# IAM

# Permission Groups

## List Account Permission Groups

`client.IAM.PermissionGroups.List(ctx, params) (*V4PagePaginationArray[PermissionGroupListResponse], error)`

**get** `/accounts/{account_id}/iam/permission_groups`

List all the permissions groups for an account.

### Parameters

- `params PermissionGroupListParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `ID param.Field[string]`

    Query param: ID of the permission group to be fetched.

  - `Label param.Field[string]`

    Query param: Label of the permission group to be fetched.

  - `Name param.Field[string]`

    Query param: Name of the permission group to be fetched.

  - `Page param.Field[float64]`

    Query param: Page number of paginated results.

  - `PerPage param.Field[float64]`

    Query param: Maximum number of results per page.

### Returns

- `type PermissionGroupListResponse struct{…}`

  A named group of permissions that map to a group of operations against resources.

  - `ID string`

    Identifier of the permission group.

  - `Meta PermissionGroupListResponseMeta`

    Attributes associated to the permission group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the permission group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.IAM.PermissionGroups.List(context.TODO(), iam.PermissionGroupListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "c8fed203ed3043cba015a93ad1616f1f",
      "meta": {
        "key": "key",
        "value": "value"
      },
      "name": "Zone Read"
    },
    {
      "id": "82e64a83756745bbbb1c9c2701bf816b",
      "meta": {
        "key": "key",
        "value": "value"
      },
      "name": "Magic Network Monitoring"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```

## Permission Group Details

`client.IAM.PermissionGroups.Get(ctx, permissionGroupID, query) (*PermissionGroupGetResponse, error)`

**get** `/accounts/{account_id}/iam/permission_groups/{permission_group_id}`

Get information about a specific permission group in an account.

### Parameters

- `permissionGroupID string`

  Permission Group identifier tag.

- `query PermissionGroupGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type PermissionGroupGetResponse struct{…}`

  A named group of permissions that map to a group of operations against resources.

  - `ID string`

    Identifier of the permission group.

  - `Meta PermissionGroupGetResponseMeta`

    Attributes associated to the permission group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the permission group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  permissionGroup, err := client.IAM.PermissionGroups.Get(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.PermissionGroupGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", permissionGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
    "meta": {
      "key": "key",
      "value": "value"
    },
    "name": "Load Balancer"
  }
}
```

# Resource Groups

## List Resource Groups

`client.IAM.ResourceGroups.List(ctx, params) (*SinglePage[ResourceGroupListResponse], error)`

**get** `/accounts/{account_id}/iam/resource_groups`

List all the resource groups for an account.

### Parameters

- `params ResourceGroupListParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `ID param.Field[string]`

    Query param: ID of the resource group to be fetched.

  - `Name param.Field[string]`

    Query param: Name of the resource group to be fetched.

### Returns

- `type ResourceGroupListResponse struct{…}`

  A group of scoped resources.

  - `ID string`

    Identifier of the resource group.

  - `Scope []ResourceGroupListResponseScope`

    The scope associated to the resource group

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupListResponseScopeObject`

      A list of scope objects for additional context.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

  - `Meta ResourceGroupListResponseMeta`

    Attributes associated to the resource group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.IAM.ResourceGroups.List(context.TODO(), iam.ResourceGroupListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
      "scope": [
        {
          "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
          "objects": [
            {
              "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
            }
          ]
        }
      ],
      "meta": {
        "key": "key",
        "value": "value"
      },
      "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
    }
  ]
}
```

## Resource Group Details

`client.IAM.ResourceGroups.Get(ctx, resourceGroupID, query) (*ResourceGroupGetResponse, error)`

**get** `/accounts/{account_id}/iam/resource_groups/{resource_group_id}`

Get information about a specific resource group in an account.

### Parameters

- `resourceGroupID string`

  Resource Group identifier tag.

- `query ResourceGroupGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type ResourceGroupGetResponse struct{…}`

  A group of scoped resources.

  - `ID string`

    Identifier of the resource group.

  - `Scope []ResourceGroupGetResponseScope`

    The scope associated to the resource group

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupGetResponseScopeObject`

      A list of scope objects for additional context.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

  - `Meta ResourceGroupGetResponseMeta`

    Attributes associated to the resource group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  resourceGroup, err := client.IAM.ResourceGroups.Get(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.ResourceGroupGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", resourceGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
    "scope": [
      {
        "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
        "objects": [
          {
            "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
          }
        ]
      }
    ],
    "meta": {
      "key": "key",
      "value": "value"
    },
    "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
  }
}
```

## Create Resource Group

`client.IAM.ResourceGroups.New(ctx, params) (*ResourceGroupNewResponse, error)`

**post** `/accounts/{account_id}/iam/resource_groups`

Create a new Resource Group under the specified account.

### Parameters

- `params ResourceGroupNewParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Name param.Field[string]`

    Body param: Name of the resource group

  - `Scope param.Field[ResourceGroupNewParamsScope]`

    Body param: A scope is a combination of scope objects which provides additional context.

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupNewParamsScopeObject`

      A list of scope objects for additional context. The number of Scope objects should not be zero.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

### Returns

- `type ResourceGroupNewResponse struct{…}`

  A group of scoped resources.

  - `ID string`

    Identifier of the resource group.

  - `Scope []ResourceGroupNewResponseScope`

    The scope associated to the resource group

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupNewResponseScopeObject`

      A list of scope objects for additional context.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

  - `Meta ResourceGroupNewResponseMeta`

    Attributes associated to the resource group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  resourceGroup, err := client.IAM.ResourceGroups.New(context.TODO(), iam.ResourceGroupNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    Name: cloudflare.F("NewResourceGroup"),
    Scope: cloudflare.F(iam.ResourceGroupNewParamsScope{
      Key: cloudflare.F("com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"),
      Objects: cloudflare.F([]iam.ResourceGroupNewParamsScopeObject{iam.ResourceGroupNewParamsScopeObject{
        Key: cloudflare.F("com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"),
      }}),
    }),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", resourceGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
    "scope": [
      {
        "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
        "objects": [
          {
            "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
          }
        ]
      }
    ],
    "meta": {
      "key": "key",
      "value": "value"
    },
    "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
  }
}
```

## Update Resource Group

`client.IAM.ResourceGroups.Update(ctx, resourceGroupID, params) (*ResourceGroupUpdateResponse, error)`

**put** `/accounts/{account_id}/iam/resource_groups/{resource_group_id}`

Modify an existing resource group.

### Parameters

- `resourceGroupID string`

  Resource Group identifier tag.

- `params ResourceGroupUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Name param.Field[string]`

    Body param: Name of the resource group

  - `Scope param.Field[ResourceGroupUpdateParamsScope]`

    Body param: A scope is a combination of scope objects which provides additional context.

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupUpdateParamsScopeObject`

      A list of scope objects for additional context. The number of Scope objects should not be zero.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

### Returns

- `type ResourceGroupUpdateResponse struct{…}`

  A group of scoped resources.

  - `ID string`

    Identifier of the resource group.

  - `Scope []ResourceGroupUpdateResponseScope`

    The scope associated to the resource group

    - `Key string`

      This is a combination of pre-defined resource name and identifier (like Account ID etc.)

    - `Objects []ResourceGroupUpdateResponseScopeObject`

      A list of scope objects for additional context.

      - `Key string`

        This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

  - `Meta ResourceGroupUpdateResponseMeta`

    Attributes associated to the resource group.

    - `Key string`

    - `Value string`

  - `Name string`

    Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  resourceGroup, err := client.IAM.ResourceGroups.Update(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.ResourceGroupUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", resourceGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
    "scope": [
      {
        "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
        "objects": [
          {
            "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
          }
        ]
      }
    ],
    "meta": {
      "key": "key",
      "value": "value"
    },
    "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
  }
}
```

## Remove Resource Group

`client.IAM.ResourceGroups.Delete(ctx, resourceGroupID, body) (*ResourceGroupDeleteResponse, error)`

**delete** `/accounts/{account_id}/iam/resource_groups/{resource_group_id}`

Remove a resource group from an account.

### Parameters

- `resourceGroupID string`

  Resource Group identifier tag.

- `body ResourceGroupDeleteParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type ResourceGroupDeleteResponse struct{…}`

  - `ID string`

    Identifier

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  resourceGroup, err := client.IAM.ResourceGroups.Delete(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.ResourceGroupDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", resourceGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353"
  }
}
```

# User Groups

## List User Groups

`client.IAM.UserGroups.List(ctx, params) (*V4PagePaginationArray[UserGroupListResponse], error)`

**get** `/accounts/{account_id}/iam/user_groups`

List all the user groups for an account.

