side on the `association_status` field.\n- `cf share resource get <share-resource-id>` — Get share resource by ID.\n- `cf share resource list` — List share resources by share ID.\n\n### Create Operations\n\n- `cf share create` — Creates a new resource share for sharing Cloudflare resources with other accounts or organizations. (supports --dry-run, --body)\n- `cf share recipient create <share-id>` — Adds a single recipient to an account-targeted resource share, granting them access to the shared resources. The recipient account must belong to the same organization as the share owner. To replace the entire recipient list in one call, use `PUT /accounts/{account_id}/shares/{share_id}/recipients` instead. (supports --dry-run, --body)\n- `cf share resource create <share-id>` — Adds a resource to an existing share, making it available to share recipients. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf share recipient update <share-id>` — Replaces the full recipient list for an account-targeted share. The server computes the diff between the current and desired recipients: new accounts are added, accounts no longer in the list are marked for disassociation, and unchanged accounts are left as-is. Returns an error if the share targets an organization (`target_type=organization`); org-targeted shares derive their recipients dynamically from org membership and cannot be modified through this endpoint. (supports --dry-run, --body)\n- `cf share resource update <share-resource-id>` — Update is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run, --body)\n- `cf share update <share-id>` — Updates the share's display name and tags. This endpoint does **not** modify recipients or resources — those are managed via dedicated subresource endpoints: - **Recipients**: Use `POST /accounts/{account_id}/shares/{share_id}/recipients` to add a single recipient, `PUT /accounts/{account_id}/shares/{share_id}/recipients` to replace the full recipient list, or `DELETE /accounts/{account_id}/shares/{share_id}/recipients/{recipient_id}` to remove a recipient. - **Resources**: Use the share's resource subresource endpoints. Updating is not immediate; an updated share object with a new status will be returned. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf share delete <share-id>` — Deletion is not immediate, an updated share object with a new status will be returned. (supports --dry-run)\n- `cf share recipient delete <recipient-id>` — Performs a **soft delete**: sets the recipient's `desired_association_status` to `disassociated`, which signals the background reconciliation workflow (Temporal) to remove the shared resources from the recipient account. The recipient record remains in the database for audit purposes and is still returned by `GET /accounts/{account_id}/shares/{share_id}/recipients` with its updated status. Resource access is not fully removed until the workflow completes and `current_association_status` transitions to `disassociated`. The recipient record itself is never physically deleted. (supports --dry-run)\n- `cf share resource delete <share-resource-id>` — Deletion is not immediate, an updated share resource object with a new status will be returned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"signed-url": "# signed-url — signed-url\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -162,7 +162,7 @@
 		"tracked-domains": "# tracked-domains — tracked-domains\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tunnel": "# tunnel — tunnel\n\n## Commands\n\n### Read Operations\n\n- `cf tunnel config get <tunnel-id>` — Retrieves the configuration for a remotely managed Cloudflare Tunnel.\n- `cf tunnel connections list` — Lists the connections for a Cloudflare Tunnel, including connector IDs, cloudflared versions, and Cloudflare locations.\n- `cf tunnel connectors get <connector-id>` — Retrieves a connector and its connection details for a Cloudflare Tunnel, including its cloudflared version, architecture, and connected Cloudflare locations.\n- `cf tunnel get <tunnel-id>` — Fetches a single Cloudflare Tunnel.\n- `cf tunnel list` — Lists and filters Cloudflare Tunnels in an account.\n- `cf tunnel token get <tunnel-id>` — Retrieves the token used to run cloudflared and associate it with a specific Cloudflare Tunnel. Treat the token as a secret.\n\n### Create Operations\n\n- `cf tunnel create` — Creates a remotely or locally managed Cloudflare Tunnel in an account. After creation, retrieve its token and run cloudflared to establish the connector connection. (supports --dry-run, --body)\n- `cf tunnel management token create <tunnel-id>` — Creates a short-lived management token for the requested Tunnel management resources, such as streaming logs. Treat the token as a secret. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf tunnel config update <tunnel-id>` — Replaces the configuration for a remotely managed Cloudflare Tunnel, including its ingress rules and origin request settings. (supports --dry-run, --body)\n- `cf tunnel edit <tunnel-id>` — Updates the name or secret of an existing Cloudflare Tunnel. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf tunnel delete <tunnel-id>` — Permanently deletes a Cloudflare Tunnel from an account. The tunnel must have no active connections. (supports --dry-run)\n\n### Other Operations\n\n- `cf tunnel connections cleanup <tunnel-id>` — Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tunnels": "# tunnels — tunnels\n\n## Commands\n\n### Read Operations\n\n- `cf tunnels list` — Lists and filters all types of Tunnels in an account.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"turnstile": "# turnstile — turnstile\n\n## Commands\n\n### Read Operations\n\n- `cf turnstile widgets get <sitekey>` — Show a single challenge widget configuration.\n- `cf turnstile widgets list` — Lists all turnstile widgets of an account.\n\n### Create Operations\n\n- `cf turnstile widgets create` — Lists challenge widgets. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf turnstile widgets update <sitekey>` — Update the configuration of a widget. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf turnstile widgets delete <sitekey>` — Destroy a Turnstile Widget. (supports --dry-run)\n\n### Other Operations\n\n- `cf turnstile widgets rotate-secret <sitekey>` — Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"turnstile": "# turnstile — CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience\n\n## Commands\n\n### Read Operations\n\n- `cf turnstile widgets get <sitekey>` — Show a single challenge widget configuration.\n- `cf turnstile widgets list` — Lists all turnstile widgets of an account.\n\n### Create Operations\n\n- `cf turnstile widgets create` — Lists challenge widgets. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf turnstile widgets update <sitekey>` — Update the configuration of a widget. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf turnstile widgets delete <sitekey>` — Destroy a Turnstile Widget. (supports --dry-run)\n\n### Other Operations\n\n- `cf turnstile widgets rotate-secret <sitekey>` — Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-info": "# url-info — url-info\n\n## Commands\n\n### Read Operations\n\n- `cf url-info get` — Return submitted URLs based on ID\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-normalization": "# url-normalization — url-normalization\n\n## Commands\n\n### Read Operations\n\n- `cf url-normalization get` — Fetches the current URL Normalization settings.\n\n### Update Operations\n\n- `cf url-normalization update` — Updates the URL Normalization settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf url-normalization delete` — Deletes the URL Normalization settings. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"url-scanner": "# url-scanner — Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results\n\n## Commands\n\n### Read Operations\n\n- `cf url-scanner responses get <response-id>` — Returns the raw response of the network request. Find the `response_id` in the `data.requests.response.hash`.\n- `cf url-scanner scans get <scan-id>` — Get URL scan by uuid\n- `cf url-scanner scans list` — Use a subset of ElasticSearch Query syntax to filter scans. Some example queries:<br/> <br/>- 'path:\"/bundles/jquery.js\"': Searches for scans who requested resources with the given path.<br/>- 'page.asn:AS24940 AND hash:xxx': Websites hosted in AS24940 where a resource with the given hash was downloaded.<br/>- 'page.domain:microsoft* AND verdicts.malicious:true AND NOT page.domain:microsoft.com': malicious scans whose hostname starts with \"microsoft\".<br/>- 'apikey:me AND date:[2025-01 TO 2025-02]': my scans from 2025 January to 2025 February.\n\n### Create Operations\n\n- `cf url-scanner scans create` — Submit a URL to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf url-scanner scans bulk-create` — Submit URLs to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/ and take into account scans submitted in bulk have lower priority and may take longer to finish. (supports --dry-run, --body)\n- `cf url-scanner scans dom <scan-id>` — Returns a plain text response, with the scan's DOM content as rendered by Chrome. (supports --dry-run)\n- `cf url-scanner scans har <scan-id>` — Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/. (supports --dry-run)\n- `cf url-scanner scans screenshot <scan-id>` — Get scan's screenshot by resolution (desktop/mobile/tablet). (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -170,16 +170,15 @@
 		"values": "# values — values\n\n## Commands\n\n### Read Operations\n\n- `cf values list` — Lists all distinct values for a given tag key, optionally filtered by resource type.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"vectorize": "# vectorize — vectorize\n\n## Commands\n\n### Read Operations\n\n- `cf vectorize get <index-name>` — Returns the specified Vectorize Index.\n- `cf vectorize info <index-name>` — Get information about a vectorize index.\n- `cf vectorize list` — Returns a list of Vectorize Indexes\n- `cf vectorize metadata-index list` — List Metadata Indexes for the specified Vectorize Index.\n\n### Create Operations\n\n- `cf vectorize create` — Creates and returns a new Vectorize Index. (supports --dry-run, --body)\n- `cf vectorize metadata-index create <index-name>` — Enable metadata filtering based on metadata property. Limited to 10 properties. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf vectorize delete <index-name>` — Deletes the specified Vectorize Index. (supports --dry-run)\n- `cf vectorize metadata-index delete <index-name>` — Allow Vectorize to delete the specified metadata index. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf vectorize delete-by-ids <index-name>` — Delete a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize get-by-ids <index-name>` — Get a set of vectors from an index by their vector identifiers. (supports --dry-run, --body)\n- `cf vectorize insert <index-name>` — Inserts vectors into the specified index and returns a mutation id corresponding to the vectors enqueued for insertion. (supports --dry-run, --body)\n- `cf vectorize list-vectors <index-name>` — Returns a paginated list of vector identifiers from the specified index. (supports --dry-run)\n- `cf vectorize query <index-name>` — Finds vectors closest to a given vector in an index. (supports --dry-run, --body)\n- `cf vectorize upsert <index-name>` — Upserts vectors into the specified index, creating them if they do not exist and returns a mutation id corresponding to the vectors enqueued for upsertion. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"verify": "# verify — verify\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"waiting-rooms": "# waiting-rooms — Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages\n\n## Commands\n\n### Read Operations\n\n- `cf waiting-rooms account-waiting-rooms list` — Lists waiting rooms for account.\n- `cf waiting-rooms events details get <event-id>` — Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.\n- `cf waiting-rooms events get <event-id>` — Fetches a single configured event for a waiting room.\n- `cf waiting-rooms events list` — Lists events for a waiting room.\n- `cf waiting-rooms get <waiting-room-id>` — Fetches a single configured waiting room.\n- `cf waiting-rooms list` — Lists waiting rooms for zone.\n- `cf waiting-rooms rules get <waiting-room-id>` — Lists rules for a waiting room.\n- `cf waiting-rooms settings get` — Get zone-level Waiting Room settings.\n- `cf waiting-rooms statuses get <waiting-room-id>` — Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.\n\n### Create Operations\n\n- `cf waiting-rooms create` — Creates a new waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time. (supports --dry-run, --body)\n- `cf waiting-rooms rules create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf waiting-rooms edit <waiting-room-id>` — Patches a configured waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events edit <event-id>` — Patches a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events update <event-id>` — Updates a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules edit <rule-id>` — Patches a rule for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules update <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms settings edit` — Patch zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms settings update` — Replace zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms update <waiting-room-id>` — Updates a configured waiting room. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf waiting-rooms delete <waiting-room-id>` — Deletes a waiting room. (supports --dry-run)\n- `cf waiting-rooms events delete <event-id>` — Deletes an event for a waiting room. (supports --dry-run)\n- `cf waiting-rooms rules delete <rule-id>` — Deletes a rule for a waiting room. (supports --dry-run)\n\n### Other Operations\n\n- `cf waiting-rooms page preview` — Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \\\"Welcome\\\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"waiting-rooms": "# waiting-rooms — Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages\n\n## Commands\n\n### Read Operations\n\n- `cf waiting-rooms account-waiting-rooms list` — Lists waiting rooms for account or zone.\n- `cf waiting-rooms events details get <event-id>` — Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.\n- `cf waiting-rooms events get <event-id>` — Fetches a single configured event for a waiting room.\n- `cf waiting-rooms events list` — Lists events for a waiting room.\n- `cf waiting-rooms get <waiting-room-id>` — Fetches a single configured waiting room.\n- `cf waiting-rooms rules get <waiting-room-id>` — Lists rules for a waiting room.\n- `cf waiting-rooms settings get` — Get zone-level Waiting Room settings.\n- `cf waiting-rooms statuses get <waiting-room-id>` — Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.\n\n### Create Operations\n\n- `cf waiting-rooms create` — Creates a new waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time. (supports --dry-run, --body)\n- `cf waiting-rooms rules create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf waiting-rooms edit <waiting-room-id>` — Patches a configured waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events edit <event-id>` — Patches a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events update <event-id>` — Updates a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules edit <rule-id>` — Patches a rule for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules update <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms settings edit` — Patch zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms settings update` — Replace zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms update <waiting-room-id>` — Updates a configured waiting room. