organizations

Creates, updates, deletes, gets or lists an organizations resource.

Overview

Name	organizations
Type	Resource
Id	cloudflare.zero_trust.organizations

Fields

The following fields are returned by SELECT queries:

list_by_account

Get your Zero Trust organization response

Name	Datatype	Description
name	string	The name of your Zero Trust organization. (example: Widget Corps Internal Applications)
allow_authenticate_via_warp	boolean	When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
auth_domain	string	The unique subdomain assigned to your Zero Trust organization. (example: test.cloudflareaccess.com)
auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login.
created_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
custom_pages	object
deny_unmatched_requests	boolean	Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
deny_unmatched_requests_exempted_zone_names	array	Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
is_ui_read_only	boolean	Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
login_design	object
mfa_config	object	Configures multi-factor authentication (MFA) settings for an organization.
mfa_required_for_all_apps	boolean	Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
mfa_ssh_piv_key_requirements	object	Configures SSH PIV key requirements for MFA using hardware security keys.
session_duration	string	The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. (example: 24h)
ui_read_only_toggle_reason	string	A description of the reason why the UI read only field is being toggled. (example: Temporarily turn off the UI read only lock to make a change via the UI, x-stainless-terraform-configurability: computed_optional)
updated_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
user_seat_expiration_inactive_time	string	The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. (example: 730h)
warp_auth_session_duration	string	The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. (example: 24h)

list_by_zone

Get your Zero Trust organization response

Name	Datatype	Description
name	string	The name of your Zero Trust organization. (example: Widget Corps Internal Applications)
allow_authenticate_via_warp	boolean	When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
auth_domain	string	The unique subdomain assigned to your Zero Trust organization. (example: test.cloudflareaccess.com)
auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login.
created_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
custom_pages	object
deny_unmatched_requests	boolean	Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
deny_unmatched_requests_exempted_zone_names	array	Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
is_ui_read_only	boolean	Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
login_design	object
mfa_config	object	Configures multi-factor authentication (MFA) settings for an organization.
mfa_required_for_all_apps	boolean	Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
mfa_ssh_piv_key_requirements	object	Configures SSH PIV key requirements for MFA using hardware security keys.
session_duration	string	The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. (example: 24h)
ui_read_only_toggle_reason	string	A description of the reason why the UI read only field is being toggled. (example: Temporarily turn off the UI read only lock to make a change via the UI, x-stainless-terraform-configurability: computed_optional)
updated_at	string (date-time)	(example: 2014-01-01T05:20:00.12345Z)
user_seat_expiration_inactive_time	string	The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. (example: 730h)
warp_auth_session_duration	string	The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. (example: 24h)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_by_account	select	account_id		Returns the configuration for your Zero Trust organization.
list_by_zone	select	zone_id		Returns the configuration for your Zero Trust organization.
create_by_account	insert	account_id, name, auth_domain		Sets up a Zero Trust organization for your account or zone.
create_by_zone	insert	zone_id, name, auth_domain		Sets up a Zero Trust organization for your account or zone.
update_by_account	replace	account_id		Updates the configuration for your Zero Trust organization.
update_by_zone	replace	zone_id		Updates the configuration for your Zero Trust organization.
revoke_users_by_account	exec	account_id, email	devices	Revokes a user's access across all applications.
revoke_users_by_zone	exec	zone_id, email	devices	Revokes a user's access across all applications.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
account_id	string	The Cloudflare account ID.
zone_id	string	The Cloudflare zone ID.
devices	boolean	When set to true, all devices associated with the user will be revoked.

SELECT examples

list_by_account

Returns the configuration for your Zero Trust organization.

SELECT
name,
allow_authenticate_via_warp,
auth_domain,
auto_redirect_to_identity,
created_at,
custom_pages,
deny_unmatched_requests,
deny_unmatched_requests_exempted_zone_names,
is_ui_read_only,
login_design,
mfa_config,
mfa_required_for_all_apps,
mfa_ssh_piv_key_requirements,
session_duration,
ui_read_only_toggle_reason,
updated_at,
user_seat_expiration_inactive_time,
warp_auth_session_duration
FROM cloudflare.zero_trust.organizations
WHERE account_id = '{{ account_id }}' -- required
;

list_by_zone

Returns the configuration for your Zero Trust organization.

SELECT
name,
allow_authenticate_via_warp,
auth_domain,
auto_redirect_to_identity,
created_at,
custom_pages,
deny_unmatched_requests,
deny_unmatched_requests_exempted_zone_names,
is_ui_read_only,
login_design,
mfa_config,
mfa_required_for_all_apps,
mfa_ssh_piv_key_requirements,
session_duration,
ui_read_only_toggle_reason,
updated_at,
user_seat_expiration_inactive_time,
warp_auth_session_duration
FROM cloudflare.zero_trust.organizations
WHERE zone_id = '{{ zone_id }}' -- required
;

INSERT examples

create_by_account

Sets up a Zero Trust organization for your account or zone.