### Parameters

- `params UserGroupListParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `ID param.Field[string]`

    Query param: ID of the user group to be fetched.

  - `Direction param.Field[UserGroupListParamsDirection]`

    Query param: The sort order of returned user groups by name (ascending or descending).

    - `const UserGroupListParamsDirectionAsc UserGroupListParamsDirection = "asc"`

    - `const UserGroupListParamsDirectionDesc UserGroupListParamsDirection = "desc"`

  - `FuzzyName param.Field[string]`

    Query param: A string used for searching for user groups containing that substring.

  - `Name param.Field[string]`

    Query param: Name of the user group to be fetched.

  - `Page param.Field[float64]`

    Query param: Page number of paginated results.

  - `PerPage param.Field[float64]`

    Query param: Maximum number of results per page.

### Returns

- `type UserGroupListResponse struct{…}`

  A group of policies resources.

  - `ID string`

    User Group identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the user group

  - `ModifiedOn Time`

    Last time the user group was modified.

  - `Name string`

    Name of the user group.

  - `Policies []UserGroupListResponsePolicy`

    Policies attached to the User group

    - `ID string`

      Policy identifier.

    - `Access UserGroupListResponsePoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupListResponsePoliciesAccessAllow UserGroupListResponsePoliciesAccess = "allow"`

      - `const UserGroupListResponsePoliciesAccessDeny UserGroupListResponsePoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupListResponsePoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Identifier of the permission group.

      - `Meta UserGroupListResponsePoliciesPermissionGroupsMeta`

        Attributes associated to the permission group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the permission group.

    - `ResourceGroups []UserGroupListResponsePoliciesResourceGroup`

      A list of resource groups that the policy applies to.

      - `ID string`

        Identifier of the resource group.

      - `Scope []UserGroupListResponsePoliciesResourceGroupsScope`

        The scope associated to the resource group

        - `Key string`

          This is a combination of pre-defined resource name and identifier (like Account ID etc.)

        - `Objects []UserGroupListResponsePoliciesResourceGroupsScopeObject`

          A list of scope objects for additional context.

          - `Key string`

            This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

      - `Meta UserGroupListResponsePoliciesResourceGroupsMeta`

        Attributes associated to the resource group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.IAM.UserGroups.List(context.TODO(), iam.UserGroupListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "023e105f4ecef8ad9ca31a8372d0c353",
      "created_on": "2024-03-01T12:21:02.0000Z",
      "modified_on": "2024-03-01T12:21:02.0000Z",
      "name": "My New User Group",
      "policies": [
        {
          "id": "f267e341f3dd4697bd3b9f71dd96247f",
          "access": "allow",
          "permission_groups": [
            {
              "id": "c8fed203ed3043cba015a93ad1616f1f",
              "meta": {
                "key": "key",
                "value": "value"
              },
              "name": "Zone Read"
            },
            {
              "id": "82e64a83756745bbbb1c9c2701bf816b",
              "meta": {
                "key": "key",
                "value": "value"
              },
              "name": "Magic Network Monitoring"
            }
          ],
          "resource_groups": [
            {
              "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
              "scope": [
                {
                  "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
                  "objects": [
                    {
                      "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
                    }
                  ]
                }
              ],
              "meta": {
                "key": "key",
                "value": "value"
              },
              "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
            }
          ]
        }
      ]
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```

## User Group Details

`client.IAM.UserGroups.Get(ctx, userGroupID, query) (*UserGroupGetResponse, error)`

**get** `/accounts/{account_id}/iam/user_groups/{user_group_id}`

Get information about a specific user group in an account.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `query UserGroupGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type UserGroupGetResponse struct{…}`

  A group of policies resources.

  - `ID string`

    User Group identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the user group

  - `ModifiedOn Time`

    Last time the user group was modified.

  - `Name string`

    Name of the user group.

  - `Policies []UserGroupGetResponsePolicy`

    Policies attached to the User group

    - `ID string`

      Policy identifier.

    - `Access UserGroupGetResponsePoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupGetResponsePoliciesAccessAllow UserGroupGetResponsePoliciesAccess = "allow"`

      - `const UserGroupGetResponsePoliciesAccessDeny UserGroupGetResponsePoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupGetResponsePoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Identifier of the permission group.

      - `Meta UserGroupGetResponsePoliciesPermissionGroupsMeta`

        Attributes associated to the permission group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the permission group.

    - `ResourceGroups []UserGroupGetResponsePoliciesResourceGroup`

      A list of resource groups that the policy applies to.

      - `ID string`

        Identifier of the resource group.

      - `Scope []UserGroupGetResponsePoliciesResourceGroupsScope`

        The scope associated to the resource group

        - `Key string`

          This is a combination of pre-defined resource name and identifier (like Account ID etc.)

        - `Objects []UserGroupGetResponsePoliciesResourceGroupsScopeObject`

          A list of scope objects for additional context.

          - `Key string`

            This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

      - `Meta UserGroupGetResponsePoliciesResourceGroupsMeta`

        Attributes associated to the resource group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  userGroup, err := client.IAM.UserGroups.Get(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", userGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2024-03-01T12:21:02.0000Z",
    "modified_on": "2024-03-01T12:21:02.0000Z",
    "name": "My New User Group",
    "policies": [
      {
        "id": "f267e341f3dd4697bd3b9f71dd96247f",
        "access": "allow",
        "permission_groups": [
          {
            "id": "c8fed203ed3043cba015a93ad1616f1f",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Zone Read"
          },
          {
            "id": "82e64a83756745bbbb1c9c2701bf816b",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Magic Network Monitoring"
          }
        ],
        "resource_groups": [
          {
            "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
            "scope": [
              {
                "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
                "objects": [
                  {
                    "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
                  }
                ]
              }
            ],
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
          }
        ]
      }
    ]
  }
}
```

## Create User Group

`client.IAM.UserGroups.New(ctx, params) (*UserGroupNewResponse, error)`

**post** `/accounts/{account_id}/iam/user_groups`

Create a new user group under the specified account.

### Parameters

- `params UserGroupNewParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Name param.Field[string]`

    Body param: Name of the User group.

  - `Policies param.Field[[]UserGroupNewParamsPolicy]`

    Body param: Policies attached to the User group

    - `Access UserGroupNewParamsPoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupNewParamsPoliciesAccessAllow UserGroupNewParamsPoliciesAccess = "allow"`

      - `const UserGroupNewParamsPoliciesAccessDeny UserGroupNewParamsPoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupNewParamsPoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Permission Group identifier tag.

    - `ResourceGroups []UserGroupNewParamsPoliciesResourceGroup`

      A set of resource groups that are specified to the policy.

      - `ID string`

        Resource Group identifier tag.

### Returns

- `type UserGroupNewResponse struct{…}`

  A group of policies resources.

  - `ID string`

    User Group identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the user group

  - `ModifiedOn Time`

    Last time the user group was modified.

  - `Name string`

    Name of the user group.

  - `Policies []UserGroupNewResponsePolicy`

    Policies attached to the User group

    - `ID string`

      Policy identifier.

    - `Access UserGroupNewResponsePoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupNewResponsePoliciesAccessAllow UserGroupNewResponsePoliciesAccess = "allow"`

      - `const UserGroupNewResponsePoliciesAccessDeny UserGroupNewResponsePoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupNewResponsePoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Identifier of the permission group.

      - `Meta UserGroupNewResponsePoliciesPermissionGroupsMeta`

        Attributes associated to the permission group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the permission group.

    - `ResourceGroups []UserGroupNewResponsePoliciesResourceGroup`

      A list of resource groups that the policy applies to.

      - `ID string`

        Identifier of the resource group.

      - `Scope []UserGroupNewResponsePoliciesResourceGroupsScope`

        The scope associated to the resource group

        - `Key string`

          This is a combination of pre-defined resource name and identifier (like Account ID etc.)

        - `Objects []UserGroupNewResponsePoliciesResourceGroupsScopeObject`

          A list of scope objects for additional context.

          - `Key string`

            This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

      - `Meta UserGroupNewResponsePoliciesResourceGroupsMeta`

        Attributes associated to the resource group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  userGroup, err := client.IAM.UserGroups.New(context.TODO(), iam.UserGroupNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    Name: cloudflare.F("My New User Group"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", userGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2024-03-01T12:21:02.0000Z",
    "modified_on": "2024-03-01T12:21:02.0000Z",
    "name": "My New User Group",
    "policies": [
      {
        "id": "f267e341f3dd4697bd3b9f71dd96247f",
        "access": "allow",
        "permission_groups": [
          {
            "id": "c8fed203ed3043cba015a93ad1616f1f",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Zone Read"
          },
          {
            "id": "82e64a83756745bbbb1c9c2701bf816b",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Magic Network Monitoring"
          }
        ],
        "resource_groups": [
          {
            "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
            "scope": [
              {
                "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
                "objects": [
                  {
                    "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
                  }
                ]
              }
            ],
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
          }
        ]
      }
    ]
  }
}
```

## Update User Group

`client.IAM.UserGroups.Update(ctx, userGroupID, params) (*UserGroupUpdateResponse, error)`

**put** `/accounts/{account_id}/iam/user_groups/{user_group_id}`

Modify an existing user group.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `params UserGroupUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Name param.Field[string]`

    Body param: Name of the User group.