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf waiting-rooms delete <waiting-room-id>` — Deletes a waiting room. (supports --dry-run)\n- `cf waiting-rooms events delete <event-id>` — Deletes an event for a waiting room. (supports --dry-run)\n- `cf waiting-rooms rules delete <rule-id>` — Deletes a rule for a waiting room. (supports --dry-run)\n\n### Other Operations\n\n- `cf waiting-rooms page preview` — Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \\\"Welcome\\\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"web-assets": "# web-assets — web-assets\n\n## Commands\n\n### Read Operations\n\n- `cf web-assets discovery get` — Returns the latest API operations discovered from zone traffic, rendered as OpenAPI schemas.\n- `cf web-assets discovery operations get <discovery-id>` — Returns a discovered web or API operation by discovery ID.\n- `cf web-assets discovery operations list` — Returns the latest web and API operations discovered from zone traffic.\n- `cf web-assets labels list` — Returns all managed and user-defined labels available for web and API operations in the zone.\n- `cf web-assets labels managed get <name>` — Returns a managed label and the web and API operations associated with it.\n- `cf web-assets labels user get <name>` — Returns a user-defined label and the web and API operations associated with it.\n- `cf web-assets operations get <operation-id>` — Returns a web or API operation, including its schema validation settings and requested feature data.\n- `cf web-assets operations list` — Lists web and API operations tracked for the zone, including each operation's method, path, and feature configuration.\n- `cf web-assets schemas list` — Returns tracked web and API operations and their feature configuration rendered as OpenAPI schemas.\n\n### Create Operations\n\n- `cf web-assets operations create` — Creates one web or API operation. The host, method, and path are normalized; an existing matching operation is returned instead of duplicated. (supports --dry-run, --body)\n- `cf web-assets operations labels create <operation-id>` — Attaches one or more labels to a web or API operation. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web-assets discovery operations edit <discovery-id>` — Updates the state of a discovered web or API operation. (supports --dry-run, --body)\n- `cf web-assets labels managed operations update <name>` — Replaces the complete set of web and API operations attached to the managed label. (supports --dry-run, --body)\n- `cf web-assets labels user edit <name>` — Updates only the supplied fields on a user-defined label. (supports --dry-run, --body)\n- `cf web-assets labels user operations update <name>` — Replaces the complete set of web and API operations attached to the user-defined label. (supports --dry-run, --body)\n- `cf web-assets labels user update <name>` — Replaces all editable fields on a user-defined label. (supports --dry-run, --body)\n- `cf web-assets operations labels update <operation-id>` — Replaces the complete label set on a web or API operation. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web-assets labels user delete <name>` — Deletes a user-defined label and removes its associations with web and API operations. (supports --dry-run)\n- `cf web-assets operations delete <operation-id>` — Deletes a web or API operation from endpoint management so its feature configuration is no longer tracked. (supports --dry-run)\n- `cf web-assets operations labels delete <operation-id>` — Removes one or more labels from a web or API operation. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf web-assets discovery operations bulk-edit` — Updates the state of one or more discovered web and API operations. (supports --dry-run, --body)\n- `cf web-assets labels user bulk-create` — Creates one or more user-defined labels for classifying web and API operations. (supports --dry-run, --body)\n- `cf web-assets labels user bulk-delete` — Deletes one or more user-defined labels and removes their associations with web and API operations. (supports --dry-run, --body)\n- `cf web-assets operations bulk-create` — Creates one or more web or API operations. Hosts, methods, and paths are normalized; an existing matching operation is returned instead of duplicated. (supports --dry-run, --body)\n- `cf web-assets operations bulk-delete` — Deletes multiple web or API operations from endpoint management in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-create` — Attaches labels to multiple web or API operations in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-delete` — Removes labels from multiple web or API operations in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-update` — Replaces the complete label sets on multiple web or API operations in one request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"web3": "# web3 — web3\n\n## Commands\n\n### Read Operations\n\n- `cf web3 hostnames get <identifier>` — Web3 Hostname Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries get <content-list-entry-identifier>` — IPFS Universal Path Gateway Content List Entry Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries list` — List IPFS Universal Path Gateway Content List Entries\n- `cf web3 hostnames ipfs-universal-paths content-lists get <identifier>` — IPFS Universal Path Gateway Content List Details\n- `cf web3 hostnames list` — List Web3 Hostnames\n\n### Create Operations\n\n- `cf web3 hostnames create` — Create Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries create <identifier>` — Create IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web3 hostnames edit <identifier>` — Edit Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries update <content-list-entry-identifier>` — Edit IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists update <identifier>` — Update IPFS Universal Path Gateway Content List (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web3 hostnames delete <identifier>` — Delete Web3 Hostname (supports --dry-run)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries delete <content-list-entry-identifier>` — Delete IPFS Universal Path Gateway Content List Entry (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"workers": "# workers — workers\n\n## Commands\n\n### Read Operations\n\n- `cf workers account-settings get` — Fetches Worker account settings for an account.\n- `cf workers beta workers get <worker-id>` — Get details about a specific Worker.\n- `cf workers beta workers list` — List all Workers for an account.\n- `cf workers beta workers versions get <version-id>` — Get details about a specific version.\n- `cf workers beta workers versions list` — List all versions for a Worker.\n- `cf workers deployments get <deployment-id>` — Get information about a Worker Deployment.\n- `cf workers deployments list` — List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.\n- `cf workers domains get <domain-id>` — Gets information about a domain.\n- `cf workers domains list` — Lists all domains for an account.\n- `cf workers placement regions list` — Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.\n- `cf workers routes get <route-id>` — Returns information about a route, including URL pattern and Worker.\n- `cf workers routes list` — Returns routes for a zone.\n- `cf workers scripts content get` — Fetch script content only.\n- `cf workers scripts get` — Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.\n- `cf workers scripts list` — Fetch a list of uploaded workers.\n- `cf workers scripts schedules get` — Fetches Cron Triggers for a Worker.\n- `cf workers scripts script-and-version-settings get` — Get metadata and config, such as bindings or usage model.\n- `cf workers scripts settings get` — Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.\n- `cf workers scripts subdomain get` — Get if the Worker is available on the workers.dev subdomain.\n- `cf workers scripts tail get` — Get list of tails currently deployed on a Worker.\n- `cf workers scripts usage-model get` — Fetches the Usage Model for a given Worker.\n- `cf workers secrets get <secret-name>` — Get a given secret binding (value omitted) on a script.\n- `cf workers secrets list` — List secrets bound to a script.\n- `cf workers services environments content get <environment-name>` — Get script content from a worker with an environment.\n- `cf workers services environments settings get <environment-name>` — Get script settings from a worker with an environment.\n- `cf workers subdomains get` — Returns a Workers subdomain for an account.\n- `cf workers versions get <version-id>` — Retrieves detailed information about a specific version of a Workers script.\n- `cf workers versions list` — List of Worker Versions. The first version in the list is the latest version.\n\n### Create Operations\n\n- `cf workers assets upload create` — Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers beta workers create` — Create a new Worker. (supports --dry-run, --body)\n- `cf workers beta workers versions create <worker-id>` — Create a new version. (supports --dry-run, --body)\n- `cf workers deployments create` — Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker. (supports --dry-run, --body)\n- `cf workers routes create` — Creates a route that maps a URL pattern to a Worker. (supports --dry-run, --body)\n- `cf workers scripts assets upload create` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers scripts subdomain create` — Enable or disable the Worker on the workers.dev subdomain. (supports --dry-run, --body)\n- `cf workers scripts tail create` — Starts a tail that receives logs and exception from a Worker. (supports --dry-run)\n- `cf workers versions create` — Upload a Worker Version without deploying to Cloudflare's network. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers account-settings update` — Creates Worker account settings for an account. (supports --dry-run, --body)\n- `cf workers beta workers edit <worker-id>` — Perform a partial update on a Worker, where omitted properties are left unchanged from their current values. (supports --dry-run, --body)\n- `cf workers beta workers update <worker-id>` — Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint. (supports --dry-run, --body)\n- `cf workers beta workers versions edit <worker-id>` — Only `/versions/latest` is supported. Creates a new version by applying a JSON Merge Patch (RFC 7396) to the latest version. Patching a specific version ID is not supported. Omitted fields are inherited from the latest version. (supports --dry-run, --body)\n- `cf workers domains update` — Attaches a domain that routes traffic to a Worker. (supports --dry-run, --body)\n- `cf workers routes update <route-id>` — Updates the URL pattern or Worker associated with a route. (supports --dry-run, --body)\n- `cf workers scripts content update` — Put script content without touching config or metadata. (supports --dry-run, --body)\n- `cf workers scripts schedules update` — Updates Cron Triggers for a Worker. (supports --dry-run, --body)\n- `cf workers scripts script-and-version-settings edit` — Patch metadata or config, such as bindings or usage model. (supports --dry-run, --body)\n- `cf workers scripts settings edit` — Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers. (supports --dry-run, --body)\n- `cf workers scripts update` — Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers scripts usage-model update` — Updates the Usage Model for a given Worker. Requires a Workers Paid subscription. (supports --dry-run, --body)\n- `cf workers secrets update <name>` — Add a secret to a script. (supports --dry-run, --body)\n- `cf workers services environments content update <environment-name>` — Put script content from a worker with an environment. (supports --dry-run, --body)\n- `cf workers services environments settings edit <environment-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf workers subdomains update` — Creates a Workers subdomain for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers beta workers delete <worker-id>` — Delete a Worker and all its associated resources (versions, deployments, etc.). (supports --dry-run)\n- `cf workers beta workers versions delete <version-id>` — Delete a version. (supports --dry-run)\n- `cf workers deployments delete <deployment-id>` — Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted. (supports --dry-run)\n- `cf workers domains delete <domain-id>` — Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain. (supports --dry-run)\n- `cf workers routes delete <route-id>` — Deletes a route. (supports --dry-run)\n- `cf workers scripts delete` — Delete your worker. This call has no response body on a successful delete. (supports --dry-run)\n- `cf workers scripts subdomain delete` — Disable all workers.dev subdomains for a Worker. (supports --dry-run)\n- `cf workers scripts tail delete <id>` — Deletes a tail from a Worker. (supports --dry-run)\n- `cf workers secrets delete <secret-name>` — Remove a secret from a script. (supports --dry-run)\n- `cf workers subdomains delete` — Deletes a Workers subdomain for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers scripts search` — Search for Workers in an account. (supports --dry-run)\n- `cf workers secrets bulk-edit` — Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"workers-builds": "# workers-builds — Automated build and deployment pipeline for Workers — track builds, logs, and repo connections\n\n## Commands\n\n### Read Operations\n\n- `cf workers-builds builds get <build-uuid>` — Retrieve detailed information about a specific build\n- `cf workers-builds builds list` — Get all builds for a specific worker script with pagination\n- `cf workers-builds builds logs get <build-uuid>` — Retrieve logs for a specific build with cursor-based pagination\n- `cf workers-builds deploy-hooks get <deploy-hook-uuid>` — Get details of a specific deploy hook.\n- `cf workers-builds deploy-hooks list` — Get all deploy hooks for a specific worker script.\n- `cf workers-builds repos config-autofill get <repo-id>` — Analyze repository for automatic configuration detection\n- `cf workers-builds tokens list` — Get all build tokens with pagination\n- `cf workers-builds triggers environment-variables list` — Get all environment variables for a trigger\n- `cf workers-builds triggers list` — Get all triggers for a specific worker script\n- `cf workers-builds workers get <script-tag>` — Retrieve the build configuration for a specific Worker script, including git repository details and production settings.\n\n### Create Operations\n\n- `cf workers-builds deploy-hooks create <script-name>` — Create a new deploy hook for a worker script. (supports --dry-run, --body)\n- `cf workers-builds tokens create` — Create a new build authentication token (supports --dry-run, --body)\n- `cf workers-builds triggers create` — Create a new CI/CD trigger (supports --dry-run, --body)\n- `cf workers-builds workers create` — Create a new build configuration for a Worker script, linking it to a git repository with CI/CD triggers. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers-builds deploy-hooks update <deploy-hook-uuid>` — Update an existing deploy hook. (supports --dry-run, --body)\n- `cf workers-builds triggers update <trigger-uuid>` — Update an existing CI/CD trigger (supports --dry-run, --body)\n- `cf workers-builds workers edit <script-tag>` — Update the build configuration for a Worker script. Supports partial updates to git repository settings and production build settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers-builds deploy-hooks delete <deploy-hook-uuid>` — Delete a deploy hook. (supports --dry-run)\n- `cf workers-builds repos connections delete <repo-connection-uuid>` — Remove a repository connection (supports --dry-run)\n- `cf workers-builds tokens delete <build-token-uuid>` — Remove a build authentication token (supports --dry-run)\n- `cf workers-builds triggers delete <trigger-uuid>` — Remove a CI/CD trigger (supports --dry-run)\n- `cf workers-builds triggers environment-variables delete <environment-variable-key>` — Remove a specific environment variable from a trigger (supports --dry-run)\n- `cf workers-builds workers delete <script-tag>` — Delete the build configuration for a Worker script. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers-builds builds cancel <build-uuid>` — Cancel a running or queued build (supports --dry-run)\n- `cf workers-builds deploy-hooks trigger <deploy-hook-uuid>` — Trigger a build using a deploy hook. This endpoint does not require authentication - the deploy_hook_uuid acts as a secret token. (supports --dry-run)\n- `cf workers-builds get-account-limits` — Retrieve account limits and usage information (supports --dry-run)\n- `cf workers-builds get-builds-by-version` — Retrieve builds for specific version IDs (supports --dry-run)\n- `cf workers-builds get-latest-builds` — Retrieve the most recent builds for multiple worker scripts (supports --dry-run)\n- `cf workers-builds repos connections upsert` — Upsert a repository connection for CI/CD integration (supports --dry-run, --body)\n- `cf workers-builds triggers create-build <trigger-uuid>` — Trigger a manual build for a specific trigger (supports --dry-run, --body)\n- `cf workers-builds triggers environment-variables upsert <trigger-uuid>` — Create or update environment variables for a trigger (supports --dry-run, --body)\n- `cf workers-builds triggers purge-cache <trigger-uuid>` — Clear the build cache for a specific trigger (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"workflows": "# workflows — Durable, multi-step workflows that run on Workers with automatic retries and state persistence\n\n## Commands\n\n### Read Operations\n\n- `cf workflows get <workflow-name>` — Retrieves configuration and metadata for a specific workflow.\n- `cf workflows instances get <instance-id>` — Retrieves logs and execution status for a specific workflow instance.\n- `cf workflows instances list` — Lists all instances of a workflow with their execution status.\n- `cf workflows instances step get <instance-id>` — Retrieves the full, untruncated output for a specific step on a workflow instance. Returns a flat status-shaped JSON body with step `status` ('running' | 'waiting' | 'complete' | 'errored'), `error` (nullable), and `output` (the step value, or null while running/waiting/errored). When the step returned a ReadableStream from step.do, the response is served as 'application/octet-stream' with the raw bytes as the body instead of JSON. A `status='running'` response with non-null `error` indicates the step is currently retrying after a prior attempt failed.\n- `cf workflows list` — Lists all workflows configured for the account.\n- `cf workflows settings get` — Retrieves account-level Workflows settings, such as the default instance retention.\n- `cf workflows versions get <version-id>` — Retrieves details for a specific deployed workflow version.\n- `cf workflows versions list` — Lists all deployed versions of a workflow.\n\n### Create Operations\n\n- `cf workflows instances batch create <workflow-name>` — Creates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances create <workflow-name>` — Creates a new instance of a workflow, starting its execution. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workflows settings edit` — Updates only the account-level Workflows settings fields present in the request body. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workflows delete <workflow-name>` — Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it. (supports --dry-run)\n- `cf workflows instances delete <instance-id>` — Deletes a workflow instance and its stored state. (supports --dry-run)\n\n### Other Operations\n\n- `cf workflows instances events send <event-type>` — Sends an event to a running workflow instance to trigger state transitions. (supports --dry-run)\n- `cf workflows instances pause <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances restart <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances resume <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances terminate <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows versions graph <version-id>` — Retrieves the graph visualization of a workflow version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zaraz": "# zaraz — Server-side tag manager — load third-party tools (analytics, pixels, etc.) from Cloudflare's edge without client-side JS\n\n## Commands\n\n### Read Operations\n\n- `cf zaraz config get` — Gets latest Zaraz configuration for a zone. It can be preview or published configuration, whichever was the last updated. Secret variables values will not be included.\n- `cf zaraz default get` — Gets default Zaraz configuration for a zone.\n- `cf zaraz export get` — Exports full current published Zaraz configuration for a zone, secret variables included.\n- `cf zaraz history configs get` — Gets a history of published Zaraz configurations by ID(s) for a zone.\n- `cf zaraz history list` — Lists a history of published Zaraz configuration records for a zone.\n- `cf zaraz workflow get` — Gets Zaraz workflow for a zone.\n\n### Create Operations\n\n- `cf zaraz publish create` — Publish current Zaraz preview configuration for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zaraz config update` — Updates Zaraz configuration for a zone. (supports --dry-run, --body)\n- `cf zaraz history update` — Restores a historical published Zaraz configuration by ID for a zone. (supports --dry-run, --body)\n- `cf zaraz workflow update` — Updates Zaraz workflow for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"zero-trust": "# zero-trust — Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation\n\n## Commands\n\n### Read Operations\n\n- `cf zero-trust access applications cas get <app-id>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust access applications cas list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust access applications get <app-id>` — Fetches information about an Access application.\n- `cf zero-trust access applications list` — Lists all Access applications in an account.\n- `cf zero-trust access applications policies get <policy-id>` — Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.\n- `cf zero-trust access applications policies list` — Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.\n- `cf zero-trust access applications policy-tests get <policy-test-id>` — Fetches the current status of a given Access policy test.\n- `cf zero-trust access applications policy-tests users list` — Fetches a single page of user results from an Access policy test.\n- `cf zero-trust access applications user-policy-checks list` — Tests if a specific user has permission to access an application.\n- `cf zero-trust access authenticator-device-aaguids list` — Returns a list of Authenticator Device AAGUIDs for MFA configuration.\n- `cf zero-trust access bookmarks get <bookmark-id>` — Fetches a single Bookmark application.\n- `cf zero-trust access bookmarks list` — Lists Bookmark applications.\n- `cf zero-trust access certificates get <certificate-id>` — Fetches a single mTLS certificate.\n- `cf zero-trust access certificates list` — Lists all mTLS root certificates.\n- `cf zero-trust access certificates settings get` — List all mTLS hostname settings for this account.\n- `cf zero-trust access custom-pages get <custom-page-id>` — Fetches a custom page and also returns its HTML.\n- `cf zero-trust access custom-pages list` — List custom pages\n- `cf zero-trust access gateway-ca list` — Lists SSH Certificate Authorities (CA).\n- `cf zero-trust access groups get <group-id>` — Fetches a single Access group.\n- `cf zero-trust access groups list` — Lists all Access groups.\n- `cf zero-trust access idp-federation-grants get <grant-id>` — Retrieves a single IdP federation grant by its UID.\n- `cf zero-trust access idp-federation-grants list` — Lists the IdP federation grants owned by the account.\n- `cf zero-trust access keys get` — Gets the Access key rotation settings for an account.\n- `cf zero-trust access logs access-requests list` — Gets a list of Access authentication audit logs for an account.\n- `cf zero-trust access logs jit-requests get <knock-request-id>` — Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.\n- `cf zero-trust access logs jit-requests list` — Lists account-wide Access JIT request logs reconstructed from request lifecycle events.\n- `cf zero-trust access logs scim updates list` — Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust access policies get <policy-id>` — Fetches a single Access reusable policy.\n- `cf zero-trust access policies list` — Lists Access reusable policies.\n- `cf zero-trust access saml-certificates get <saml-cert-set-id>` — Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.\n- `cf zero-trust access saml-certificates list` — Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.\n- `cf zero-trust access service-tokens get <service-token-id>` — Fetches a single service token.\n- `cf zero-trust access service-tokens list` — Lists all service tokens.\n- `cf zero-trust access tags get <tag-name>` — Get a tag\n- `cf zero-trust access tags list` — List tags\n- `cf zero-trust access users active-sessions get <nonce>` — Get an active session for a single user.\n- `cf zero-trust access users active-sessions list` — Get active sessions for a single user.\n- `cf zero-trust access users failed-logins list` — Get all failed login attempts for a single user.\n- `cf zero-trust access users get <user-id>` — Gets a specific user for an account.\n- `cf zero-trust access users last-seen-identity get <user-id>` — Get last seen identity for a single user.\n- `cf zero-trust access users list` — Gets a list of users for an account.\n- `cf zero-trust apps ca get <app-id>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust apps ca list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust apps get <app-id>` — Fetches information about an Access application.\n- `cf zero-trust apps list` — List all Access Applications in a zone.\n- `cf zero-trust apps policies get <policy-id>` — Fetches a single Access policy.\n- `cf zero-trust apps policies list` — Lists Access policies configured for an application.\n- `cf zero-trust apps review status list` — Retrieve the statuses of your applications.\n- `cf zero-trust apps user policy checks get <app-id>` — Tests if a specific user has permission to access an application.\n- `cf zero-trust casb applications authMethods list` — Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.\n- `cf zero-trust casb applications get <application-id>` — Returns full application details including auth methods, use cases, and permissions.\n- `cf zero-trust casb applications list` — Returns a list of available applications with use cases and permissions.\n- `cf zero-trust casb applications setupFlows list` — Returns all available setup flows for the application, one per auth method.\n- `cf zero-trust casb integrations get <id>` — Returns full integration details including use cases and permissions.\n- `cf zero-trust casb integrations list` — Returns a paginated list of integrations for the account.\n- `cf zero-trust certificates get <certificate-id>` — Fetches a single mTLS certificate.\n- `cf zero-trust certificates list` — Lists all mTLS certificates.\n- `cf zero-trust certificates settings list` — List all mTLS hostname settings for this zone.\n- `cf zero-trust connectivity-settings get` — Gets the Zero Trust Connectivity Settings for the given account.\n- `cf zero-trust devices client target environments list` — Retrieves a list of all available target environments with their display names. This endpoint is in Beta.\n- `cf zero-trust devices client versions list` — Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups get <group-id>` — Fetches a single deployment group by its ID. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups list` — Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.\n- `cf zero-trust devices get <device-id>` — Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}\n- `cf zero-trust devices ip-profiles get <profile-id>` — Fetches a single WARP Device IP profile.\n- `cf zero-trust devices ip-profiles list` — Lists WARP Device IP profiles.\n- `cf zero-trust devices list` — List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations\n- `cf zero-trust devices networks get <network-id>` — Fetches details for a single managed network.\n- `cf zero-trust devices networks list` — Fetches a list of managed networks for an account.\n- `cf zero-trust devices override-codes get <registration-id>` — Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.\n- `cf zero-trust devices override-codes list` — Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.\n- `cf zero-trust devices physical-devices get <device-id>` — Fetches a single WARP device.\n- `cf zero-trust devices physical-devices list` — Lists WARP devices.\n- `cf zero-trust devices policies custom excludes get <policy-id>` — Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom fallback-domains get <policy-id>` — Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies custom get <policy-id>` — Fetches a device settings profile by ID.\n- `cf zero-trust devices policies custom includes get <policy-id>` — Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom list` — Fetches a list of the device settings profiles for an account.\n- `cf zero-trust devices policies default certificates get` — Fetches device certificate provisioning.\n- `cf zero-trust devices policies default excludes get` — Fetches the list of routes excluded from the WARP client's tunnel.\n- `cf zero-trust devices policies default fallback-domains get` — Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies default get` — Fetches the default device settings profile for an account.\n- `cf zero-trust devices policies default includes get` — Fetches the list of routes included in the WARP client's tunnel.\n- `cf zero-trust devices posture get <rule-id>` — Fetches a single device posture rule.\n- `cf zero-trust devices posture integrations get <integration-id>` — Fetches details for a single device posture integration.\n- `cf zero-trust devices posture integrations list` — Fetches the list of device posture integrations for an account.\n- `cf zero-trust devices posture list` — Fetches device posture rules for a Zero Trust account.\n- `cf zero-trust devices registrations get <registration-id>` — Fetches a single WARP registration.\n- `cf zero-trust devices registrations list` — Lists WARP registrations.\n- `cf zero-trust devices resilience global-warp-override get` — Fetch the Global WARP override state.\n- `cf zero-trust devices settings get` — Describes the current device settings for a Zero Trust account.\n- `cf zero-trust dex colos list` — List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.\n- `cf zero-trust dex commands eligible-devices list` — List devices with WARP client support for remote captures which have been connected in the last 1 hour.\n- `cf zero-trust dex commands list` — Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters\n- `cf zero-trust dex commands quota get` — Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset\n- `cf zero-trust dex commands results get <filename>` — Downloads artifacts for an executed command. Bulk downloads are not supported\n- `cf zero-trust dex devices aggregates live get` — Get details for live (up to 60 minutes) devices using WARP.\n- `cf zero-trust dex devices aggregates over-time get` — Get aggregate details for devices using WARP, up to 7 days.\n- `cf zero-trust dex devices get <device-id>` — Get the latest status of a device given device_id from the device_state table.\n- `cf zero-trust dex devices list` — List details of devices using WARP.\n- `cf zero-trust dex devices over-time get <device-id>` — Get time-bucketed status metrics for a specific device.\n- `cf zero-trust dex isps list` — List ISP information observed for a specific device during traceroute tests.