> ## Documentation Index > Fetch the complete documentation index at: https://docs.atako.ai/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare > Connect Cloudflare to your Atako agents — 14 read and 4 write actions. Let your agents manage Cloudflare zones and DNS records, purge the cache, read zone settings and rulesets, and work with Workers, KV and Pages. ## Connection * **Authentication**: API key (API token). Sign in at dash.cloudflare.com → My Profile → API Tokens → Create Token. Start from the "Edit zone DNS" template or a custom token with the permissions you want your agents to have: Zone:Read, DNS:Edit, Cache Purge:Purge, Account Settings:Read, User Details:Read (for get\_user), Workers Scripts:Read, Workers KV Storage:Edit, Cloudflare Pages:Read. Cache purge needs an active zone (a pending zone answers 403). Scope it to the zones/accounts concerned, create it and copy the token (shown once). Do not use the Global API Key. See [Cloudflare's documentation](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). ## Read actions (14) | Action | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `get_kv_value` | Read the value stored under a KV key. Unlike every other action, the answer is the RAW value (text, or parsed JSON if the value is JSON), not the \{ success, result } envelope; an unknown key answers 404. | | `get_user` | Get the user who owns the token (needs a user-level permission; account-owned tokens get an error). Payload in `result` of the \{ success, errors, result } envelope. | | `get_zone` | Get one zone by zone\_id (status, name servers, plan, account). Payload in `result`. | | `get_zone_setting` | Read one zone setting by its id, e.g. "ssl", "always\_use\_https", "development\_mode", "cache\_level", "browser\_cache\_ttl", "min\_tls\_version", "security\_level". Returns result = \{ id, value, editable, modified\_on }. | | `list_accounts` | List the accounts the token can access — use result\[].id as account\_id for Workers, KV and Pages actions. Optional filters: name, page (1-based), per\_page (5–50, default 20), direction (asc\|desc). Payload in `result`, pagination in `result_info`. | | `list_dns_records` | List DNS records of a zone. Optional filters: type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA…), name (exact FQDN, e.g. "[www.example.com](http://www.example.com)"), content (exact value), proxied, search (free text over name/content), page (1-based), per\_page (default 100), order, direction. Payload in `result`, pagination in `result_info`. | | `list_kv_keys` | List the keys of a KV namespace (name, expiration, metadata — not the values). Optional: prefix, limit (10–1000, default 1000), cursor (from result\_info.cursor for the next page). | | `list_kv_namespaces` | List the Workers KV namespaces of an account (id, title). Optional: page (1-based), per\_page (1–1000, default 20), order (id\|title), direction. Payload in `result`, pagination in `result_info`. | | `list_pages_deployments` | List the deployments of a Pages project (id, url, environment, latest\_stage status, deployment\_trigger with branch/commit). Optional env (production\|preview), page, per\_page. Payload in `result`. | | `list_pages_projects` | List the Cloudflare Pages projects of an account (name, subdomain, domains, production branch, latest deployment). Optional page / per\_page. Payload in `result`. | | `list_workers` | List the Worker scripts of an account (metadata only: id, created\_on, modified\_on, handlers, routes…). Optional tags filter. Payload in `result`. | | `list_zone_rulesets` | List the rulesets of a zone (WAF, custom rules, redirects, transforms…), read-only. Cursor pagination: pass result\_info.cursor back as cursor; per\_page up to 50. | | `list_zones` | List zones (domains). Optional filters: name (domain, e.g. "example.com"), status (initializing\|pending\|active\|moved), account\_id (sent as account.id), page (1-based), per\_page (5–50, default 20), order, direction. Use result\[].id as zone\_id. Payload in `result`, pagination in `result_info`. | | `verify_token` | Verify the connected API token (probe, no arguments). Returns the Cloudflare envelope \{ success, errors, messages, result } with result = \{ id, status ("active"\|"disabled"\|"expired"), not\_before, expires\_on }. | ## Write actions (4) | Action | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `create_dns_record` | Create a DNS record. type: A\|AAAA\|CNAME\|TXT\|MX\|NS\|SRV; name: FQDN or "@" for the apex; content: the value (IPv4 for A, IPv6 for AAAA, hostname for CNAME/NS/MX, text for TXT) — required except for SRV; ttl: 1 = automatic, else 30–86400 s; proxied: route through Cloudflare (A/AAAA/CNAME only); priority: required for MX; data: \{ priority, weight, port, target } required for SRV (name like "\_sip.\_tcp.example.com"); comment: optional note. Returns the record in `result`. | | `purge_cache` | Purge cached content of a zone. Give exactly ONE of: purge\_everything (true) — everything; files — full URLs ("[https://example.com/app.css](https://example.com/app.css)"); tags — Cache-Tag values; hosts — hostnames; prefixes — URL prefixes without scheme ("example.com/blog/"). Returns result = \{ id }. | | `set_kv_value` | Write a text value under a KV key (creates or overwrites). key\_name (≤ 512 bytes), value (UTF-8 text, e.g. a JSON string you serialized), optional expiration\_ttl (seconds from now, ≥ 60) or expiration (UNIX timestamp). Sent through the KV bulk-write endpoint with a single item. Returns result = \{ successful\_key\_count, unsuccessful\_keys }. | | `update_dns_record` | Partially update a DNS record (PATCH): only the fields given change. Fields as in create\_dns\_record: type, name, content, ttl (1 = automatic), proxied, priority (MX), data (SRV), comment. Get dns\_record\_id from list\_dns\_records. Returns the record in `result`. | ## Permissions Every action above must be explicitly granted to an agent before it can be used. See [Permissions](/integrations/permissions) for the grant model and [Security](/integrations/security) for how credentials are protected. *** *Last reviewed against the provider API: September 2026.*