  - `Policies param.Field[[]UserGroupUpdateParamsPolicy]`

    Body param: Policies attached to the User group

    - `ID string`

      Policy identifier.

    - `Access UserGroupUpdateParamsPoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupUpdateParamsPoliciesAccessAllow UserGroupUpdateParamsPoliciesAccess = "allow"`

      - `const UserGroupUpdateParamsPoliciesAccessDeny UserGroupUpdateParamsPoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupUpdateParamsPoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Permission Group identifier tag.

    - `ResourceGroups []UserGroupUpdateParamsPoliciesResourceGroup`

      A set of resource groups that are specified to the policy.

      - `ID string`

        Resource Group identifier tag.

### Returns

- `type UserGroupUpdateResponse struct{…}`

  A group of policies resources.

  - `ID string`

    User Group identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the user group

  - `ModifiedOn Time`

    Last time the user group was modified.

  - `Name string`

    Name of the user group.

  - `Policies []UserGroupUpdateResponsePolicy`

    Policies attached to the User group

    - `ID string`

      Policy identifier.

    - `Access UserGroupUpdateResponsePoliciesAccess`

      Allow or deny operations against the resources.

      - `const UserGroupUpdateResponsePoliciesAccessAllow UserGroupUpdateResponsePoliciesAccess = "allow"`

      - `const UserGroupUpdateResponsePoliciesAccessDeny UserGroupUpdateResponsePoliciesAccess = "deny"`

    - `PermissionGroups []UserGroupUpdateResponsePoliciesPermissionGroup`

      A set of permission groups that are specified to the policy.

      - `ID string`

        Identifier of the permission group.

      - `Meta UserGroupUpdateResponsePoliciesPermissionGroupsMeta`

        Attributes associated to the permission group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the permission group.

    - `ResourceGroups []UserGroupUpdateResponsePoliciesResourceGroup`

      A list of resource groups that the policy applies to.

      - `ID string`

        Identifier of the resource group.

      - `Scope []UserGroupUpdateResponsePoliciesResourceGroupsScope`

        The scope associated to the resource group

        - `Key string`

          This is a combination of pre-defined resource name and identifier (like Account ID etc.)

        - `Objects []UserGroupUpdateResponsePoliciesResourceGroupsScopeObject`

          A list of scope objects for additional context.

          - `Key string`

            This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

      - `Meta UserGroupUpdateResponsePoliciesResourceGroupsMeta`

        Attributes associated to the resource group.

        - `Key string`

        - `Value string`

      - `Name string`

        Name of the resource group.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  userGroup, err := client.IAM.UserGroups.Update(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", userGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2024-03-01T12:21:02.0000Z",
    "modified_on": "2024-03-01T12:21:02.0000Z",
    "name": "My New User Group",
    "policies": [
      {
        "id": "f267e341f3dd4697bd3b9f71dd96247f",
        "access": "allow",
        "permission_groups": [
          {
            "id": "c8fed203ed3043cba015a93ad1616f1f",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Zone Read"
          },
          {
            "id": "82e64a83756745bbbb1c9c2701bf816b",
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "Magic Network Monitoring"
          }
        ],
        "resource_groups": [
          {
            "id": "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
            "scope": [
              {
                "key": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4",
                "objects": [
                  {
                    "key": "com.cloudflare.api.account.zone.23f8d65290b24279ba6f44721b3eaad5"
                  }
                ]
              }
            ],
            "meta": {
              "key": "key",
              "value": "value"
            },
            "name": "com.cloudflare.api.account.eb78d65290b24279ba6f44721b3ea3c4"
          }
        ]
      }
    ]
  }
}
```

## Remove User Group

`client.IAM.UserGroups.Delete(ctx, userGroupID, body) (*UserGroupDeleteResponse, error)`

**delete** `/accounts/{account_id}/iam/user_groups/{user_group_id}`

Remove a user group from an account.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `body UserGroupDeleteParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type UserGroupDeleteResponse struct{…}`

  - `ID string`

    Identifier

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  userGroup, err := client.IAM.UserGroups.Delete(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", userGroup.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353"
  }
}
```

# Members

## List User Group Members

`client.IAM.UserGroups.Members.List(ctx, userGroupID, params) (*V4PagePaginationArray[UserGroupMemberListResponse], error)`

**get** `/accounts/{account_id}/iam/user_groups/{user_group_id}/members`

List all the members attached to a user group.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `params UserGroupMemberListParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Direction param.Field[UserGroupMemberListParamsDirection]`

    Query param: The sort order of returned user group members by email.

    - `const UserGroupMemberListParamsDirectionAsc UserGroupMemberListParamsDirection = "asc"`

    - `const UserGroupMemberListParamsDirectionDesc UserGroupMemberListParamsDirection = "desc"`

  - `FuzzyEmail param.Field[string]`

    Query param: A string used for filtering members by partial email match.

  - `Page param.Field[float64]`

    Query param: Page number of paginated results.

  - `PerPage param.Field[float64]`

    Query param: Maximum number of results per page.

### Returns

- `type UserGroupMemberListResponse struct{…}`

  Member attached to a User Group.

  - `ID string`

    Account member identifier.

  - `Email string`

    The contact email address of the user.

  - `Status UserGroupMemberListResponseStatus`

    The member's status in the account.

    - `const UserGroupMemberListResponseStatusAccepted UserGroupMemberListResponseStatus = "accepted"`

    - `const UserGroupMemberListResponseStatusPending UserGroupMemberListResponseStatus = "pending"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.IAM.UserGroups.Members.List(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupMemberListParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "4f5f0c14a2a41d5063dd301b2f829f04",
      "email": "user@example.com",
      "status": "accepted"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```

## Get User Group Member

`client.IAM.UserGroups.Members.Get(ctx, userGroupID, memberID, query) (*UserGroupMemberGetResponse, error)`

**get** `/accounts/{account_id}/iam/user_groups/{user_group_id}/members/{member_id}`

Get details of a specific member in a user group.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `memberID string`

  The identifier of an existing account Member.

- `query UserGroupMemberGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type UserGroupMemberGetResponse struct{…}`

  Detailed member information for a User Group member.

  - `ID string`

    Account member identifier.

  - `CreatedAt Time`

    When the member was added to the user group.

  - `Email string`

    The contact email address of the user.

  - `Status UserGroupMemberGetResponseStatus`

    The member's status in the account.

    - `const UserGroupMemberGetResponseStatusAccepted UserGroupMemberGetResponseStatus = "accepted"`

    - `const UserGroupMemberGetResponseStatusPending UserGroupMemberGetResponseStatus = "pending"`

  - `User UserGroupMemberGetResponseUser`

    Details of the user associated with this membership.

    - `ID string`

      User identifier tag.

    - `Email string`

      The contact email address of the user.

    - `FirstName string`

      User's first name.