\n- `cf zero-trust dex overview tests list` — List DEX tests with overview metrics.\n- `cf zero-trust dex overview tests unique-devices get` — Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.\n- `cf zero-trust dex rules get <rule-id>` — Get details for a DEX Rule.\n- `cf zero-trust dex rules list` — List DEX Rules.\n- `cf zero-trust dex test-results http get <test-id>` — Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results http percentiles get <test-id>` — Get percentiles for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute get <test-id>` — Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute network-path get <test-result-id>` — Get a breakdown of hops and performance metrics for a specific traceroute test run\n- `cf zero-trust dex test-results traceroute percentiles get <test-id>` — Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex tests get <dex-test-id>` — Fetch a single DEX test.\n- `cf zero-trust dex tests list` — Fetch all DEX tests.\n- `cf zero-trust dex tests network-path get <test-id>` — Get a breakdown of metrics by hop for individual traceroute test runs.\n- `cf zero-trust dex warp-change-events list` — List WARP configuration and enablement toggle change events by device.\n- `cf zero-trust dlp custom-prompt-topics get <entry-id>` — Fetches a DLP custom prompt topic entry by ID.\n- `cf zero-trust dlp custom-prompt-topics list` — Lists all DLP custom prompt topic entries in an account.\n- `cf zero-trust dlp data-classes get <data-class-id>` — Gets the configuration for a data class.\n- `cf zero-trust dlp data-classes list` — Lists data classes configured for the account.\n- `cf zero-trust dlp data-tag-categories get <category-id>` — Gets a data tag category and its tags.\n- `cf zero-trust dlp data-tag-categories list` — Lists data tag categories configured for the account.\n- `cf zero-trust dlp data-tag-category-templates get <template-id>` — Gets an available data tag category template.\n- `cf zero-trust dlp data-tag-category-templates list` — Lists available data tag category templates.\n- `cf zero-trust dlp data-tags get <tag-id>` — Gets a data tag from a category.\n- `cf zero-trust dlp data-tags list` — Lists data tags in a category.\n- `cf zero-trust dlp datasets get <dataset-id>` — Gets a dataset and its latest upload status.\n- `cf zero-trust dlp datasets list` — Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.\n- `cf zero-trust dlp email account-mapping get` — Retrieves the email provider mapping configuration for DLP email scanning.\n- `cf zero-trust dlp email rules get <rule-id>` — Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.\n- `cf zero-trust dlp email rules list` — Lists all email scanner rules for an account.\n- `cf zero-trust dlp entries get <entry-id>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp limits list` — Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.\n- `cf zero-trust dlp payload-logs get` — Gets the current payload logging configuration for DLP, showing whether matched content is being logged.\n- `cf zero-trust dlp profiles custom get <profile-id>` — Fetches a custom DLP profile by id.\n- `cf zero-trust dlp profiles get <profile-id>` — Fetches a DLP profile by ID.\n- `cf zero-trust dlp profiles list` — Lists all DLP profiles in an account.\n- `cf zero-trust dlp profiles predefined get <profile-id>` — This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.\n- `cf zero-trust dlp sensitivity-group-templates get <template-id>` — Gets an available sensitivity group template.\n- `cf zero-trust dlp sensitivity-group-templates list` — Lists available sensitivity group templates.\n- `cf zero-trust dlp sensitivity-groups get <sensitivity-group-id>` — Gets a sensitivity group and its levels.\n- `cf zero-trust dlp sensitivity-groups list` — Lists sensitivity groups configured for the account.\n- `cf zero-trust dlp sensitivity-levels get <sensitivity-level-id>` — Gets a sensitivity level from a group.\n- `cf zero-trust dlp sensitivity-levels list` — Lists sensitivity levels in a sensitivity group.\n- `cf zero-trust gateway app-types list` — List all application and application type mappings.\n- `cf zero-trust gateway audit-ssh-settings get` — Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.\n- `cf zero-trust gateway categories list` — List all categories.\n- `cf zero-trust gateway certificates get <certificate-id>` — Get a single Zero Trust certificate.\n- `cf zero-trust gateway certificates list` — List all Zero Trust certificates for an account.\n- `cf zero-trust gateway configurations custom-certificate get` — Retrieve the current Zero Trust certificate configuration.\n- `cf zero-trust gateway configurations get` — Retrieve the current Zero Trust account configuration.\n- `cf zero-trust gateway dns-destination-ips list` — List Zero Trust Gateway IPv4 address pairs for an account.\n- `cf zero-trust gateway egress-cidr-pairs list` — Retrieve the list of egress CIDRs allocated to this Zero Trust account.\n- `cf zero-trust gateway list` — Retrieve information about the current Zero Trust account.\n- `cf zero-trust gateway lists get <list-id>` — Fetch a single Zero Trust list.\n- `cf zero-trust gateway lists items list` — Fetch all items in a single Zero Trust list.\n- `cf zero-trust gateway lists list` — Fetch all Zero Trust lists for an account.\n- `cf zero-trust gateway locations get <location-id>` — Get a single Zero Trust Gateway location.\n- `cf zero-trust gateway locations list` — List Zero Trust Gateway locations for an account.\n- `cf zero-trust gateway logging get` — Retrieve the current logging settings for the Zero Trust account.\n- `cf zero-trust gateway operations get <operation-id>` — Fetch a single Zero Trust Gateway operation by its ID.\n- `cf zero-trust gateway operations list` — List all Zero Trust Gateway operations for an account.\n- `cf zero-trust gateway pacfiles get <pacfile-id>` — Get a single Zero Trust Gateway PAC file.\n- `cf zero-trust gateway pacfiles list` — List all Zero Trust Gateway PAC files for an account.\n- `cf zero-trust gateway proxy-endpoints get <proxy-endpoint-id>` — Get a single Zero Trust Gateway proxy endpoint.\n- `cf zero-trust gateway proxy-endpoints list` — List all Zero Trust Gateway proxy endpoints for an account.\n- `cf zero-trust gateway rules get <rule-id>` — Get a single Zero Trust Gateway rule.\n- `cf zero-trust gateway rules list` — List Zero Trust Gateway rules for an account.\n- `cf zero-trust groups get <group-id>` — Fetches a single Access group.\n- `cf zero-trust groups list` — Lists all Access groups.\n- `cf zero-trust identity-providers get <identity-provider-id>` — Fetches a configured identity provider.\n- `cf zero-trust identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust identity-providers scim groups list` — Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust identity-providers scim users list` — Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust organizations doh get` — Returns the DoH settings for your Zero Trust organization.\n- `cf zero-trust organizations list` — Returns the configuration for your Zero Trust organization.\n- `cf zero-trust profiles custom list` — Lists all DLP custom profiles in an account.\n- `cf zero-trust profiles predefined get <profile-id>` — Fetches a predefined DLP profile by id.\n- `cf zero-trust risk-scoring behaviours get` — Retrieves configured risk score behaviors that define how user actions affect their overall risk score.\n- `cf zero-trust risk-scoring get <user-id>` — Retrieves the detailed risk score breakdown for a specific user, including contributing factors.\n- `cf zero-trust risk-scoring integrations get <integration-id>` — Gets a Zero Trust risk score integration by ID.\n- `cf zero-trust risk-scoring integrations list` — Lists all configured Zero Trust risk score integrations for the account.\n- `cf zero-trust risk-scoring integrations references get <reference-id>` — Retrieves a Zero Trust risk score integration using its external reference ID.\n- `cf zero-trust risk-scoring summary get` — Gets an aggregate summary of risk scores across the account, including distribution and trends.\n- `cf zero-trust service-tokens get <service-token-id>` — Fetches a single service token.\n- `cf zero-trust service-tokens list` — Lists all service tokens.\n- `cf zero-trust settings get` — Gets the account-level DLP settings.\n- `cf zero-trust zone-identity-providers get <identity-provider-id>` — Fetches a configured identity provider.\n- `cf zero-trust zone-identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust zone-organizations get` — Returns the configuration for your Zero Trust organization.\n\n### Create Operations\n\n- `cf zero-trust access applications cas create <app-id>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust access applications create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust access applications policies create <app-id>` — Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array. (supports --dry-run, --body)\n- `cf zero-trust access applications policy-tests create` — Starts an Access policy test. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks create <bookmark-id>` — Create a new Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages create` — Create a custom page (supports --dry-run, --body)\n- `cf zero-trust access gateway-ca create` — Adds a new SSH Certificate Authority (CA). (supports --dry-run)\n- `cf zero-trust access groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust access idp-federation-grants create` — Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time. (supports --dry-run, --body)\n- `cf zero-trust access policies create` — Creates a new Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token. (supports --dry-run, --body)\n- `cf zero-trust access tags create` — Create a tag (supports --dry-run, --body)\n- `cf zero-trust access users create` — Creates a new user. (supports --dry-run, --body)\n- `cf zero-trust apps ca create <app-id>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust apps create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust apps policies create <app-id>` — Create a new Access policy for an application. (supports --dry-run, --body)\n- `cf zero-trust apps revoke tokens create <app-id>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust casb integrations create` — Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor. (supports --dry-run, --body)\n- `cf zero-trust certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups create` — Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles create` — Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks create` — Creates a new device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom create` — Creates a device settings profile to be applied to certain devices matching the criteria. (supports --dry-run, --body)\n- `cf zero-trust devices posture create` — Creates a new device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations create` — Create a new device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices resilience global-warp-override create` — Sets the Global WARP override state. (supports --dry-run, --body)\n- `cf zero-trust devices revoke create` — Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead. (supports --dry-run, --body)\n- `cf zero-trust devices unrevoke create` — Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead. (supports --dry-run, --body)\n- `cf zero-trust dex commands create` — Initiate commands for up to 10 devices per account. (supports --dry-run, --body)\n- `cf zero-trust dex rules create` — Create a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests create` — Create a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp custom-prompt-topics create` — Creates a DLP custom prompt topic entry. (supports --dry-run, --body)\n- `cf zero-trust dlp data-classes create` — Creates a data class for use in DLP profiles. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tag-categories create` — Creates a data tag category, optionally from a template. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tags create <category-id>` — Creates a data tag in a category. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets create` — Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload create <dataset-id>` — Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists. (supports --dry-run)\n- `cf zero-trust dlp datasets versions create <version>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets versions entries create <entry-id>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. (supports --dry-run, --body)\n- `cf zero-trust dlp email account-mapping create` — Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules create` — Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take. (supports --dry-run, --body)\n- `cf zero-trust dlp entries create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration create` — Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined create` — Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom create` — Creates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined create <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups create` — Creates a sensitivity group, optionally from a template. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-levels create <sensitivity-group-id>` — Creates a sensitivity level in a group. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates create` — Create a new Zero Trust certificate. (supports --dry-run, --body)\n- `cf zero-trust gateway create` — Create a Zero Trust account for an existing Cloudflare account. (supports --dry-run)\n- `cf zero-trust gateway lists create` — Creates a new Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations create` — Create a new Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles create` — Create a new Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints create` — Create a new Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules create` — Create a new Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust identity-providers saml-certificate create <identity-provider-id>` — Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider (supports --dry-run)\n- `cf zero-trust organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined create` — Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations create` — Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system. (supports --dry-run, --body)\n- `cf zero-trust service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations create` — Sets up a Zero Trust organization for your account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zero-trust access applications policies update <policy-id>` — Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run, --body)\n- `cf zero-trust access applications settings edit <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications settings update <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications update <app-id>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks update <bookmark-id>` — Updates a configured Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust access certificates update <certificate-id>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages update <custom-page-id>` — Update a custom page (supports --dry-run, --body)\n- `cf zero-trust access groups update <group-id>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust access keys update` — Updates the Access key rotation settings for an account. (supports --dry-run, --body)\n- `cf zero-trust access policies update <policy-id>` — Updates a Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens update <service-token-id>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust access tags update <tag-name>` — Update a tag (supports --dry-run, --body)\n- `cf zero-trust access users update <user-id>` — Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed). (supports --dry-run, --body)\n- `cf zero-trust apps policies make reusable update <policy-id>` — Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust apps policies update <policy-id>` — Update a configured Access policy. (supports --dry-run, --body)\n- `cf zero-trust apps review status update` — Update the statuses of your applications. (supports --dry-run, --body)\n- `cf zero-trust apps settings edit <app-id>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps settings update <app-id>` — Updates application settings. (supports --dry-run, --body)\n- `cf zero-trust apps update <app-id>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust casb integrations update <id>` — Updates an integration's name, permissions, DLP profiles, use cases, or credentials. (supports --dry-run, --body)\n- `cf zero-trust certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust certificates update <certificate-id>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust connectivity-settings edit` — Updates the Zero Trust Connectivity Settings for the given account. