{"openapi":"3.1.0","info":{"title":"Cloudflare Gateway Config (BYOK) API","version":"0.1.0","description":"Cloudflare Gateway Config (BYOK) lets an AI assistant read your own Cloudflare Gateway Config data through the Cloudflare Gateway Config API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 11 tools (get_gateway_account, get_gateway_configuration, list_content_categories, list_application_types, get_application_review_status, list_gateway_certificates,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-cloudflare-gateway-config.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-cloudflare-gateway-config/docs"},"termsOfService":"https://connectorbay.com/byok-cloudflare-gateway-config/terms"},"servers":[{"url":"https://byok-cloudflare-gateway-config.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-cloudflare-gateway-config/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/get_gateway_account":{"post":{"operationId":"get_gateway_account","summary":"Show the Zero Trust Gateway account id, gateway tag and provider name. Use for \"What is my Zero Trust Gateway tag\".","description":"Show the Zero Trust Gateway account id, gateway tag and provider name. Use for \"What is my Zero Trust Gateway tag\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"get_gateway_accountArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_gateway_configuration":{"post":{"operationId":"get_gateway_configuration","summary":"Get the Gateway account settings: TLS decryption, antivirus, browser isolation, protocol detection, body scanning, sandb","description":"Get the Gateway account settings: TLS decryption, antivirus, browser isolation, protocol detection, body scanning, sandbox, activity log, FIPS and maximum TTL. Use for \"Is TLS decryption enabled in my Gateway settings\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"get_gateway_configurationArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_content_categories":{"post":{"operationId":"list_content_categories","summary":"List the Gateway content and security categories with id, name, class (free, premium, blocked) and description. Subcateg","description":"List the Gateway content and security categories with id, name, class (free, premium, blocked) and description. Subcategories are left out. Use for \"Which content categories can Gateway block\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_content_categoriesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_application_types":{"post":{"operationId":"list_application_types","summary":"List the applications and application types Gateway knows, with ids and names. Use for \"Which applications can I target ","description":"List the applications and application types Gateway knows, with ids and names. Use for \"Which applications can I target in Gateway policies\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_application_typesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_application_review_status":{"post":{"operationId":"get_application_review_status","summary":"Show the Gateway application review lists: approved, in review and unapproved application ids. Use for \"Which applicatio","description":"Show the Gateway application review lists: approved, in review and unapproved application ids. Use for \"Which applications are approved or unapproved in Gateway\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"get_application_review_statusArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_gateway_certificates":{"post":{"operationId":"list_gateway_certificates","summary":"List Zero Trust certificates (custom and Gateway-managed) with type, binding status, expiry, fingerprint and issuer. The","description":"List Zero Trust certificates (custom and Gateway-managed) with type, binding status, expiry, fingerprint and issuer. The certificate text is left out. Use for \"When do my Gateway certificates expire\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_gateway_certificatesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_proxy_endpoints":{"post":{"operationId":"list_proxy_endpoints","summary":"List Gateway proxy endpoints (IP-based and identity-based) with kind, subdomain and allowed IPs. Use for \"Which Gateway ","description":"List Gateway proxy endpoints (IP-based and identity-based) with kind, subdomain and allowed IPs. Use for \"Which Gateway proxy endpoints are configured\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only endpoints whose name contains this text.","title":"Search"},"order_by":{"anyOf":[{"enum":["name","created_at","updated_at"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort field.","title":"Order By"},"direction":{"anyOf":[{"enum":["asc","desc"],"type":"string"},{"type":"null"}],"default":null,"description":"Sort direction.","title":"Direction"}},"required":["account_id"],"title":"list_proxy_endpointsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_pac_files":{"post":{"operationId":"list_pac_files","summary":"List Gateway PAC files with name, description, slug and URL. The file contents are left out. Use for \"Which PAC files ar","description":"List Gateway PAC files with name, description, slug and URL. The file contents are left out. Use for \"Which PAC files are configured in Gateway\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"per_page":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many PAC files per page (1 to 200).","title":"Per Page"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"}},"required":["account_id"],"title":"list_pac_filesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_logging_settings":{"post":{"operationId":"get_logging_settings","summary":"Show Gateway logging settings: whether PII is redacted and which rule types (DNS, HTTP, L4) are logged. Use for \"Does Ga","description":"Show Gateway logging settings: whether PII is redacted and which rule types (DNS, HTTP, L4) are logged. Use for \"Does Gateway redact PII in logs\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"get_logging_settingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_egress_ip_pairs":{"post":{"operationId":"list_egress_ip_pairs","summary":"List the Gateway egress IPv4 and IPv6 ranges assigned to the account with data center and geolocation. Use for \"Which eg","description":"List the Gateway egress IPv4 and IPv6 ranges assigned to the account with data center and geolocation. Use for \"Which egress IPs does Gateway use for my account\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_egress_ip_pairsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_dns_destination_ips":{"post":{"operationId":"list_dns_destination_ips","summary":"List the Gateway DNS destination IP address pairs (shared, dedicated or BYOIP). Use for \"Which DNS resolver IPs does my ","description":"List the Gateway DNS destination IP address pairs (shared, dedicated or BYOIP). Use for \"Which DNS resolver IPs does my Gateway use\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_dns_destination_ipsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}