    - `LastName string`

      User's last name.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  member, err := client.IAM.UserGroups.Members.Get(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupMemberGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", member.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "4f5f0c14a2a41d5063dd301b2f829f04",
    "created_at": "2026-01-15T10:30:00Z",
    "email": "user@example.com",
    "status": "accepted",
    "user": {
      "id": "7c5dae5552338874e5053f2534d2767a",
      "email": "user@example.com",
      "first_name": "Alice",
      "last_name": "Smith"
    }
  }
}
```

## Add User Group Members

`client.IAM.UserGroups.Members.New(ctx, userGroupID, params) (*SinglePage[UserGroupMemberNewResponse], error)`

**post** `/accounts/{account_id}/iam/user_groups/{user_group_id}/members`

Add members to a User Group.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `params UserGroupMemberNewParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Members param.Field[[]UserGroupMemberNewParamsMember]`

    Body param

    - `ID string`

      The identifier of an existing account Member.

### Returns

- `type UserGroupMemberNewResponse struct{…}`

  Member attached to a User Group.

  - `ID string`

    Account member identifier.

  - `Email string`

    The contact email address of the user.

  - `Status UserGroupMemberNewResponseStatus`

    The member's status in the account.

    - `const UserGroupMemberNewResponseStatusAccepted UserGroupMemberNewResponseStatus = "accepted"`

    - `const UserGroupMemberNewResponseStatusPending UserGroupMemberNewResponseStatus = "pending"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.IAM.UserGroups.Members.New(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupMemberNewParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      Members: []iam.UserGroupMemberNewParamsMember{iam.UserGroupMemberNewParamsMember{
        ID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      }},
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "4f5f0c14a2a41d5063dd301b2f829f04",
      "email": "user@example.com",
      "status": "accepted"
    }
  ]
}
```

## Update User Group Members

`client.IAM.UserGroups.Members.Update(ctx, userGroupID, params) (*SinglePage[UserGroupMemberUpdateResponse], error)`

**put** `/accounts/{account_id}/iam/user_groups/{user_group_id}/members`

Replace the set of members attached to a User Group.

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `params UserGroupMemberUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Members param.Field[[]UserGroupMemberUpdateParamsMember]`

    Body param: Set/Replace members to a user group.

    - `ID string`

      The identifier of an existing account Member.

### Returns

- `type UserGroupMemberUpdateResponse struct{…}`

  Member attached to a User Group.

  - `ID string`

    Account member identifier.

  - `Email string`

    The contact email address of the user.

  - `Status UserGroupMemberUpdateResponseStatus`

    The member's status in the account.

    - `const UserGroupMemberUpdateResponseStatusAccepted UserGroupMemberUpdateResponseStatus = "accepted"`

    - `const UserGroupMemberUpdateResponseStatusPending UserGroupMemberUpdateResponseStatus = "pending"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.IAM.UserGroups.Members.Update(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupMemberUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      Members: []iam.UserGroupMemberUpdateParamsMember{iam.UserGroupMemberUpdateParamsMember{
        ID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      }},
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "4f5f0c14a2a41d5063dd301b2f829f04",
      "email": "user@example.com",
      "status": "accepted"
    }
  ]
}
```

## Remove User Group Member

`client.IAM.UserGroups.Members.Delete(ctx, userGroupID, memberID, body) (*UserGroupMemberDeleteResponse, error)`

**delete** `/accounts/{account_id}/iam/user_groups/{user_group_id}/members/{member_id}`

Remove a member from User Group

### Parameters

- `userGroupID string`

  User Group identifier tag.

- `memberID string`

  The identifier of an existing account Member.

- `body UserGroupMemberDeleteParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type UserGroupMemberDeleteResponse struct{…}`

  Member attached to a User Group.

  - `ID string`

    Account member identifier.

  - `Email string`

    The contact email address of the user.

  - `Status UserGroupMemberDeleteResponseStatus`

    The member's status in the account.

    - `const UserGroupMemberDeleteResponseStatusAccepted UserGroupMemberDeleteResponseStatus = "accepted"`

    - `const UserGroupMemberDeleteResponseStatusPending UserGroupMemberDeleteResponseStatus = "pending"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  member, err := client.IAM.UserGroups.Members.Delete(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.UserGroupMemberDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", member.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "4f5f0c14a2a41d5063dd301b2f829f04",
    "email": "user@example.com",
    "status": "accepted"
  }
}
```

# SSO

## Get all SSO connectors

`client.IAM.SSO.List(ctx, query) (*SinglePage[SSOListResponse], error)`

**get** `/accounts/{account_id}/sso_connectors`

Lists all SSO connectors configured for the account.

### Parameters

- `query SSOListParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type SSOListResponse struct{…}`

  - `ID string`

    SSO Connector identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the SSO connector

  - `EmailDomain string`

  - `Enabled bool`

  - `UpdatedOn Time`

    Timestamp for the last update of the SSO connector

  - `UseFedrampLanguage bool`

    Controls the display of FedRAMP language to the user during SSO login

  - `Verification SSOListResponseVerification`

    - `Code string`

      DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

    - `Status SSOListResponseVerificationStatus`

      The status of the verification code from the verification process.

      - `const SSOListResponseVerificationStatusAwaiting SSOListResponseVerificationStatus = "awaiting"`

      - `const SSOListResponseVerificationStatusPending SSOListResponseVerificationStatus = "pending"`

      - `const SSOListResponseVerificationStatusFailed SSOListResponseVerificationStatus = "failed"`

      - `const SSOListResponseVerificationStatusVerified SSOListResponseVerificationStatus = "verified"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.IAM.SSO.List(context.TODO(), iam.SSOListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "023e105f4ecef8ad9ca31a8372d0c353",
      "created_on": "2025-01-01T12:21:02.0000Z",
      "email_domain": "example.com",
      "enabled": false,
      "updated_on": "2025-01-01T12:21:02.0000Z",
      "use_fedramp_language": false,
      "verification": {
        "code": "cloudflare_dashboard_sso=023e105f4ecef8ad9ca31a8372d0c353",
        "status": "pending"
      }
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```

## Get single SSO connector

`client.IAM.SSO.Get(ctx, ssoConnectorID, query) (*SSOGetResponse, error)`

**get** `/accounts/{account_id}/sso_connectors/{sso_connector_id}`

Retrieves details for a specific SSO connector.

### Parameters

- `ssoConnectorID string`

  SSO Connector identifier tag.

- `query SSOGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type SSOGetResponse struct{…}`

  - `ID string`

    SSO Connector identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the SSO connector

  - `EmailDomain string`

  - `Enabled bool`

  - `UpdatedOn Time`

    Timestamp for the last update of the SSO connector

  - `UseFedrampLanguage bool`

    Controls the display of FedRAMP language to the user during SSO login

  - `Verification SSOGetResponseVerification`

    - `Code string`

      DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

    - `Status SSOGetResponseVerificationStatus`

      The status of the verification code from the verification process.

      - `const SSOGetResponseVerificationStatusAwaiting SSOGetResponseVerificationStatus = "awaiting"`

      - `const SSOGetResponseVerificationStatusPending SSOGetResponseVerificationStatus = "pending"`

      - `const SSOGetResponseVerificationStatusFailed SSOGetResponseVerificationStatus = "failed"`

      - `const SSOGetResponseVerificationStatusVerified SSOGetResponseVerificationStatus = "verified"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  sso, err := client.IAM.SSO.Get(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.SSOGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", sso.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2025-01-01T12:21:02.0000Z",
    "email_domain": "example.com",
    "enabled": false,
    "updated_on": "2025-01-01T12:21:02.0000Z",
    "use_fedramp_language": false,
    "verification": {
      "code": "cloudflare_dashboard_sso=023e105f4ecef8ad9ca31a8372d0c353",
      "status": "pending"
    }
  }
}
```

## Initialize new SSO connector

`client.IAM.SSO.New(ctx, params) (*SSONewResponse, error)`

**post** `/accounts/{account_id}/sso_connectors`

Creates a new SSO connector for logging into Cloudflare through an identity provider.

### Parameters

- `params SSONewParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `EmailDomain param.Field[string]`

    Body param: Email domain of the new SSO connector

  - `BeginVerification param.Field[bool]`

    Body param: Begin the verification process after creation

  - `UseFedrampLanguage param.Field[bool]`

    Body param: Controls the display of FedRAMP language to the user during SSO login

### Returns

- `type SSONewResponse struct{…}`

  - `ID string`

    SSO Connector identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the SSO connector

  - `EmailDomain string`

  - `Enabled bool`

  - `UpdatedOn Time`

    Timestamp for the last update of the SSO connector

  - `UseFedrampLanguage bool`

    Controls the display of FedRAMP language to the user during SSO login

  - `Verification SSONewResponseVerification`

    - `Code string`

      DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

    - `Status SSONewResponseVerificationStatus`

      The status of the verification code from the verification process.

      - `const SSONewResponseVerificationStatusAwaiting SSONewResponseVerificationStatus = "awaiting"`

      - `const SSONewResponseVerificationStatusPending SSONewResponseVerificationStatus = "pending"`

      - `const SSONewResponseVerificationStatusFailed SSONewResponseVerificationStatus = "failed"`

      - `const SSONewResponseVerificationStatusVerified SSONewResponseVerificationStatus = "verified"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  sso, err := client.IAM.SSO.New(context.TODO(), iam.SSONewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    EmailDomain: cloudflare.F("example.com"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", sso.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2025-01-01T12:21:02.0000Z",
    "email_domain": "example.com",
    "enabled": false,
    "updated_on": "2025-01-01T12:21:02.0000Z",
    "use_fedramp_language": false,
    "verification": {
      "code": "cloudflare_dashboard_sso=023e105f4ecef8ad9ca31a8372d0c353",
      "status": "pending"
    }
  }
}
```

## Update SSO connector state

`client.IAM.SSO.Update(ctx, ssoConnectorID, params) (*SSOUpdateResponse, error)`

**patch** `/accounts/{account_id}/sso_connectors/{sso_connector_id}`

Updates the state or configuration of an SSO connector.