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups update <group-id>` — Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles update <profile-id>` — Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks update <network-id>` — Updates a configured device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom edit <policy-id>` — Updates a configured device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom excludes update <policy-id>` — Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom fallback-domains update <policy-id>` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom includes update <policy-id>` — Sets the list of routes included in the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies default certificates edit` — Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session. (supports --dry-run, --body)\n- `cf zero-trust devices policies default edit` — Updates the default device settings profile for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies default excludes update` — Sets the list of routes excluded from the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices policies default fallback-domains update` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. (supports --dry-run, --body)\n- `cf zero-trust devices policies default includes update` — Sets the list of routes included in the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations edit <integration-id>` — Updates a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices posture update <rule-id>` — Updates a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices settings edit` — Patches the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust devices settings update` — Updates the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust dex rules update <rule-id>` — Update a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests update <dex-test-id>` — Update a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp custom-prompt-topics update <entry-id>` — Updates a DLP custom prompt topic entry. (supports --dry-run, --body)\n- `cf zero-trust dlp data-classes update <data-class-id>` — Updates the configuration for a data class. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tag-categories update <category-id>` — Updates a data tag category and its tags. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tags update <tag-id>` — Updates a data tag in a category. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets update <dataset-id>` — Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload edit <version>` — This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules update <rule-id>` — Updates a DLP email scanning rule. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom update <entry-id>` — Updates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp payload-logs update` — Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom update <profile-id>` — Updates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined update <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups update <sensitivity-group-id>` — Updates a sensitivity group and its levels. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-levels update <sensitivity-level-id>` — Updates a sensitivity level in a group. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints update <document-fingerprint-id>` — Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents. (supports --dry-run, --body)\n- `cf zero-trust gateway audit-ssh-settings update` — Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations edit` — Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations update` — Update the current Zero Trust account configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway lists edit <list-id>` — Appends or removes an item from a configured Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway lists update <list-id>` — Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations update <location-id>` — Update a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway logging update` — Update logging settings for the current Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles update <pacfile-id>` — Update a configured Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints edit <proxy-endpoint-id>` — Update a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules edit <rule-id>` — Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement. (supports --dry-run, --body)\n- `cf zero-trust gateway rules update <rule-id>` — Update a configured Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust groups update <group-id>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust identity-providers update <identity-provider-id>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust organizations doh update` — Updates the DoH settings for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined update <profile-id>` — Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring behaviours update` — Updates risk score behavior configurations, defining weights and thresholds for risk calculation. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations update <integration-id>` — Overwrite the reference_id, tenant_url, and active values with the ones provided. (supports --dry-run, --body)\n- `cf zero-trust seats edit` — Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false. (supports --dry-run, --body)\n- `cf zero-trust service-tokens update <service-token-id>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust settings edit` — Missing fields keep their existing values. (supports --dry-run, --body)\n- `cf zero-trust settings update` — Missing fields are reset to initial (unconfigured) values. (supports --dry-run, --body)\n- `cf zero-trust zone-identity-providers update <identity-provider-id>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust zone-organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zero-trust access applications cas delete <app-id>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust access applications delete <app-id>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust access applications policies delete <policy-id>` — Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust access bookmarks delete <bookmark-id>` — Deletes a Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates delete <certificate-id>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust access custom-pages delete <custom-page-id>` — Delete a custom page (supports --dry-run)\n- `cf zero-trust access gateway-ca delete <certificate-id>` — Deletes an SSH Certificate Authority. (supports --dry-run)\n- `cf zero-trust access groups delete <group-id>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust access idp-federation-grants delete <grant-id>` — Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts. (supports --dry-run)\n- `cf zero-trust access policies delete <policy-id>` — Deletes an Access reusable policy. (supports --dry-run)\n- `cf zero-trust access service-tokens delete <service-token-id>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust access tags delete <tag-name>` — Delete a tag (supports --dry-run)\n- `cf zero-trust access users delete <user-id>` — Deletes a specific user for an account. This will also revoke any active seats and tokens for the user. (supports --dry-run)\n- `cf zero-trust apps ca delete <app-id>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust apps delete <app-id>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust apps policies delete <policy-id>` — Delete an Access policy. (supports --dry-run)\n- `cf zero-trust casb integrations delete <id>` — Delete an integration by soft-deleting it. (supports --dry-run)\n- `cf zero-trust certificates delete <certificate-id>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust devices deployment groups delete <group-id>` — Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta. (supports --dry-run)\n- `cf zero-trust devices ip-profiles delete <profile-id>` — Delete a WARP Device IP profile. (supports --dry-run)\n- `cf zero-trust devices networks delete <network-id>` — Deletes a device managed network and fetches a list of the remaining device managed networks for an account. (supports --dry-run)\n- `cf zero-trust devices physical-devices delete <device-id>` — Deletes a WARP device. (supports --dry-run)\n- `cf zero-trust devices policies custom delete <policy-id>` — Deletes a device settings profile and fetches a list of the remaining profiles for an account. (supports --dry-run)\n- `cf zero-trust devices posture delete <rule-id>` — Deletes a device posture rule. (supports --dry-run)\n- `cf zero-trust devices posture integrations delete <integration-id>` — Delete a configured device posture integration. (supports --dry-run)\n- `cf zero-trust devices registrations delete <registration-id>` — Deletes a WARP registration. (supports --dry-run)\n- `cf zero-trust devices settings delete` — Resets the current device settings for a Zero Trust account. (supports --dry-run)\n- `cf zero-trust dex rules delete <rule-id>` — Delete a DEX Rule. (supports --dry-run)\n- `cf zero-trust dex tests delete <dex-test-id>` — Delete a Device DEX test. Returns the remaining device dex tests for the account. (supports --dry-run)\n- `cf zero-trust dlp custom-prompt-topics delete <entry-id>` — Deletes a DLP custom prompt topic entry. (supports --dry-run)\n- `cf zero-trust dlp data-classes delete <data-class-id>` — Deletes a data class from the account. (supports --dry-run)\n- `cf zero-trust dlp data-tag-categories delete <category-id>` — Deletes a data tag category and its tags. (supports --dry-run)\n- `cf zero-trust dlp data-tags delete <tag-id>` — Deletes a data tag from a category. (supports --dry-run)\n- `cf zero-trust dlp datasets delete <dataset-id>` — This deletes all versions of the dataset. (supports --dry-run)\n- `cf zero-trust dlp email rules delete <rule-id>` — Removes a DLP email scanning rule. The rule will no longer be applied to email messages. (supports --dry-run)\n- `cf zero-trust dlp entries delete <entry-id>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries integration delete <entry-id>` — This is a no-op as integration entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp entries predefined delete <entry-id>` — This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp profiles custom delete <profile-id>` — Deletes a DLP custom profile. (supports --dry-run)\n- `cf zero-trust dlp profiles predefined delete <profile-id>` — This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-groups delete <sensitivity-group-id>` — Deletes a sensitivity group and its levels. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-levels delete <sensitivity-level-id>` — Deletes a sensitivity level from a group. (supports --dry-run)\n- `cf zero-trust document-fingerprints delete <document-fingerprint-id>` — Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected. (supports --dry-run)\n- `cf zero-trust gateway certificates delete <certificate-id>` — Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it. (supports --dry-run)\n- `cf zero-trust gateway lists delete <list-id>` — Deletes a Zero Trust list. (supports --dry-run)\n- `cf zero-trust gateway locations delete <location-id>` — Delete a configured Zero Trust Gateway location. (supports --dry-run)\n- `cf zero-trust gateway pacfiles delete <pacfile-id>` — Delete a configured Zero Trust Gateway PAC file. (supports --dry-run)\n- `cf zero-trust gateway proxy-endpoints delete <proxy-endpoint-id>` — Delete a configured Zero Trust Gateway proxy endpoint. (supports --dry-run)\n- `cf zero-trust gateway rules delete <rule-id>` — Delete a Zero Trust Gateway rule. (supports --dry-run)\n- `cf zero-trust groups delete <group-id>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust identity-providers delete <identity-provider-id>` — Deletes an identity provider from Access. (supports --dry-run)\n- `cf zero-trust risk-scoring integrations delete <integration-id>` — Removes a Zero Trust risk score integration, disconnecting the external risk signal source. (supports --dry-run)\n- `cf zero-trust service-tokens delete <service-token-id>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust settings delete` — Deletes account-level DLP settings and returns the initial values. (supports --dry-run)\n- `cf zero-trust users mfa authenticators delete <authenticator-id>` — Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result. (supports --dry-run)\n- `cf zero-trust zone-identity-providers delete <identity-provider-id>` — Deletes an identity provider from Access. (supports --dry-run)\n\n### Other Operations\n\n- `cf zero-trust access applications revoke-tokens <app-id>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust access custom-pages validate` — Validate a Liquid template and return its errors and warnings without persisting it. (supports --dry-run, --body)\n- `cf zero-trust access keys rotate` — Perfoms a key rotation for an account. (supports --dry-run)\n- `cf zero-trust access saml-certificates get-pem <saml-cert-set-id>` — Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration. (supports --dry-run)\n- `cf zero-trust access saml-certificates rotate <saml-cert-set-id>` — Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration. (supports --dry-run)\n- `cf zero-trust access service-tokens refresh <service-token-id>` — Refreshes the expiration of a service token. (supports --dry-run)\n- `cf zero-trust access service-tokens rotate <service-token-id>` — Generates a new Client Secret for a service token and revokes the old one. (supports --dry-run, --body)\n- `cf zero-trust casb integrations pause <id>` — Pauses an integration, stopping all crawlers. (supports --dry-run)\n- `cf zero-trust casb integrations resume <id>` — Resumes a paused integration, restarting crawlers. (supports --dry-run)\n- `cf zero-trust devices physical-devices revoke <device-id>` — Revokes all WARP registrations associated with the specified device. (supports --dry-run)\n- `cf zero-trust devices registrations bulk-delete` — Deletes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations revoke` — Revokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations unrevoke` — Unrevokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust dlp email rules bulk-edit` — Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first. (supports --dry-run, --body)\n- `cf zero-trust dlp patterns validate` — Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups get-level-order <sensitivity-group-id>` — Gets the current order of sensitivity levels in a group. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-groups update-level-order <sensitivity-group-id>` — Updates the order of sensitivity levels in a group. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create document fingerprints` — Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create v2 <document-fingerprint-id>` — Updates metadata for an existing document fingerprint, such as its name or description. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints get document fingerprints <document-fingerprint-id>` — Gets a document fingerprint and its latest upload status. (supports --dry-run)\n- `cf zero-trust document-fingerprints get fingerprints all` — Lists all document fingerprints configured for DLP scanning in the account. (supports --dry-run)\n- `cf zero-trust gateway audit-ssh-settings rotate-seed` — Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy. (supports --dry-run)\n- `cf zero-trust gateway certificates activate <certificate-id>` — Bind a single Zero Trust certificate to the edge. (supports --dry-run)\n- `cf zero-trust gateway certificates deactivate <certificate-id>` — Unbind a single Zero Trust certificate from the edge. (supports --dry-run)\n- `cf zero-trust gateway lists upload` — Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status. (supports --dry-run, --body)\n- `cf zero-trust gateway rules bulk-edit` — Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated. (supports --dry-run, --body)\n- `cf zero-trust gateway rules list-tenant` — List Zero Trust Gateway rules for the parent account of an account in the MSP configuration. (supports --dry-run)\n- `cf zero-trust gateway rules reset-expiration <rule-id>` — Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`. (supports --dry-run)\n- `cf zero-trust organizations revoke-users` — Revokes a user's access across all applications. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring reset <user-id>` — Resets risk scores for specified users, clearing their accumulated risk history. (supports --dry-run)\n- `cf zero-trust zone-organizations revoke-user-create` — Revokes a user's access across all applications. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"zero-trust": "# zero-trust — Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation\n\n## Commands\n\n### Read Operations\n\n- `cf zero-trust access applications cas get <app-id>` — Fetches a short-lived certificate CA and its public key.\n- `cf zero-trust access applications cas list` — Lists short-lived certificate CAs and their public keys.\n- `cf zero-trust access applications get <app-id>` — Fetches information about an Access application.\n- `cf zero-trust access applications list` — Lists all Access applications in an account or zone.\n- `cf zero-trust access applications policies get <policy-id>` — Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.\n- `cf zero-trust access applications policies list` — Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.\n- `cf zero-trust access applications policy-tests get <policy-test-id>` — Fetches the current status of a given Access policy test.\n- `cf zero-trust access applications policy-tests users list` — Fetches a single page of user results from an Access policy test.\n- `cf zero-trust access applications user-policy-checks list` — Tests if a specific user has permission to access an application.\n- `cf zero-trust access authenticator-device-aaguids list` — Returns a list of Authenticator Device AAGUIDs for MFA configuration.\n- `cf zero-trust access bookmarks get <bookmark-id>` — Fetches a single Bookmark application.\n- `cf zero-trust access bookmarks list` — Lists Bookmark applications.\n- `cf zero-trust access certificates get <certificate-id>` — Fetches a single mTLS certificate.\n- `cf zero-trust access certificates list` — Lists all mTLS root certificates.\n- `cf zero-trust access certificates settings get` — List all mTLS hostname settings for this account or zone.\n- `cf zero-trust access custom-pages get <custom-page-id>` — Fetches a custom page and also returns its HTML.\n- `cf zero-trust access custom-pages list` — List custom pages\n- `cf zero-trust access gateway-ca list` — Lists SSH Certificate Authorities (CA).\n- `cf zero-trust access groups get <group-id>` — Fetches a single Access group.\n- `cf zero-trust access groups list` — Lists all Access groups.\n- `cf zero-trust access idp-federation-grants get <grant-id>` — Retrieves a single IdP federation grant by its UID.\n- `cf zero-trust access idp-federation-grants list` — Lists the IdP federation grants owned by the account.\n- `cf zero-trust access keys get` — Gets the Access key rotation settings for an account.\n- `cf zero-trust access logs access-requests list` — Gets a list of Access authentication audit logs for an account.\n- `cf zero-trust access logs jit-requests get <knock-request-id>` — Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.\n- `cf zero-trust access logs jit-requests list` — Lists account-wide Access JIT request logs reconstructed from request lifecycle events.\n- `cf zero-trust access logs scim updates list` — Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust access policies get <policy-id>` — Fetches a single Access reusable policy.\n- `cf zero-trust access policies list` — Lists Access reusable policies.\n- `cf zero-trust access saml-certificates get <saml-cert-set-id>` — Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.\n- `cf zero-trust access saml-certificates list` — Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.\n- `cf zero-trust access service-tokens get <service-token-id>` — Fetches a single service token.\n- `cf zero-trust access service-tokens list` — Lists all service tokens.\n- `cf zero-trust access tags get <tag-name>` — Get a tag\n- `cf zero-trust access tags list` — List tags\n- `cf zero-trust access users active-sessions get <nonce>` — Get an active session for a single user.\n- `cf zero-trust access users active-sessions list` — Get active sessions for a single user.\n- `cf zero-trust access users failed-logins list` — Get all failed login attempts for a single user.\n- `cf zero-trust access users get <user-id>` — Gets a specific user for an account.\n- `cf zero-trust access users last-seen-identity get <user-id>` — Get last seen identity for a single user.\n- `cf zero-trust access users list` — Gets a list of users for an account.\n- `cf zero-trust apps review status list` — Retrieve the statuses of your applications.\n- `cf zero-trust casb applications authMethods list` — Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.\n- `cf zero-trust casb applications get <application-id>` — Returns full application details including auth methods, use cases, and permissions.\n- `cf zero-trust casb applications list` — Returns a list of available applications with use cases and permissions.\n- `cf zero-trust casb applications setupFlows list` — Returns all available setup flows for the application, one per auth method.\n- `cf zero-trust casb integrations get <id>` — Returns full integration details including use cases and permissions.\n- `cf zero-trust casb integrations list` — Returns a paginated list of integrations for the account.\n- `cf zero-trust connectivity-settings get` — Gets the Zero Trust Connectivity Settings for the given account.\n- `cf zero-trust devices client target environments list` — Retrieves a list of all available target environments with their display names. This endpoint is in Beta.\n- `cf zero-trust devices client versions list` — Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups get <group-id>` — Fetches a single deployment group by its ID. This endpoint is in Beta.\n- `cf zero-trust devices deployment groups list` — Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.\n- `cf zero-trust devices get <device-id>` — Fetches a single WARP device.\n- `cf zero-trust devices ip-profiles get <profile-id>` — Fetches a single WARP Device IP profile.\n- `cf zero-trust devices ip-profiles list` — Lists WARP Device IP profiles.\n- `cf zero-trust devices list` — Lists WARP devices.\n- `cf zero-trust devices networks get <network-id>` — Fetches details for a single managed network.\n- `cf zero-trust devices networks list` — Fetches a list of managed networks for an account.\n- `cf zero-trust devices override-codes get <registration-id>` — Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.\n- `cf zero-trust devices override-codes list` — Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.\n- `cf zero-trust devices policies custom excludes get <policy-id>` — Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom fallback-domains get <policy-id>` — Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies custom get <policy-id>` — Fetches a device settings profile by ID.\n- `cf zero-trust devices policies custom includes get <policy-id>` — Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.\n- `cf zero-trust devices policies custom list` — Fetches a list of the device settings profiles for an account.\n- `cf zero-trust devices policies default certificates get` — Fetches device certificate provisioning.\n- `cf zero-trust devices policies default excludes get` — Fetches the list of routes excluded from the WARP client's tunnel.\n- `cf zero-trust devices policies default fallback-domains get` — Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.\n- `cf zero-trust devices policies default get` — Fetches the default device settings profile for an account.\n- `cf zero-trust devices policies default includes get` — Fetches the list of routes included in the WARP client's tunnel.\n- `cf zero-trust devices posture get <rule-id>` — Fetches a single device posture rule.\n- `cf zero-trust devices posture integrations get <integration-id>` — Fetches details for a single device posture integration.\n- `cf zero-trust devices posture integrations list` — Fetches the list of device posture integrations for an account.\n- `cf zero-trust devices posture list` — Fetches device posture rules for a Zero Trust account.\n- `cf zero-trust devices registrations get <registration-id>` — Fetches a single WARP registration.\n- `cf zero-trust devices registrations list` — Lists WARP registrations.\n- `cf zero-trust devices resilience global-warp-override get` — Fetch the Global WARP override state.\n- `cf zero-trust devices settings get` — Describes the current device settings for a Zero Trust account.\n- `cf zero-trust dex colos list` — List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.\n- `cf zero-trust dex commands eligible-devices list` — List devices with WARP client support for remote captures which have been connected in the last 1 hour.\n- `cf zero-trust dex commands list` — Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters\n- `cf zero-trust dex commands quota get` — Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset\n- `cf zero-trust dex commands results get <filename>` — Downloads artifacts for an executed command. Bulk downloads are not supported\n- `cf zero-trust dex devices aggregates live get` — Get details for live (up to 60 minutes) devices using WARP.\n- `cf zero-trust dex devices aggregates over-time get` — Get aggregate details for devices using WARP, up to 7 days.\n- `cf zero-trust dex devices get <device-id>` — Get the latest status of a device given device_id from the device_state table.\n- `cf zero-trust dex devices list` — List details of devices using WARP.\n- `cf zero-trust dex devices over-time get <device-id>` — Get time-bucketed status metrics for a specific device.\n- `cf zero-trust dex isps list` — List ISP information observed for a specific device during traceroute tests.\n- `cf zero-trust dex overview tests list` — List DEX tests with overview metrics.\n- `cf zero-trust dex overview tests unique-devices get` — Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.\n- `cf zero-trust dex rules get <rule-id>` — Get details for a DEX Rule.\n- `cf zero-trust dex rules list` — List DEX Rules.\n- `cf zero-trust dex test-results http get <test-id>` — Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results http percentiles get <test-id>` — Get percentiles for an http test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute get <test-id>` — Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex test-results traceroute network-path get <test-result-id>` — Get a breakdown of hops and performance metrics for a specific traceroute test run\n- `cf zero-trust dex test-results traceroute percentiles get <test-id>` — Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.\n- `cf zero-trust dex tests get <dex-test-id>` — Fetch a single DEX test.\n- `cf zero-trust dex tests list` — Fetch all DEX tests.\n- `cf zero-trust dex tests network-path get <test-id>` — Get a breakdown of metrics by hop for individual traceroute test runs.\n- `cf zero-trust dex warp-change-events list` — List WARP configuration and enablement toggle change events by device.\n- `cf zero-trust dlp custom-prompt-topics get <entry-id>` — Fetches a DLP custom prompt topic entry by ID.\n- `cf zero-trust dlp custom-prompt-topics list` — Lists all DLP custom prompt topic entries in an account.\n- `cf zero-trust dlp data-classes get <data-class-id>` — Gets the configuration for a data class.\n- `cf zero-trust dlp data-classes list` — Lists data classes configured for the account.\n- `cf zero-trust dlp data-tag-categories get <category-id>` — Gets a data tag category and its tags.\n- `cf zero-trust dlp data-tag-categories list` — Lists data tag categories configured for the account.\n- `cf zero-trust dlp data-tag-category-templates get <template-id>` — Gets an available data tag category template.\n- `cf zero-trust dlp data-tag-category-templates list` — Lists available data tag category templates.\n- `cf zero-trust dlp data-tags get <tag-id>` — Gets a data tag from a category.\n- `cf zero-trust dlp data-tags list` — Lists data tags in a category.\n- `cf zero-trust dlp datasets get <dataset-id>` — Gets a dataset and its latest upload status.\n- `cf zero-trust dlp datasets list` — Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.\n- `cf zero-trust dlp email account-mapping get` — Retrieves the email provider mapping configuration for DLP email scanning.\n- `cf zero-trust dlp email rules get <rule-id>` — Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.\n- `cf zero-trust dlp email rules list` — Lists all email scanner rules for an account.\n- `cf zero-trust dlp entries get <entry-id>` — Fetches a DLP entry by ID.\n- `cf zero-trust dlp entries list` — Lists all DLP entries in an account.\n- `cf zero-trust dlp limits list` — Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.\n- `cf zero-trust dlp payload-logs get` — Gets the current payload logging configuration for DLP, showing whether matched content is being logged.\n- `cf zero-trust dlp profiles custom get <profile-id>` — Fetches a custom DLP profile by id.\n- `cf zero-trust dlp profiles get <profile-id>` — Fetches a DLP profile by ID.\n- `cf zero-trust dlp profiles list` — Lists all DLP profiles in an account.\n- `cf zero-trust dlp profiles predefined get <profile-id>` — This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.\n- `cf zero-trust dlp sensitivity-group-templates get <template-id>` — Gets an available sensitivity group template.\n- `cf zero-trust dlp sensitivity-group-templates list` — Lists available sensitivity group templates.\n- `cf zero-trust dlp sensitivity-groups get <sensitivity-group-id>` — Gets a sensitivity group and its levels.\n- `cf zero-trust dlp sensitivity-groups list` — Lists sensitivity groups configured for the account.\n- `cf zero-trust dlp sensitivity-levels get <sensitivity-level-id>` — Gets a sensitivity level from a group.\n- `cf zero-trust dlp sensitivity-levels list` — Lists sensitivity levels in a sensitivity group.\n- `cf zero-trust gateway app-types list` — List all application and application type mappings.\n- `cf zero-trust gateway audit-ssh-settings get` — Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.\n- `cf zero-trust gateway categories list` — List all categories.\n- `cf zero-trust gateway certificates get <certificate-id>` — Get a single Zero Trust certificate.\n- `cf zero-trust gateway certificates list` — List all Zero Trust certificates for an account.