INSERT INTO cloudflare.zero_trust.organizations (
allow_authenticate_via_warp,
auth_domain,
auto_redirect_to_identity,
deny_unmatched_requests,
deny_unmatched_requests_exempted_zone_names,
is_ui_read_only,
login_design,
mfa_config,
mfa_required_for_all_apps,
mfa_ssh_piv_key_requirements,
name,
session_duration,
ui_read_only_toggle_reason,
user_seat_expiration_inactive_time,
warp_auth_session_duration,
account_id
)
SELECT 
{{ allow_authenticate_via_warp }},
'{{ auth_domain }}' /* required */,
{{ auto_redirect_to_identity }},
{{ deny_unmatched_requests }},
'{{ deny_unmatched_requests_exempted_zone_names }}',
{{ is_ui_read_only }},
'{{ login_design }}',
'{{ mfa_config }}',
{{ mfa_required_for_all_apps }},
'{{ mfa_ssh_piv_key_requirements }}',
'{{ name }}' /* required */,
'{{ session_duration }}',
'{{ ui_read_only_toggle_reason }}',
'{{ user_seat_expiration_inactive_time }}',
'{{ warp_auth_session_duration }}',
'{{ account_id }}'
RETURNING
errors,
messages,
result,
success
;

create_by_zone

Sets up a Zero Trust organization for your account or zone.

INSERT INTO cloudflare.zero_trust.organizations (
allow_authenticate_via_warp,
auth_domain,
auto_redirect_to_identity,
deny_unmatched_requests,
deny_unmatched_requests_exempted_zone_names,
is_ui_read_only,
login_design,
mfa_config,
mfa_required_for_all_apps,
mfa_ssh_piv_key_requirements,
name,
session_duration,
ui_read_only_toggle_reason,
user_seat_expiration_inactive_time,
warp_auth_session_duration,
zone_id
)
SELECT 
{{ allow_authenticate_via_warp }},
'{{ auth_domain }}' /* required */,
{{ auto_redirect_to_identity }},
{{ deny_unmatched_requests }},
'{{ deny_unmatched_requests_exempted_zone_names }}',
{{ is_ui_read_only }},
'{{ login_design }}',
'{{ mfa_config }}',
{{ mfa_required_for_all_apps }},
'{{ mfa_ssh_piv_key_requirements }}',
'{{ name }}' /* required */,
'{{ session_duration }}',
'{{ ui_read_only_toggle_reason }}',
'{{ user_seat_expiration_inactive_time }}',
'{{ warp_auth_session_duration }}',
'{{ zone_id }}'
RETURNING
errors,
messages,
result,
success
;

Manifest

# Description fields are for documentation purposes
- name: organizations
props:
  - name: account_id
    value: "{{ account_id }}"
    description: Required parameter for the organizations resource.
  - name: zone_id
    value: "{{ zone_id }}"
    description: Required parameter for the organizations resource.
  - name: allow_authenticate_via_warp
    value: {{ allow_authenticate_via_warp }}
    description: |
      When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    default: false
  - name: auth_domain
    value: "{{ auth_domain }}"
    description: |
      The unique subdomain assigned to your Zero Trust organization.
  - name: auto_redirect_to_identity
    value: {{ auto_redirect_to_identity }}
    description: |
      When set to `true`, users skip the identity provider selection step during login.
    default: false
  - name: deny_unmatched_requests
    value: {{ deny_unmatched_requests }}
    description: |
      Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array.
  - name: deny_unmatched_requests_exempted_zone_names
    value:
      - "{{ deny_unmatched_requests_exempted_zone_names }}"
    description: |
      Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
  - name: is_ui_read_only
    value: {{ is_ui_read_only }}
    description: |
      Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    default: false
  - name: login_design
    value:
      background_color: "{{ background_color }}"
      footer_text: "{{ footer_text }}"
      header_text: "{{ header_text }}"
      logo_path: "{{ logo_path }}"
      text_color: "{{ text_color }}"
  - name: mfa_config
    description: |
      Configures multi-factor authentication (MFA) settings for an organization.
    value:
      allowed_authenticators:
        - "{{ allowed_authenticators }}"
      amr_matching_session_duration: "{{ amr_matching_session_duration }}"
      required_aaguids: "{{ required_aaguids }}"
      session_duration: "{{ session_duration }}"
  - name: mfa_required_for_all_apps
    value: {{ mfa_required_for_all_apps }}
    description: |
      Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    default: false
  - name: mfa_ssh_piv_key_requirements
    description: |
      Configures SSH PIV key requirements for MFA using hardware security keys.
    value:
      pin_policy: "{{ pin_policy }}"
      require_fips_device: {{ require_fips_device }}
      ssh_key_size:
        - {{ ssh_key_size }}
      ssh_key_type:
        - "{{ ssh_key_type }}"
      touch_policy: "{{ touch_policy }}"
  - name: name
    value: "{{ name }}"
    description: |
      The name of your Zero Trust organization.
  - name: session_duration
    value: "{{ session_duration }}"
    description: |
      The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.
  - name: ui_read_only_toggle_reason
    value: "{{ ui_read_only_toggle_reason }}"
    description: |
      A description of the reason why the UI read only field is being toggled.
  - name: user_seat_expiration_inactive_time
    value: "{{ user_seat_expiration_inactive_time }}"
    description: |
      The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.
  - name: warp_auth_session_duration
    value: "{{ warp_auth_session_duration }}"
    description: |
      The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h.