### Parameters

- `ssoConnectorID string`

  SSO Connector identifier tag.

- `params SSOUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `Enabled param.Field[bool]`

    Body param: SSO Connector enabled state

  - `UseFedrampLanguage param.Field[bool]`

    Body param: Controls the display of FedRAMP language to the user during SSO login

### Returns

- `type SSOUpdateResponse struct{…}`

  - `ID string`

    SSO Connector identifier tag.

  - `CreatedOn Time`

    Timestamp for the creation of the SSO connector

  - `EmailDomain string`

  - `Enabled bool`

  - `UpdatedOn Time`

    Timestamp for the last update of the SSO connector

  - `UseFedrampLanguage bool`

    Controls the display of FedRAMP language to the user during SSO login

  - `Verification SSOUpdateResponseVerification`

    - `Code string`

      DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

    - `Status SSOUpdateResponseVerificationStatus`

      The status of the verification code from the verification process.

      - `const SSOUpdateResponseVerificationStatusAwaiting SSOUpdateResponseVerificationStatus = "awaiting"`

      - `const SSOUpdateResponseVerificationStatusPending SSOUpdateResponseVerificationStatus = "pending"`

      - `const SSOUpdateResponseVerificationStatusFailed SSOUpdateResponseVerificationStatus = "failed"`

      - `const SSOUpdateResponseVerificationStatusVerified SSOUpdateResponseVerificationStatus = "verified"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  sso, err := client.IAM.SSO.Update(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.SSOUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", sso.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "created_on": "2025-01-01T12:21:02.0000Z",
    "email_domain": "example.com",
    "enabled": false,
    "updated_on": "2025-01-01T12:21:02.0000Z",
    "use_fedramp_language": false,
    "verification": {
      "code": "cloudflare_dashboard_sso=023e105f4ecef8ad9ca31a8372d0c353",
      "status": "pending"
    }
  }
}
```

## Delete SSO connector

`client.IAM.SSO.Delete(ctx, ssoConnectorID, body) (*SSODeleteResponse, error)`

**delete** `/accounts/{account_id}/sso_connectors/{sso_connector_id}`

Deletes an SSO connector from the account.

### Parameters

- `ssoConnectorID string`

  SSO Connector identifier tag.

- `body SSODeleteParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type SSODeleteResponse struct{…}`

  - `ID string`

    Identifier

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  sso, err := client.IAM.SSO.Delete(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.SSODeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", sso.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353"
  }
}
```

## Begin SSO connector verification

`client.IAM.SSO.BeginVerification(ctx, ssoConnectorID, body) (*SSOBeginVerificationResponse, error)`

**post** `/accounts/{account_id}/sso_connectors/{sso_connector_id}/begin_verification`

Validates the user has added the DNS TXT record required for validating ownership of the domain they are trying to set up a connector for.

### Parameters

- `ssoConnectorID string`

  SSO Connector identifier tag.

- `body SSOBeginVerificationParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type SSOBeginVerificationResponse struct{…}`

  - `Errors []SSOBeginVerificationResponseError`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source SSOBeginVerificationResponseErrorsSource`

      - `Pointer string`

  - `Messages []SSOBeginVerificationResponseMessage`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source SSOBeginVerificationResponseMessagesSource`

      - `Pointer string`

  - `Success SSOBeginVerificationResponseSuccess`

    Whether the API call was successful.