\n- `cf zero-trust gateway configurations custom-certificate get` — Retrieve the current Zero Trust certificate configuration.\n- `cf zero-trust gateway configurations get` — Retrieve the current Zero Trust account configuration.\n- `cf zero-trust gateway dns-destination-ips list` — List Zero Trust Gateway IPv4 address pairs for an account.\n- `cf zero-trust gateway egress-cidr-pairs list` — Retrieve the list of egress CIDRs allocated to this Zero Trust account.\n- `cf zero-trust gateway list` — Retrieve information about the current Zero Trust account.\n- `cf zero-trust gateway lists get <list-id>` — Fetch a single Zero Trust list.\n- `cf zero-trust gateway lists items list` — Fetch all items in a single Zero Trust list.\n- `cf zero-trust gateway lists list` — Fetch all Zero Trust lists for an account.\n- `cf zero-trust gateway locations get <location-id>` — Get a single Zero Trust Gateway location.\n- `cf zero-trust gateway locations list` — List Zero Trust Gateway locations for an account.\n- `cf zero-trust gateway logging get` — Retrieve the current logging settings for the Zero Trust account.\n- `cf zero-trust gateway operations get <operation-id>` — Fetch a single Zero Trust Gateway operation by its ID.\n- `cf zero-trust gateway operations list` — List all Zero Trust Gateway operations for an account.\n- `cf zero-trust gateway pacfiles get <pacfile-id>` — Get a single Zero Trust Gateway PAC file.\n- `cf zero-trust gateway pacfiles list` — List all Zero Trust Gateway PAC files for an account.\n- `cf zero-trust gateway proxy-endpoints get <proxy-endpoint-id>` — Get a single Zero Trust Gateway proxy endpoint.\n- `cf zero-trust gateway proxy-endpoints list` — List all Zero Trust Gateway proxy endpoints for an account.\n- `cf zero-trust gateway rules get <rule-id>` — Get a single Zero Trust Gateway rule.\n- `cf zero-trust gateway rules list` — List Zero Trust Gateway rules for an account.\n- `cf zero-trust identity-providers get <identity-provider-id>` — Fetches a configured identity provider.\n- `cf zero-trust identity-providers list` — Lists all configured identity providers.\n- `cf zero-trust identity-providers scim groups list` — Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust identity-providers scim users list` — Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).\n- `cf zero-trust organizations doh get` — Returns the DoH settings for your Zero Trust organization.\n- `cf zero-trust organizations list` — Returns the configuration for your Zero Trust organization.\n- `cf zero-trust profiles custom list` — Lists all DLP custom profiles in an account.\n- `cf zero-trust profiles predefined get <profile-id>` — Fetches a predefined DLP profile by id.\n- `cf zero-trust risk-scoring behaviours get` — Retrieves configured risk score behaviors that define how user actions affect their overall risk score.\n- `cf zero-trust risk-scoring get <user-id>` — Retrieves the detailed risk score breakdown for a specific user, including contributing factors.\n- `cf zero-trust risk-scoring integrations get <integration-id>` — Gets a Zero Trust risk score integration by ID.\n- `cf zero-trust risk-scoring integrations list` — Lists all configured Zero Trust risk score integrations for the account.\n- `cf zero-trust risk-scoring integrations references get <reference-id>` — Retrieves a Zero Trust risk score integration using its external reference ID.\n- `cf zero-trust risk-scoring summary get` — Gets an aggregate summary of risk scores across the account, including distribution and trends.\n- `cf zero-trust settings get` — Gets the account-level DLP settings.\n\n### Create Operations\n\n- `cf zero-trust access applications cas create <app-id>` — Generates a new short-lived certificate CA and public key. (supports --dry-run)\n- `cf zero-trust access applications create` — Adds a new application to Access. (supports --dry-run, --body)\n- `cf zero-trust access applications policies create <app-id>` — Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array. (supports --dry-run, --body)\n- `cf zero-trust access applications policy-tests create` — Starts an Access policy test. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks create <bookmark-id>` — Create a new Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates create` — Adds a new mTLS root certificate to Access. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages create` — Create a custom page (supports --dry-run, --body)\n- `cf zero-trust access gateway-ca create` — Adds a new SSH Certificate Authority (CA). (supports --dry-run)\n- `cf zero-trust access groups create` — Creates a new Access group. (supports --dry-run, --body)\n- `cf zero-trust access idp-federation-grants create` — Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time. (supports --dry-run, --body)\n- `cf zero-trust access policies create` — Creates a new Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens create` — Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token. (supports --dry-run, --body)\n- `cf zero-trust access tags create` — Create a tag (supports --dry-run, --body)\n- `cf zero-trust access users create` — Creates a new user. (supports --dry-run, --body)\n- `cf zero-trust casb integrations create` — Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups create` — Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles create` — Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks create` — Creates a new device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom create` — Creates a device settings profile to be applied to certain devices matching the criteria. (supports --dry-run, --body)\n- `cf zero-trust devices posture create` — Creates a new device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations create` — Create a new device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices resilience global-warp-override create` — Sets the Global WARP override state. (supports --dry-run, --body)\n- `cf zero-trust dex commands create` — Initiate commands for up to 10 devices per account. (supports --dry-run, --body)\n- `cf zero-trust dex rules create` — Create a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests create` — Create a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp custom-prompt-topics create` — Creates a DLP custom prompt topic entry. (supports --dry-run, --body)\n- `cf zero-trust dlp data-classes create` — Creates a data class for use in DLP profiles. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tag-categories create` — Creates a data tag category, optionally from a template. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tags create <category-id>` — Creates a data tag in a category. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets create` — Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload create <dataset-id>` — Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists. (supports --dry-run)\n- `cf zero-trust dlp datasets versions create <version>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets versions entries create <entry-id>` — This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. (supports --dry-run, --body)\n- `cf zero-trust dlp email account-mapping create` — Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules create` — Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take. (supports --dry-run, --body)\n- `cf zero-trust dlp entries create` — Creates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration create` — Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined create` — Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom create` — Creates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined create <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups create` — Creates a sensitivity group, optionally from a template. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-levels create <sensitivity-group-id>` — Creates a sensitivity level in a group. (supports --dry-run, --body)\n- `cf zero-trust gateway certificates create` — Create a new Zero Trust certificate. (supports --dry-run, --body)\n- `cf zero-trust gateway create` — Create a Zero Trust account for an existing Cloudflare account. (supports --dry-run)\n- `cf zero-trust gateway lists create` — Creates a new Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations create` — Create a new Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles create` — Create a new Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints create` — Create a new Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules create` — Create a new Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust identity-providers create` — Adds a new identity provider to Access. (supports --dry-run, --body)\n- `cf zero-trust identity-providers saml-certificate create <identity-provider-id>` — Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider (supports --dry-run)\n- `cf zero-trust organizations create` — Sets up a Zero Trust organization for your account or zone. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined create` — Creates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations create` — Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zero-trust access applications policies update <policy-id>` — Updates an Access policy specific to an application. To update a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint. (supports --dry-run, --body)\n- `cf zero-trust access applications settings edit <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications settings update <app-id>` — Updates Access application settings. (supports --dry-run, --body)\n- `cf zero-trust access applications update <app-id>` — Updates an Access application. (supports --dry-run, --body)\n- `cf zero-trust access bookmarks update <bookmark-id>` — Updates a configured Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates settings update` — Updates an mTLS certificate's hostname settings. (supports --dry-run, --body)\n- `cf zero-trust access certificates update <certificate-id>` — Updates a configured mTLS certificate. (supports --dry-run, --body)\n- `cf zero-trust access custom-pages update <custom-page-id>` — Update a custom page (supports --dry-run, --body)\n- `cf zero-trust access groups update <group-id>` — Updates a configured Access group. (supports --dry-run, --body)\n- `cf zero-trust access keys update` — Updates the Access key rotation settings for an account. (supports --dry-run, --body)\n- `cf zero-trust access policies update <policy-id>` — Updates a Access reusable policy. (supports --dry-run, --body)\n- `cf zero-trust access service-tokens update <service-token-id>` — Updates a configured service token. (supports --dry-run, --body)\n- `cf zero-trust access tags update <tag-name>` — Update a tag (supports --dry-run, --body)\n- `cf zero-trust access users update <user-id>` — Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed). (supports --dry-run, --body)\n- `cf zero-trust apps policies make reusable update <policy-id>` — Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust apps review status update` — Update the statuses of your applications. (supports --dry-run, --body)\n- `cf zero-trust casb integrations update <id>` — Updates an integration's name, permissions, DLP profiles, use cases, or credentials. (supports --dry-run, --body)\n- `cf zero-trust connectivity-settings edit` — Updates the Zero Trust Connectivity Settings for the given account. (supports --dry-run, --body)\n- `cf zero-trust devices deployment groups update <group-id>` — Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta. (supports --dry-run, --body)\n- `cf zero-trust devices ip-profiles update <profile-id>` — Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated. (supports --dry-run, --body)\n- `cf zero-trust devices networks update <network-id>` — Updates a configured device managed network. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom edit <policy-id>` — Updates a configured device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom excludes update <policy-id>` — Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom fallback-domains update <policy-id>` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies custom includes update <policy-id>` — Sets the list of routes included in the WARP client's tunnel for a specific device settings profile. (supports --dry-run, --body)\n- `cf zero-trust devices policies default certificates edit` — Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session. (supports --dry-run, --body)\n- `cf zero-trust devices policies default edit` — Updates the default device settings profile for an account. (supports --dry-run, --body)\n- `cf zero-trust devices policies default excludes update` — Sets the list of routes excluded from the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices policies default fallback-domains update` — Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. (supports --dry-run, --body)\n- `cf zero-trust devices policies default includes update` — Sets the list of routes included in the WARP client's tunnel. (supports --dry-run, --body)\n- `cf zero-trust devices posture integrations edit <integration-id>` — Updates a configured device posture integration. (supports --dry-run, --body)\n- `cf zero-trust devices posture update <rule-id>` — Updates a device posture rule. (supports --dry-run, --body)\n- `cf zero-trust devices settings edit` — Patches the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust devices settings update` — Updates the current device settings for a Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust dex rules update <rule-id>` — Update a DEX Rule. (supports --dry-run, --body)\n- `cf zero-trust dex tests update <dex-test-id>` — Update a DEX test. (supports --dry-run, --body)\n- `cf zero-trust dlp custom-prompt-topics update <entry-id>` — Updates a DLP custom prompt topic entry. (supports --dry-run, --body)\n- `cf zero-trust dlp data-classes update <data-class-id>` — Updates the configuration for a data class. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tag-categories update <category-id>` — Updates a data tag category and its tags. (supports --dry-run, --body)\n- `cf zero-trust dlp data-tags update <tag-id>` — Updates a data tag in a category. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets update <dataset-id>` — Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings. (supports --dry-run, --body)\n- `cf zero-trust dlp datasets upload edit <version>` — This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched. (supports --dry-run, --body)\n- `cf zero-trust dlp email rules update <rule-id>` — Updates a DLP email scanning rule. (supports --dry-run, --body)\n- `cf zero-trust dlp entries custom update <entry-id>` — Updates a DLP custom entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries integration update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries predefined update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp entries update <entry-id>` — Updates a DLP entry. (supports --dry-run, --body)\n- `cf zero-trust dlp payload-logs update` — Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles custom update <profile-id>` — Updates a DLP custom profile. (supports --dry-run, --body)\n- `cf zero-trust dlp profiles predefined update <profile-id>` — This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups update <sensitivity-group-id>` — Updates a sensitivity group and its levels. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-levels update <sensitivity-level-id>` — Updates a sensitivity level in a group. