> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

## After this article

You will be able to connect Cloudflare to Lumos to sync users and roles, and optionally provision access. The integration supports a read-only mode and a provisioning mode.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records |
| Roles | Permission | Yes | Yes | Roles in Cloudflare |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Delete | User | Delete a user in Cloudflare |

Account creation in Cloudflare is invite-based. When Lumos creates an account, it sends a Cloudflare member invitation and the membership sits pending until the user accepts. Assigning a role before the invite is accepted fails, so first-time role assignment for a new member waits until the account is active.

## Required plan and roles

* **Credentials:** a Cloudflare **API Token** created from a custom token template, plus your **Account ID**.
* **Token permissions (read-only):**
  * User → Memberships → Read
  * User → User Details → Read
  * Account → Access: Organizations, Identity Providers, and Groups → Read
  * Account → Account Settings → Read
* **Token permissions (provisioning):** add these on top of the read set:
  * Account → Account Settings → Edit
  * User → Memberships → Edit

## Read-only access vs provisioning

**Is read-only possible?** Yes. Create the API Token with only the four read permissions (User → Memberships → Read, User → User Details → Read, Account → Access: Organizations, Identity Providers, and Groups → Read, Account → Account Settings → Read) and the connection is read-only.

**What read-only requires.** A custom Cloudflare API Token scoped to the four read permissions above, plus your Account ID. Follow the steps below to create the token and connect.

**What full provisioning requires.** The same API Token with two additional Edit permissions on top of the read set, Account → Account Settings → Edit and User → Memberships → Edit.

**Watch out for.** Switching from read-only to provisioning means editing the same token's permissions (or issuing a new one), not reconnecting through a different card. Account creation in Cloudflare is invite-based, so a new member sits pending until they accept, and assigning a role before that happens fails until the next sync picks up the active account. The connector only manages account-wide roles, so members defined by a zone-scoped Domain Scoped Roles policy will reject role assignment.

## Instructions

**Phase 1: Create an API Token in Cloudflare**

1. Log into the Cloudflare dashboard and go to **My Profile → API Tokens**.
2. Create a new API Token. When prompted with templates, select **Create Custom Token**.
3. Add the permissions listed above (the read set for read-only, plus the Edit permissions for provisioning).
4. Save the token value.

**Phase 2: Find your Account ID**

1. Go to the Cloudflare dashboard. Once logged in, you land on a URL like `https://dash.cloudflare.com/ACCOUNT_ID`.
2. The `ACCOUNT_ID` portion of that URL is your Organization Account ID.

**Phase 3: Connect in Lumos**

1. Find the Cloudflare card in your Lumos integrations ([reconnect](https://app.lumosidentity.com/integrations?tab=connected) an existing card or [add a new one](https://app.lumosidentity.com/integrations?tab=can_integrate)).
2. Enter your API Token and Account ID.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Can't connect the integration.** Confirm the API Token carries all four read permissions, and that the Account ID matches the `ACCOUNT_ID` in your dashboard URL. For provisioning, the token also needs the two Edit permissions.

**Role assignment fails with 400 code 1001 "Invalid role assignments found".** The member is defined by a zone-scoped permission policy (Domain Scoped Roles) rather than account-wide roles. The connector manages account-wide roles only, so Cloudflare rejects the role update for policy-based members.

**A newly created account gets a 404 code 1003 "Member not found for account".** The role was assigned before the user accepted the Cloudflare invite. Wait for the user to accept, let the daily sync (or a manual sync) discover the active account, then the role assignment lands.

**Cloudflare access provisioned through OneLogin raises false "Automatic provisioning failed" error tasks.** The access actually succeeded. Older behavior polled OneLogin for up to 15 seconds to confirm the app auto-assigned, and slow propagation timed out and created a spurious error task. A fix removed the hard failure, and existing stale error tasks can be safely dismissed from the task center.