    - `const SSOBeginVerificationResponseSuccessTrue SSOBeginVerificationResponseSuccess = true`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.IAM.SSO.BeginVerification(
    context.TODO(),
    "023e105f4ecef8ad9ca31a8372d0c353",
    iam.SSOBeginVerificationParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.Errors)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true
}
```

# OAuth Clients

## List OAuth Clients

`client.IAM.OAuthClients.List(ctx, query) (*SinglePage[OAuthClientListResponse], error)`

**get** `/accounts/{account_id}/oauth_clients`

List all OAuth clients for an account.

### Parameters

- `query OAuthClientListParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type OAuthClientListResponse struct{…}`

  Fields shared by OAuth client responses and create/update requests.

  - `ClientID string`

    The unique identifier for an OAuth client.

  - `Visibility OAuthClientListResponseVisibility`

    Visibility of the OAuth client.

    - `const OAuthClientListResponseVisibilityPublic OAuthClientListResponseVisibility = "public"`

    - `const OAuthClientListResponseVisibilityPrivate OAuthClientListResponseVisibility = "private"`

  - `AllowedCORSOrigins []string`

    Array of allowed CORS origins.

  - `ClientName string`

    Human-readable name of the OAuth client.

  - `ClientURI string`

    URL of the home page of the client.

  - `ClientURIVerification OAuthClientListResponseClientURIVerification`

    Client URI domain control verification state.

    - `Status OAuthClientListResponseClientURIVerificationStatus`

      Current verification status for the client URI host.

      - `const OAuthClientListResponseClientURIVerificationStatusPending OAuthClientListResponseClientURIVerificationStatus = "pending"`

      - `const OAuthClientListResponseClientURIVerificationStatusInProgress OAuthClientListResponseClientURIVerificationStatus = "in_progress"`

      - `const OAuthClientListResponseClientURIVerificationStatusVerified OAuthClientListResponseClientURIVerificationStatus = "verified"`

      - `const OAuthClientListResponseClientURIVerificationStatusFailed OAuthClientListResponseClientURIVerificationStatus = "failed"`

    - `Text string`

      Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

  - `CreatedAt Time`

    Timestamp when the OAuth client was created.

  - `GrantTypes []OAuthClientListResponseGrantType`

    Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientListResponseGrantTypeAuthorizationCode OAuthClientListResponseGrantType = "authorization_code"`

    - `const OAuthClientListResponseGrantTypeRefreshToken OAuthClientListResponseGrantType = "refresh_token"`

  - `HasRotatedSecret bool`

    Indicates whether the client has a rotated secret that has not yet been deleted.

  - `LogoURI string`

    URL of the client's logo.

  - `PolicyURI string`

    URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs []string`

    Array of allowed post-logout redirect URIs.

  - `PromotedAt Time`

    Timestamp when the OAuth client was promoted to public visibility.

  - `RedirectURIs []string`

    Array of allowed redirect URIs for the client.

  - `ResponseTypes []OAuthClientListResponseResponseType`

    Array of OAuth response types the client is allowed to use.

    - `const OAuthClientListResponseResponseTypeToken OAuthClientListResponseResponseType = "token"`

    - `const OAuthClientListResponseResponseTypeIDToken OAuthClientListResponseResponseType = "id_token"`

    - `const OAuthClientListResponseResponseTypeCode OAuthClientListResponseResponseType = "code"`

  - `Scopes []string`

    Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod OAuthClientListResponseTokenEndpointAuthMethod`

    The authentication method the client uses at the token endpoint.

    - `const OAuthClientListResponseTokenEndpointAuthMethodNone OAuthClientListResponseTokenEndpointAuthMethod = "none"`

    - `const OAuthClientListResponseTokenEndpointAuthMethodClientSecretBasic OAuthClientListResponseTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientListResponseTokenEndpointAuthMethodClientSecretPost OAuthClientListResponseTokenEndpointAuthMethod = "client_secret_post"`

  - `TosURI string`

    URL that points to a terms of service document.

  - `UpdatedAt Time`

    Timestamp when the OAuth client was last updated.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.IAM.OAuthClients.List(context.TODO(), iam.OAuthClientListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
      "visibility": "private",
      "allowed_cors_origins": [
        "https://example.com"
      ],
      "client_name": "My OAuth App",
      "client_uri": "https://example.com",
      "client_uri_verification": {
        "status": "in_progress",
        "text": "cloudflare_oauth_client_publisher=example"
      },
      "created_at": "2025-01-01T00:00:00Z",
      "grant_types": [
        "authorization_code",
        "refresh_token"
      ],
      "has_rotated_secret": false,
      "logo_uri": "https://example.com/logo.png",
      "policy_uri": "https://example.com/privacy",
      "post_logout_redirect_uris": [
        "https://example.com/logout"
      ],
      "promoted_at": "2026-05-13T12:00:00Z",
      "redirect_uris": [
        "https://example.com/callback"
      ],
      "response_types": [
        "code"
      ],
      "scopes": [
        "account.read"
      ],
      "token_endpoint_auth_method": "client_secret_post",
      "tos_uri": "https://example.com/tos",
      "updated_at": "2025-01-01T00:00:00Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```

## OAuth Client Details

`client.IAM.OAuthClients.Get(ctx, oauthClientID, query) (*OAuthClientGetResponse, error)`

**get** `/accounts/{account_id}/oauth_clients/{oauth_client_id}`

Get details of a specific OAuth client.

### Parameters

- `oauthClientID string`

  The unique identifier for an OAuth client.

- `query OAuthClientGetParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type OAuthClientGetResponse struct{…}`

  Fields shared by OAuth client responses and create/update requests.

  - `ClientID string`

    The unique identifier for an OAuth client.

  - `Visibility OAuthClientGetResponseVisibility`

    Visibility of the OAuth client.

    - `const OAuthClientGetResponseVisibilityPublic OAuthClientGetResponseVisibility = "public"`

    - `const OAuthClientGetResponseVisibilityPrivate OAuthClientGetResponseVisibility = "private"`

  - `AllowedCORSOrigins []string`

    Array of allowed CORS origins.

  - `ClientName string`

    Human-readable name of the OAuth client.

  - `ClientURI string`

    URL of the home page of the client.

  - `ClientURIVerification OAuthClientGetResponseClientURIVerification`

    Client URI domain control verification state.

    - `Status OAuthClientGetResponseClientURIVerificationStatus`

      Current verification status for the client URI host.

      - `const OAuthClientGetResponseClientURIVerificationStatusPending OAuthClientGetResponseClientURIVerificationStatus = "pending"`

      - `const OAuthClientGetResponseClientURIVerificationStatusInProgress OAuthClientGetResponseClientURIVerificationStatus = "in_progress"`

      - `const OAuthClientGetResponseClientURIVerificationStatusVerified OAuthClientGetResponseClientURIVerificationStatus = "verified"`

      - `const OAuthClientGetResponseClientURIVerificationStatusFailed OAuthClientGetResponseClientURIVerificationStatus = "failed"`

    - `Text string`

      Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

  - `CreatedAt Time`

    Timestamp when the OAuth client was created.

  - `GrantTypes []OAuthClientGetResponseGrantType`

    Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientGetResponseGrantTypeAuthorizationCode OAuthClientGetResponseGrantType = "authorization_code"`

    - `const OAuthClientGetResponseGrantTypeRefreshToken OAuthClientGetResponseGrantType = "refresh_token"`

  - `HasRotatedSecret bool`

    Indicates whether the client has a rotated secret that has not yet been deleted.

  - `LogoURI string`

    URL of the client's logo.

  - `PolicyURI string`

    URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs []string`

    Array of allowed post-logout redirect URIs.

  - `PromotedAt Time`

    Timestamp when the OAuth client was promoted to public visibility.

  - `RedirectURIs []string`

    Array of allowed redirect URIs for the client.

  - `ResponseTypes []OAuthClientGetResponseResponseType`

    Array of OAuth response types the client is allowed to use.

    - `const OAuthClientGetResponseResponseTypeToken OAuthClientGetResponseResponseType = "token"`

    - `const OAuthClientGetResponseResponseTypeIDToken OAuthClientGetResponseResponseType = "id_token"`

    - `const OAuthClientGetResponseResponseTypeCode OAuthClientGetResponseResponseType = "code"`

  - `Scopes []string`

    Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod OAuthClientGetResponseTokenEndpointAuthMethod`

    The authentication method the client uses at the token endpoint.

    - `const OAuthClientGetResponseTokenEndpointAuthMethodNone OAuthClientGetResponseTokenEndpointAuthMethod = "none"`

    - `const OAuthClientGetResponseTokenEndpointAuthMethodClientSecretBasic OAuthClientGetResponseTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientGetResponseTokenEndpointAuthMethodClientSecretPost OAuthClientGetResponseTokenEndpointAuthMethod = "client_secret_post"`

  - `TosURI string`

    URL that points to a terms of service document.

  - `UpdatedAt Time`

    Timestamp when the OAuth client was last updated.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  oauthClient, err := client.IAM.OAuthClients.Get(
    context.TODO(),
    "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    iam.OAuthClientGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", oauthClient.ClientID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    "visibility": "private",
    "allowed_cors_origins": [
      "https://example.com"
    ],
    "client_name": "My OAuth App",
    "client_uri": "https://example.com",
    "client_uri_verification": {
      "status": "in_progress",
      "text": "cloudflare_oauth_client_publisher=example"
    },
    "created_at": "2025-01-01T00:00:00Z",
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "has_rotated_secret": false,
    "logo_uri": "https://example.com/logo.png",
    "policy_uri": "https://example.com/privacy",
    "post_logout_redirect_uris": [
      "https://example.com/logout"
    ],
    "promoted_at": "2026-05-13T12:00:00Z",
    "redirect_uris": [
      "https://example.com/callback"
    ],
    "response_types": [
      "code"
    ],
    "scopes": [
      "account.read"
    ],
    "token_endpoint_auth_method": "client_secret_post",
    "tos_uri": "https://example.com/tos",
    "updated_at": "2025-01-01T00:00:00Z"
  }
}
```

## Create OAuth Client

`client.IAM.OAuthClients.New(ctx, params) (*OAuthClientNewResponse, error)`

**post** `/accounts/{account_id}/oauth_clients`

Create a new OAuth client for an account.

### Parameters

- `params OAuthClientNewParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `ClientName param.Field[string]`

    Body param: Human-readable name of the OAuth client.

  - `GrantTypes param.Field[[]OAuthClientNewParamsGrantType]`

    Body param: Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientNewParamsGrantTypeAuthorizationCode OAuthClientNewParamsGrantType = "authorization_code"`

    - `const OAuthClientNewParamsGrantTypeRefreshToken OAuthClientNewParamsGrantType = "refresh_token"`

  - `RedirectURIs param.Field[[]string]`

    Body param: Array of allowed redirect URIs for the client.

  - `ResponseTypes param.Field[[]OAuthClientNewParamsResponseType]`

    Body param: Array of OAuth response types the client is allowed to use.

    - `const OAuthClientNewParamsResponseTypeToken OAuthClientNewParamsResponseType = "token"`

    - `const OAuthClientNewParamsResponseTypeIDToken OAuthClientNewParamsResponseType = "id_token"`

    - `const OAuthClientNewParamsResponseTypeCode OAuthClientNewParamsResponseType = "code"`

  - `Scopes param.Field[[]string]`

    Body param: Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod param.Field[OAuthClientNewParamsTokenEndpointAuthMethod]`

    Body param: The authentication method the client uses at the token endpoint.

    - `const OAuthClientNewParamsTokenEndpointAuthMethodNone OAuthClientNewParamsTokenEndpointAuthMethod = "none"`

    - `const OAuthClientNewParamsTokenEndpointAuthMethodClientSecretBasic OAuthClientNewParamsTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientNewParamsTokenEndpointAuthMethodClientSecretPost OAuthClientNewParamsTokenEndpointAuthMethod = "client_secret_post"`

  - `AllowedCORSOrigins param.Field[[]string]`

    Body param: Array of allowed CORS origins.

  - `ClientURI param.Field[string]`

    Body param: URL of the home page of the client.

  - `LogoURI param.Field[string]`

    Body param: URL of the client's logo.

  - `PolicyURI param.Field[string]`

    Body param: URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs param.Field[[]string]`

    Body param: Array of allowed post-logout redirect URIs.

  - `TosURI param.Field[string]`

    Body param: URL that points to a terms of service document.

### Returns

- `type OAuthClientNewResponse struct{…}`

  Fields shared by OAuth client responses and create/update requests.

  - `ClientID string`

    The unique identifier for an OAuth client.

  - `Visibility OAuthClientNewResponseVisibility`

    Visibility of the OAuth client.