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints update <document-fingerprint-id>` — Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents. (supports --dry-run, --body)\n- `cf zero-trust gateway audit-ssh-settings update` — Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations edit` — Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway configurations update` — Update the current Zero Trust account configuration. (supports --dry-run, --body)\n- `cf zero-trust gateway lists edit <list-id>` — Appends or removes an item from a configured Zero Trust list. (supports --dry-run, --body)\n- `cf zero-trust gateway lists update <list-id>` — Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list. (supports --dry-run, --body)\n- `cf zero-trust gateway locations update <location-id>` — Update a configured Zero Trust Gateway location. (supports --dry-run, --body)\n- `cf zero-trust gateway logging update` — Update logging settings for the current Zero Trust account. (supports --dry-run, --body)\n- `cf zero-trust gateway pacfiles update <pacfile-id>` — Update a configured Zero Trust Gateway PAC file. (supports --dry-run, --body)\n- `cf zero-trust gateway proxy-endpoints edit <proxy-endpoint-id>` — Update a configured Zero Trust Gateway proxy endpoint. (supports --dry-run, --body)\n- `cf zero-trust gateway rules edit <rule-id>` — Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement. (supports --dry-run, --body)\n- `cf zero-trust gateway rules update <rule-id>` — Update a configured Zero Trust Gateway rule. (supports --dry-run, --body)\n- `cf zero-trust identity-providers update <identity-provider-id>` — Updates a configured identity provider. (supports --dry-run, --body)\n- `cf zero-trust organizations doh update` — Updates the DoH settings for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust organizations update` — Updates the configuration for your Zero Trust organization. (supports --dry-run, --body)\n- `cf zero-trust profiles predefined update <profile-id>` — Updates a DLP predefined profile. Only supports enabling/disabling entries. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring behaviours update` — Updates risk score behavior configurations, defining weights and thresholds for risk calculation. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring integrations update <integration-id>` — Overwrite the reference_id, tenant_url, and active values with the ones provided. (supports --dry-run, --body)\n- `cf zero-trust seats edit` — Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false. (supports --dry-run, --body)\n- `cf zero-trust settings edit` — Missing fields keep their existing values. (supports --dry-run, --body)\n- `cf zero-trust settings update` — Missing fields are reset to initial (unconfigured) values. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zero-trust access applications cas delete <app-id>` — Deletes a short-lived certificate CA. (supports --dry-run)\n- `cf zero-trust access applications delete <app-id>` — Deletes an application from Access. (supports --dry-run)\n- `cf zero-trust access applications policies delete <policy-id>` — Deletes an Access policy specific to an application. To delete a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint. (supports --dry-run)\n- `cf zero-trust access bookmarks delete <bookmark-id>` — Deletes a Bookmark application. (supports --dry-run)\n- `cf zero-trust access certificates delete <certificate-id>` — Deletes an mTLS certificate. (supports --dry-run)\n- `cf zero-trust access custom-pages delete <custom-page-id>` — Delete a custom page (supports --dry-run)\n- `cf zero-trust access gateway-ca delete <certificate-id>` — Deletes an SSH Certificate Authority. (supports --dry-run)\n- `cf zero-trust access groups delete <group-id>` — Deletes an Access group. (supports --dry-run)\n- `cf zero-trust access idp-federation-grants delete <grant-id>` — Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts. (supports --dry-run)\n- `cf zero-trust access policies delete <policy-id>` — Deletes an Access reusable policy. (supports --dry-run)\n- `cf zero-trust access service-tokens delete <service-token-id>` — Deletes a service token. (supports --dry-run)\n- `cf zero-trust access tags delete <tag-name>` — Delete a tag (supports --dry-run)\n- `cf zero-trust access users delete <user-id>` — Deletes a specific user for an account. This will also revoke any active seats and tokens for the user. (supports --dry-run)\n- `cf zero-trust casb integrations delete <id>` — Delete an integration by soft-deleting it. (supports --dry-run)\n- `cf zero-trust devices delete <device-id>` — Deletes a WARP device. (supports --dry-run)\n- `cf zero-trust devices deployment groups delete <group-id>` — Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta. (supports --dry-run)\n- `cf zero-trust devices ip-profiles delete <profile-id>` — Delete a WARP Device IP profile. (supports --dry-run)\n- `cf zero-trust devices networks delete <network-id>` — Deletes a device managed network and fetches a list of the remaining device managed networks for an account. (supports --dry-run)\n- `cf zero-trust devices policies custom delete <policy-id>` — Deletes a device settings profile and fetches a list of the remaining profiles for an account. (supports --dry-run)\n- `cf zero-trust devices posture delete <rule-id>` — Deletes a device posture rule. (supports --dry-run)\n- `cf zero-trust devices posture integrations delete <integration-id>` — Delete a configured device posture integration. (supports --dry-run)\n- `cf zero-trust devices registrations delete <registration-id>` — Deletes a WARP registration. (supports --dry-run)\n- `cf zero-trust devices settings delete` — Resets the current device settings for a Zero Trust account. (supports --dry-run)\n- `cf zero-trust dex rules delete <rule-id>` — Delete a DEX Rule. (supports --dry-run)\n- `cf zero-trust dex tests delete <dex-test-id>` — Delete a Device DEX test. Returns the remaining device dex tests for the account. (supports --dry-run)\n- `cf zero-trust dlp custom-prompt-topics delete <entry-id>` — Deletes a DLP custom prompt topic entry. (supports --dry-run)\n- `cf zero-trust dlp data-classes delete <data-class-id>` — Deletes a data class from the account. (supports --dry-run)\n- `cf zero-trust dlp data-tag-categories delete <category-id>` — Deletes a data tag category and its tags. (supports --dry-run)\n- `cf zero-trust dlp data-tags delete <tag-id>` — Deletes a data tag from a category. (supports --dry-run)\n- `cf zero-trust dlp datasets delete <dataset-id>` — This deletes all versions of the dataset. (supports --dry-run)\n- `cf zero-trust dlp email rules delete <rule-id>` — Removes a DLP email scanning rule. The rule will no longer be applied to email messages. (supports --dry-run)\n- `cf zero-trust dlp entries delete <entry-id>` — Deletes a DLP custom entry. (supports --dry-run)\n- `cf zero-trust dlp entries integration delete <entry-id>` — This is a no-op as integration entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp entries predefined delete <entry-id>` — This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp profiles custom delete <profile-id>` — Deletes a DLP custom profile. (supports --dry-run)\n- `cf zero-trust dlp profiles predefined delete <profile-id>` — This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-groups delete <sensitivity-group-id>` — Deletes a sensitivity group and its levels. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-levels delete <sensitivity-level-id>` — Deletes a sensitivity level from a group. (supports --dry-run)\n- `cf zero-trust document-fingerprints delete <document-fingerprint-id>` — Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected. (supports --dry-run)\n- `cf zero-trust gateway certificates delete <certificate-id>` — Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it. (supports --dry-run)\n- `cf zero-trust gateway lists delete <list-id>` — Deletes a Zero Trust list. (supports --dry-run)\n- `cf zero-trust gateway locations delete <location-id>` — Delete a configured Zero Trust Gateway location. (supports --dry-run)\n- `cf zero-trust gateway pacfiles delete <pacfile-id>` — Delete a configured Zero Trust Gateway PAC file. (supports --dry-run)\n- `cf zero-trust gateway proxy-endpoints delete <proxy-endpoint-id>` — Delete a configured Zero Trust Gateway proxy endpoint. (supports --dry-run)\n- `cf zero-trust gateway rules delete <rule-id>` — Delete a Zero Trust Gateway rule. (supports --dry-run)\n- `cf zero-trust identity-providers delete <identity-provider-id>` — Deletes an identity provider from Access. (supports --dry-run)\n- `cf zero-trust risk-scoring integrations delete <integration-id>` — Removes a Zero Trust risk score integration, disconnecting the external risk signal source. (supports --dry-run)\n- `cf zero-trust settings delete` — Deletes account-level DLP settings and returns the initial values. (supports --dry-run)\n- `cf zero-trust users mfa authenticators delete <authenticator-id>` — Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result. (supports --dry-run)\n\n### Other Operations\n\n- `cf zero-trust access applications revoke-tokens <app-id>` — Revokes all tokens issued for an application. (supports --dry-run)\n- `cf zero-trust access custom-pages validate` — Validate a Liquid template and return its errors and warnings without persisting it. (supports --dry-run, --body)\n- `cf zero-trust access keys rotate` — Perfoms a key rotation for an account. (supports --dry-run)\n- `cf zero-trust access saml-certificates get-pem <saml-cert-set-id>` — Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration. (supports --dry-run)\n- `cf zero-trust access saml-certificates rotate <saml-cert-set-id>` — Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration. (supports --dry-run)\n- `cf zero-trust access service-tokens refresh <service-token-id>` — Refreshes the expiration of a service token. (supports --dry-run)\n- `cf zero-trust access service-tokens rotate <service-token-id>` — Generates a new Client Secret for a service token and revokes the old one. (supports --dry-run, --body)\n- `cf zero-trust casb integrations pause <id>` — Pauses an integration, stopping all crawlers. (supports --dry-run)\n- `cf zero-trust casb integrations resume <id>` — Resumes a paused integration, restarting crawlers. (supports --dry-run)\n- `cf zero-trust devices registrations bulk-delete` — Deletes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations revoke` — Revokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices registrations unrevoke` — Unrevokes a list of WARP registrations. (supports --dry-run)\n- `cf zero-trust devices revoke <device-id>` — Revokes all WARP registrations associated with the specified device. (supports --dry-run)\n- `cf zero-trust dlp email rules bulk-edit` — Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first. (supports --dry-run, --body)\n- `cf zero-trust dlp patterns validate` — Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`. (supports --dry-run, --body)\n- `cf zero-trust dlp sensitivity-groups get-level-order <sensitivity-group-id>` — Gets the current order of sensitivity levels in a group. (supports --dry-run)\n- `cf zero-trust dlp sensitivity-groups update-level-order <sensitivity-group-id>` — Updates the order of sensitivity levels in a group. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create document fingerprints` — Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints create v2 <document-fingerprint-id>` — Updates metadata for an existing document fingerprint, such as its name or description. (supports --dry-run, --body)\n- `cf zero-trust document-fingerprints get document fingerprints <document-fingerprint-id>` — Gets a document fingerprint and its latest upload status. (supports --dry-run)\n- `cf zero-trust document-fingerprints get fingerprints all` — Lists all document fingerprints configured for DLP scanning in the account. (supports --dry-run)\n- `cf zero-trust gateway audit-ssh-settings rotate-seed` — Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy. (supports --dry-run)\n- `cf zero-trust gateway certificates activate <certificate-id>` — Bind a single Zero Trust certificate to the edge. (supports --dry-run)\n- `cf zero-trust gateway certificates deactivate <certificate-id>` — Unbind a single Zero Trust certificate from the edge. (supports --dry-run)\n- `cf zero-trust gateway lists upload` — Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status. (supports --dry-run, --body)\n- `cf zero-trust gateway rules bulk-edit` — Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated. (supports --dry-run, --body)\n- `cf zero-trust gateway rules list-tenant` — List Zero Trust Gateway rules for the parent account of an account in the MSP configuration. (supports --dry-run)\n- `cf zero-trust gateway rules reset-expiration <rule-id>` — Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`. (supports --dry-run)\n- `cf zero-trust organizations revoke-users` — Revokes a user's access across all applications. (supports --dry-run, --body)\n- `cf zero-trust risk-scoring reset <user-id>` — Resets risk scores for specified users, clearing their accumulated risk history. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zone": "# zone — zone\n\n## Commands\n\n### Other Operations\n\n- `cf zone activate` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"zone-tags": "# zone-tags — zone-tags\n\n## Commands\n\n### Read Operations\n\n- `cf zone-tags get` — Retrieves tags for a specific zone-level resource.\n\n### Update Operations\n\n- `cf zone-tags update` — Creates or updates tags for a specific zone-level resource. Replaces all existing tags for the resource. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zone-tags delete` — Removes all tags from a specific zone-level resource. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Retrieves detailed information about a specific zone identified by its zone ID. Returns zone configuration, status, nameservers, and associated metadata.\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <plan-identifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <setting-id>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Creates a new zone (domain) in your Cloudflare account. The zone is created in a pending state and must be activated by updating your domain's nameservers to point to Cloudflare, or by completing the verification process for partial (CNAME) setups. (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. Zone holds cannot be enabled on CDN-only zones. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. Existing zone holds can be removed from CDN-only zones by setting `hold_after` to `null`. Other zone hold updates cannot be made on CDN-only zones. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <setting-id>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. Existing zone holds can be removed from CDN-only zones when `hold_after` is not provided. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run)\n- `cf zones subscriptions delete` — Deletes a zone's subscription. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
 	},
 	"universal": "# cf CLI Agent Guide\n\n## Authentication\n- Preferred: Set CLOUDFLARE_API_TOKEN environment variable\n- Alternative: `cf auth login` for OAuth flow\n- Verify: `cf auth whoami`\n\n## Output\n- All output is JSON; pipe through `jq` for transforms\n\n## Safety\n- Always use `--dry-run` before create/update/delete operations\n- Use `--body '{...}'` for complex request payloads\n- Verify zone resolution with `--quiet` disabled\n\n## Context Resolution\n\nAccount ID priority (highest to lowest):\n1. `CLOUDFLARE_ACCOUNT_ID` environment variable\n2. The named `settings` export in `cloudflare.config.ts`\n3. Cached or interactive account selection\n\nZone priority (highest to lowest):\n1. `--zone` / `-z` flag\n2. `CLOUDFLARE_ZONE_ID` environment variable\n\n## Introspection\n- `cf schema --list` — list all available API schemas\n- `cf schema dns records create` — get full request/response schema for a command\n- `cf agent-context [product]` — load agent skill files\n- `cf tools` — get MCP tool definitions\n\n## Error Handling\n- Non-zero exit codes indicate errors\n- Error details are in stderr\n- Check `cf auth whoami` if you get 401 errors\n"