REPLACE examples

update_by_account

Updates the configuration for your Zero Trust organization.

REPLACE cloudflare.zero_trust.organizations
SET 
allow_authenticate_via_warp = {{ allow_authenticate_via_warp }},
auth_domain = '{{ auth_domain }}',
auto_redirect_to_identity = {{ auto_redirect_to_identity }},
custom_pages = '{{ custom_pages }}',
deny_unmatched_requests = {{ deny_unmatched_requests }},
deny_unmatched_requests_exempted_zone_names = '{{ deny_unmatched_requests_exempted_zone_names }}',
is_ui_read_only = {{ is_ui_read_only }},
login_design = '{{ login_design }}',
mfa_config = '{{ mfa_config }}',
mfa_required_for_all_apps = {{ mfa_required_for_all_apps }},
mfa_ssh_piv_key_requirements = '{{ mfa_ssh_piv_key_requirements }}',
name = '{{ name }}',
session_duration = '{{ session_duration }}',
ui_read_only_toggle_reason = '{{ ui_read_only_toggle_reason }}',
user_seat_expiration_inactive_time = '{{ user_seat_expiration_inactive_time }}',
warp_auth_session_duration = '{{ warp_auth_session_duration }}'
WHERE 
account_id = '{{ account_id }}' --required
RETURNING
errors,
messages,
result,
success;

update_by_zone

Updates the configuration for your Zero Trust organization.

REPLACE cloudflare.zero_trust.organizations
SET 
allow_authenticate_via_warp = {{ allow_authenticate_via_warp }},
auth_domain = '{{ auth_domain }}',
auto_redirect_to_identity = {{ auto_redirect_to_identity }},
custom_pages = '{{ custom_pages }}',
deny_unmatched_requests = {{ deny_unmatched_requests }},
deny_unmatched_requests_exempted_zone_names = '{{ deny_unmatched_requests_exempted_zone_names }}',
is_ui_read_only = {{ is_ui_read_only }},
login_design = '{{ login_design }}',
mfa_config = '{{ mfa_config }}',
mfa_required_for_all_apps = {{ mfa_required_for_all_apps }},
mfa_ssh_piv_key_requirements = '{{ mfa_ssh_piv_key_requirements }}',
name = '{{ name }}',
session_duration = '{{ session_duration }}',
ui_read_only_toggle_reason = '{{ ui_read_only_toggle_reason }}',
user_seat_expiration_inactive_time = '{{ user_seat_expiration_inactive_time }}',
warp_auth_session_duration = '{{ warp_auth_session_duration }}'
WHERE 
zone_id = '{{ zone_id }}' --required
RETURNING
errors,
messages,
result,
success;

Lifecycle Methods

revoke_users_by_account

Revokes a user's access across all applications.

EXEC cloudflare.zero_trust.organizations.revoke_users_by_account 
@account_id='{{ account_id }}' --required, 
@devices={{ devices }} 
@@json=
'{
"devices": {{ devices }}, 
"email": "{{ email }}", 
"user_uid": "{{ user_uid }}", 
"warp_session_reauth": {{ warp_session_reauth }}
}'
;

revoke_users_by_zone

Revokes a user's access across all applications.

EXEC cloudflare.zero_trust.organizations.revoke_users_by_zone 
@zone_id='{{ zone_id }}' --required, 
@devices={{ devices }} 
@@json=
'{
"devices": {{ devices }}, 
"email": "{{ email }}", 
"user_uid": "{{ user_uid }}", 
"warp_session_reauth": {{ warp_session_reauth }}
}'
;