    - `const OAuthClientNewResponseVisibilityPublic OAuthClientNewResponseVisibility = "public"`

    - `const OAuthClientNewResponseVisibilityPrivate OAuthClientNewResponseVisibility = "private"`

  - `AllowedCORSOrigins []string`

    Array of allowed CORS origins.

  - `ClientName string`

    Human-readable name of the OAuth client.

  - `ClientSecret string`

    The client secret. This is the only time the secret is returned in a response.

  - `ClientURI string`

    URL of the home page of the client.

  - `ClientURIVerification OAuthClientNewResponseClientURIVerification`

    Client URI domain control verification state.

    - `Status OAuthClientNewResponseClientURIVerificationStatus`

      Current verification status for the client URI host.

      - `const OAuthClientNewResponseClientURIVerificationStatusPending OAuthClientNewResponseClientURIVerificationStatus = "pending"`

      - `const OAuthClientNewResponseClientURIVerificationStatusInProgress OAuthClientNewResponseClientURIVerificationStatus = "in_progress"`

      - `const OAuthClientNewResponseClientURIVerificationStatusVerified OAuthClientNewResponseClientURIVerificationStatus = "verified"`

      - `const OAuthClientNewResponseClientURIVerificationStatusFailed OAuthClientNewResponseClientURIVerificationStatus = "failed"`

    - `Text string`

      Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

  - `CreatedAt Time`

    Timestamp when the OAuth client was created.

  - `GrantTypes []OAuthClientNewResponseGrantType`

    Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientNewResponseGrantTypeAuthorizationCode OAuthClientNewResponseGrantType = "authorization_code"`

    - `const OAuthClientNewResponseGrantTypeRefreshToken OAuthClientNewResponseGrantType = "refresh_token"`

  - `HasRotatedSecret bool`

    Indicates whether the client has a rotated secret that has not yet been deleted.

  - `LogoURI string`

    URL of the client's logo.

  - `PolicyURI string`

    URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs []string`

    Array of allowed post-logout redirect URIs.

  - `PromotedAt Time`

    Timestamp when the OAuth client was promoted to public visibility.

  - `RedirectURIs []string`

    Array of allowed redirect URIs for the client.

  - `ResponseTypes []OAuthClientNewResponseResponseType`

    Array of OAuth response types the client is allowed to use.

    - `const OAuthClientNewResponseResponseTypeToken OAuthClientNewResponseResponseType = "token"`

    - `const OAuthClientNewResponseResponseTypeIDToken OAuthClientNewResponseResponseType = "id_token"`

    - `const OAuthClientNewResponseResponseTypeCode OAuthClientNewResponseResponseType = "code"`

  - `Scopes []string`

    Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod OAuthClientNewResponseTokenEndpointAuthMethod`

    The authentication method the client uses at the token endpoint.

    - `const OAuthClientNewResponseTokenEndpointAuthMethodNone OAuthClientNewResponseTokenEndpointAuthMethod = "none"`

    - `const OAuthClientNewResponseTokenEndpointAuthMethodClientSecretBasic OAuthClientNewResponseTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientNewResponseTokenEndpointAuthMethodClientSecretPost OAuthClientNewResponseTokenEndpointAuthMethod = "client_secret_post"`

  - `TosURI string`

    URL that points to a terms of service document.

  - `UpdatedAt Time`

    Timestamp when the OAuth client was last updated.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  oauthClient, err := client.IAM.OAuthClients.New(context.TODO(), iam.OAuthClientNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    ClientName: cloudflare.F("My OAuth App"),
    GrantTypes: cloudflare.F([]iam.OAuthClientNewParamsGrantType{iam.OAuthClientNewParamsGrantTypeAuthorizationCode, iam.OAuthClientNewParamsGrantTypeRefreshToken}),
    RedirectURIs: cloudflare.F([]string{"https://example.com/callback"}),
    ResponseTypes: cloudflare.F([]iam.OAuthClientNewParamsResponseType{iam.OAuthClientNewParamsResponseTypeCode}),
    Scopes: cloudflare.F([]string{"account.read"}),
    TokenEndpointAuthMethod: cloudflare.F(iam.OAuthClientNewParamsTokenEndpointAuthMethodClientSecretPost),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", oauthClient.ClientID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    "visibility": "private",
    "allowed_cors_origins": [
      "https://example.com"
    ],
    "client_name": "My OAuth App",
    "client_secret": "cf-oauth-secret-example",
    "client_uri": "https://example.com",
    "client_uri_verification": {
      "status": "in_progress",
      "text": "cloudflare_oauth_client_publisher=example"
    },
    "created_at": "2025-01-01T00:00:00Z",
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "has_rotated_secret": false,
    "logo_uri": "https://example.com/logo.png",
    "policy_uri": "https://example.com/privacy",
    "post_logout_redirect_uris": [
      "https://example.com/logout"
    ],
    "promoted_at": "2026-05-13T12:00:00Z",
    "redirect_uris": [
      "https://example.com/callback"
    ],
    "response_types": [
      "code"
    ],
    "scopes": [
      "account.read"
    ],
    "token_endpoint_auth_method": "client_secret_post",
    "tos_uri": "https://example.com/tos",
    "updated_at": "2025-01-01T00:00:00Z"
  }
}
```

## Update OAuth Client

`client.IAM.OAuthClients.Update(ctx, oauthClientID, params) (*OAuthClientUpdateResponse, error)`

**patch** `/accounts/{account_id}/oauth_clients/{oauth_client_id}`

Update an existing OAuth client. Only include fields you want to update.

### Parameters

- `oauthClientID string`

  The unique identifier for an OAuth client.

- `params OAuthClientUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Account identifier tag.

  - `AllowedCORSOrigins param.Field[[]string]`

    Body param: Array of allowed CORS origins.

  - `ClientName param.Field[string]`

    Body param: Human-readable name of the OAuth client.

  - `ClientURI param.Field[string]`

    Body param: URL of the home page of the client.

  - `GrantTypes param.Field[[]OAuthClientUpdateParamsGrantType]`

    Body param: Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientUpdateParamsGrantTypeAuthorizationCode OAuthClientUpdateParamsGrantType = "authorization_code"`

    - `const OAuthClientUpdateParamsGrantTypeRefreshToken OAuthClientUpdateParamsGrantType = "refresh_token"`

  - `LogoURI param.Field[string]`

    Body param: URL of the client's logo.

  - `PolicyURI param.Field[string]`

    Body param: URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs param.Field[[]string]`

    Body param: Array of allowed post-logout redirect URIs.

  - `RedirectURIs param.Field[[]string]`

    Body param: Array of allowed redirect URIs for the client.

  - `ResponseTypes param.Field[[]OAuthClientUpdateParamsResponseType]`

    Body param: Array of OAuth response types the client is allowed to use.

    - `const OAuthClientUpdateParamsResponseTypeToken OAuthClientUpdateParamsResponseType = "token"`

    - `const OAuthClientUpdateParamsResponseTypeIDToken OAuthClientUpdateParamsResponseType = "id_token"`

    - `const OAuthClientUpdateParamsResponseTypeCode OAuthClientUpdateParamsResponseType = "code"`

  - `Scopes param.Field[[]string]`

    Body param: Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod param.Field[OAuthClientUpdateParamsTokenEndpointAuthMethod]`

    Body param: The authentication method the client uses at the token endpoint.

    - `const OAuthClientUpdateParamsTokenEndpointAuthMethodNone OAuthClientUpdateParamsTokenEndpointAuthMethod = "none"`

    - `const OAuthClientUpdateParamsTokenEndpointAuthMethodClientSecretBasic OAuthClientUpdateParamsTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientUpdateParamsTokenEndpointAuthMethodClientSecretPost OAuthClientUpdateParamsTokenEndpointAuthMethod = "client_secret_post"`

  - `TosURI param.Field[string]`

    Body param: URL that points to a terms of service document.

  - `Visibility param.Field[OAuthClientUpdateParamsVisibility]`

    Body param: Promote the OAuth client from private to public visibility. Only `public` is accepted; demotion to `private` is not supported. Promotion requires a non-empty client name, logo URI, verified client URI host, and at least one non-identity scope.

    - `const OAuthClientUpdateParamsVisibilityPublic OAuthClientUpdateParamsVisibility = "public"`

### Returns

- `type OAuthClientUpdateResponse struct{…}`

  Fields shared by OAuth client responses and create/update requests.

  - `ClientID string`

    The unique identifier for an OAuth client.

  - `Visibility OAuthClientUpdateResponseVisibility`

    Visibility of the OAuth client.

    - `const OAuthClientUpdateResponseVisibilityPublic OAuthClientUpdateResponseVisibility = "public"`

    - `const OAuthClientUpdateResponseVisibilityPrivate OAuthClientUpdateResponseVisibility = "private"`

  - `AllowedCORSOrigins []string`

    Array of allowed CORS origins.

  - `ClientName string`

    Human-readable name of the OAuth client.

  - `ClientURI string`

    URL of the home page of the client.

  - `ClientURIVerification OAuthClientUpdateResponseClientURIVerification`

    Client URI domain control verification state.

    - `Status OAuthClientUpdateResponseClientURIVerificationStatus`

      Current verification status for the client URI host.

      - `const OAuthClientUpdateResponseClientURIVerificationStatusPending OAuthClientUpdateResponseClientURIVerificationStatus = "pending"`

      - `const OAuthClientUpdateResponseClientURIVerificationStatusInProgress OAuthClientUpdateResponseClientURIVerificationStatus = "in_progress"`

      - `const OAuthClientUpdateResponseClientURIVerificationStatusVerified OAuthClientUpdateResponseClientURIVerificationStatus = "verified"`

      - `const OAuthClientUpdateResponseClientURIVerificationStatusFailed OAuthClientUpdateResponseClientURIVerificationStatus = "failed"`

    - `Text string`

      Exact TXT record value that must be added to DNS to prove ownership of the client URI host.

  - `CreatedAt Time`

    Timestamp when the OAuth client was created.

  - `GrantTypes []OAuthClientUpdateResponseGrantType`

    Array of OAuth grant types the client is allowed to use. `authorization_code` is required; `refresh_token` may be included optionally.

    - `const OAuthClientUpdateResponseGrantTypeAuthorizationCode OAuthClientUpdateResponseGrantType = "authorization_code"`

    - `const OAuthClientUpdateResponseGrantTypeRefreshToken OAuthClientUpdateResponseGrantType = "refresh_token"`

  - `HasRotatedSecret bool`

    Indicates whether the client has a rotated secret that has not yet been deleted.

  - `LogoURI string`

    URL of the client's logo.

  - `PolicyURI string`

    URL that points to a privacy policy document.

  - `PostLogoutRedirectURIs []string`

    Array of allowed post-logout redirect URIs.

  - `PromotedAt Time`

    Timestamp when the OAuth client was promoted to public visibility.

  - `RedirectURIs []string`

    Array of allowed redirect URIs for the client.

  - `ResponseTypes []OAuthClientUpdateResponseResponseType`

    Array of OAuth response types the client is allowed to use.

    - `const OAuthClientUpdateResponseResponseTypeToken OAuthClientUpdateResponseResponseType = "token"`

    - `const OAuthClientUpdateResponseResponseTypeIDToken OAuthClientUpdateResponseResponseType = "id_token"`

    - `const OAuthClientUpdateResponseResponseTypeCode OAuthClientUpdateResponseResponseType = "code"`

  - `Scopes []string`

    Array of OAuth scopes the client is allowed to request. Colon-delimited scopes are not accepted. Dot-delimited scopes are validated against available OAuth API scopes; simple identity scopes are allowed. Protocol scopes `offline_access` and `openid` are added or removed automatically based on `grant_types` and `response_types`.

  - `TokenEndpointAuthMethod OAuthClientUpdateResponseTokenEndpointAuthMethod`

    The authentication method the client uses at the token endpoint.

    - `const OAuthClientUpdateResponseTokenEndpointAuthMethodNone OAuthClientUpdateResponseTokenEndpointAuthMethod = "none"`

    - `const OAuthClientUpdateResponseTokenEndpointAuthMethodClientSecretBasic OAuthClientUpdateResponseTokenEndpointAuthMethod = "client_secret_basic"`

    - `const OAuthClientUpdateResponseTokenEndpointAuthMethodClientSecretPost OAuthClientUpdateResponseTokenEndpointAuthMethod = "client_secret_post"`

  - `TosURI string`

    URL that points to a terms of service document.

  - `UpdatedAt Time`

    Timestamp when the OAuth client was last updated.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  oauthClient, err := client.IAM.OAuthClients.Update(
    context.TODO(),
    "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    iam.OAuthClientUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", oauthClient.ClientID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "client_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    "visibility": "private",
    "allowed_cors_origins": [
      "https://example.com"
    ],
    "client_name": "My OAuth App",
    "client_uri": "https://example.com",
    "client_uri_verification": {
      "status": "in_progress",
      "text": "cloudflare_oauth_client_publisher=example"
    },
    "created_at": "2025-01-01T00:00:00Z",
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ],
    "has_rotated_secret": false,
    "logo_uri": "https://example.com/logo.png",
    "policy_uri": "https://example.com/privacy",
    "post_logout_redirect_uris": [
      "https://example.com/logout"
    ],
    "promoted_at": "2026-05-13T12:00:00Z",
    "redirect_uris": [
      "https://example.com/callback"
    ],
    "response_types": [
      "code"
    ],
    "scopes": [
      "account.read"
    ],
    "token_endpoint_auth_method": "client_secret_post",
    "tos_uri": "https://example.com/tos",
    "updated_at": "2025-01-01T00:00:00Z"
  }
}
```

## Delete OAuth Client

`client.IAM.OAuthClients.Delete(ctx, oauthClientID, body) (*OAuthClientDeleteResponse, error)`

**delete** `/accounts/{account_id}/oauth_clients/{oauth_client_id}`

Delete an OAuth client.

### Parameters

- `oauthClientID string`

  The unique identifier for an OAuth client.

- `body OAuthClientDeleteParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type OAuthClientDeleteResponse struct{…}`

  - `ID string`

    Identifier

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  oauthClient, err := client.IAM.OAuthClients.Delete(
    context.TODO(),
    "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    iam.OAuthClientDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", oauthClient.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353"
  }
}
```

## Rotate OAuth Client Secret

`client.IAM.OAuthClients.RotateSecret(ctx, oauthClientID, body) (*OAuthClientRotateSecretResponse, error)`

**post** `/accounts/{account_id}/oauth_clients/{oauth_client_id}/rotate_secret`

Creates a second client secret so you can update your client configuration before deleting the old one. The `has_rotated_secret` field on the client will be set to `true`.

### Parameters

- `oauthClientID string`

  The unique identifier for an OAuth client.

- `body OAuthClientRotateSecretParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type OAuthClientRotateSecretResponse struct{…}`

  - `ClientSecret string`

    The new client secret.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.IAM.OAuthClients.RotateSecret(
    context.TODO(),
    "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    iam.OAuthClientRotateSecretParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ClientSecret)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "client_secret": "cf-oauth-secret-new-example"
  }
}
```

## Delete Rotated OAuth Client Secret

`client.IAM.OAuthClients.DeleteRotatedSecret(ctx, oauthClientID, body) (*OAuthClientDeleteRotatedSecretResponse, error)`

**delete** `/accounts/{account_id}/oauth_clients/{oauth_client_id}/rotate_secret`

Removes the old client secret after a rotation, keeping only the new one. Use this after you have updated your client configuration to use the new secret. The `has_rotated_secret` field on the client indicates whether there is an old secret to delete.

### Parameters

- `oauthClientID string`

  The unique identifier for an OAuth client.

- `body OAuthClientDeleteRotatedSecretParams`

  - `AccountID param.Field[string]`

    Account identifier tag.

### Returns

- `type OAuthClientDeleteRotatedSecretResponse struct{…}`

  - `ID string`

    Identifier

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/iam"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.IAM.OAuthClients.DeleteRotatedSecret(
    context.TODO(),
    "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    iam.OAuthClientDeleteRotatedSecretParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353"
  }
}
```

# OAuth Scopes

## List OAuth Scopes

`client.IAM.OAuthScopes.List(ctx) (*SinglePage[OAuthScopeListResponse], error)`

**get** `/oauth/scopes`

List all available OAuth scopes. This endpoint requires authentication but has no authorization role requirements.

### Returns

- `type OAuthScopeListResponse struct{…}`

  An available OAuth scope that can be assigned to an OAuth client.

  - `ID string`

    The scope label to use in the scopes array when creating or updating an OAuth client.

  - `Name string`

    Human-readable name of the OAuth scope.

  - `Category string`

    Category for grouping scopes in the UI.

  - `Scopes []string`

    The underlying resource scopes (Bach scopes) that define which resources this OAuth scope can act upon.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.IAM.OAuthScopes.List(context.TODO())
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "account.read",
      "name": "Account Read",
      "category": "account_and_billing",
      "scopes": [
        "com.cloudflare.api.account"
      ]
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
```