---
title: Core platform Changelog
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

Core platform

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 13, 2026
1. ### [Origin Content Signals for Markdown for Agents](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-13-markdown-for-agents-header-preservation/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
[Markdown for Agents](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) now preserves security- and cache-relevant response headers from your origin when converting HTML to Markdown:

  * Markdown for Agents preserves security headers such as `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Frame-Options`, `Set-Cookie`, and CORS headers (for example, `Access-Control-Allow-Origin`) on the converted response.
  * Caching headers (`Cache-Control`, `Expires`, `Age`) continue to pass through.  
Your origin's [Content Signals ↗](https://contentsignals.org/) policy is now authoritative. If your origin sets a `content-signal` header, Markdown for Agents preserves it. When the origin does not send one, Cloudflare adds the default `Content-Signal: ai-train=yes, search=yes, ai-input=yes`.  
This release also fixes relative link resolution for directory-style base URLs (those ending in a trailing slash). Previously, relative links such as `../page/` could resolve one path segment too high and return a `404`. Links are now resolved correctly per [RFC 3986 ↗](https://www.rfc-editor.org/rfc/rfc3986#section-5.2.3).  
Refer to our [developer documentation](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) for more details.

Jul 09, 2026
1. ### [Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-09-tunnel-routes-and-connections-api-changes/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
On **October 5, 2026**, two changes take effect across the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/) and [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/): the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the `connections` field. If you manage private network routes or read tunnel connection details through the API, `cloudflared`, Terraform, or another integration, review the changes in the following sections and migrate before the removal date.  
#### Route endpoints  
The CIDR-encoded route endpoints are deprecated in favor of the standard, `route_id`\-based endpoints that already exist today. Both sets of endpoints route a private network through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) or [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (the API still refers to Mesh nodes as `warp_connector`) — only the request shape changes.

**Deprecated endpoints (removed October 5, 2026):**

  * Create a tunnel route (CIDR Endpoint): [POST /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/create/)
  * Update a tunnel route (CIDR Endpoint): [PATCH /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/edit/)
  * Delete a tunnel route (CIDR Endpoint): [DELETE /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/delete/)

**Replacement endpoints:**

  * Create a tunnel route: [POST /accounts/{account\_id}/teamnet/routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/create/)
  * Update a tunnel route: [PATCH /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/edit/)
  * Delete a tunnel route: [DELETE /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/delete/)  
#### What is changing

|                  | Deprecated (CIDR-encoded path)                                 | Replacement                                                         |
| ---------------- | -------------------------------------------------------------- | ------------------------------------------------------------------- |
| Route identifier | URL-encoded CIDR in the path (/network/{ip\_network\_encoded}) | route\_id in the path (network moves to the request body on create) |
| Create           | POST .../teamnet/routes/network/{ip\_network\_encoded}         | POST .../teamnet/routes with network and tunnel\_id in the body     |
| Update           | PATCH .../teamnet/routes/network/{ip\_network\_encoded}        | PATCH .../teamnet/routes/{route\_id}                                |
| Delete           | DELETE .../teamnet/routes/network/{ip\_network\_encoded}       | DELETE .../teamnet/routes/{route\_id}                               |  
#### Action required

  1. Capture each route's `route_id` by calling [List tunnel routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/list/), or read it from the response the first time you create a route with the replacement endpoint.
  2. Update any scripts, backend services, or CI/CD pipelines that call the CIDR-encoded endpoints directly.
  3. If you manage routes with the `cloudflared tunnel route ip add | delete` commands, upgrade `cloudflared` to the [latest version ↗](https://github.com/cloudflare/cloudflared/releases).
  4. If you manage routes with Terraform, make sure you are on a current version of the [cloudflare\_zero\_trust\_tunnel\_cloudflared\_route ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Ftunnel%5Fcloudflared%5Froute) resource and the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs).  
```bash  
# Before: create a route by URL-encoding the CIDR into the path  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: create a route with the network in the request body  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: update or delete a route using its route_id  
curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"comment": "Updated comment for this route."}'  
curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
#### Cloudflare Tunnel and Cloudflare Mesh connections  
Starting the same day, the `connections` array is removed from list and get responses for [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes (the `cfd_tunnel` and `warp_connector` API resources). Query the dedicated connections endpoint instead of reading the field off the tunnel or node object.  
This affects:

  * [GET /accounts/{account\_id}/cfd\_tunnel](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/get/) — `connections` removed from `result`
  * [GET /accounts/{account\_id}/warp\_connector](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/get/) — `connections` removed from `result`  
#### Action required  
Fetch connection details from the tunnel-specific connections endpoint instead of parsing it off the list or get response. For Cloudflare Tunnel, call [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/subresources/connections/methods/get/). For Cloudflare Mesh, call [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/subresources/connections/methods/get/).  
```bash  
# Before: read connections off the tunnel object  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
# After: query connections directly  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
Update any dashboards, monitoring scripts, or automation that parses `connections` from the tunnel list or get response. `cloudflared` and the Cloudflare Terraform provider do not read this field, so no changes are required on their side for this part of the update.  
#### Why we are making these changes

  * **Smaller, faster responses.** Cloudflare Tunnel and Cloudflare Mesh nodes with many connections no longer inflate every list and get call — connection detail is only fetched when you need it.
  * **A single way to identify a route.** Consolidating on `route_id` removes the need to URL-encode CIDR ranges into the path and matches how every other resource in the Zero Trust Networks API is addressed.
  * **Consistency across the API.** Both changes align these endpoints with Cloudflare's standard REST conventions for resource identifiers and nested detail endpoints.  
To learn more, refer to the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/), the [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/), and [Routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/) documentation.

Jul 07, 2026
1. ### [New WebSocket Analytics Logpush dataset](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-07-websocket-analytics-dataset/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Enterprise customers can now push per-connection WebSocket analytics to any [Logpush destination](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/enable-destinations/) using the new `websocket_analytics` dataset. Each log record is emitted when a WebSocket connection closes and includes fields that were previously only available to Cloudflare engineers via internal tooling.  
Key fields include:

  * **`ConnectionCloseReason`** — why the connection ended: `peerReset`, `peerNoError`, `timedOut`, `upstreamReset`, `protocolViolation`, `unspecifiedError`, or `none`.
  * **`ConnectionCloseSource`** — which side initiated the close: `upstream`, `downstream`, `me`, or `both`.
  * **`ConnectionTransportCloseCode`** — the TLS alert code or TCP-level close code for additional precision.
  * **`RayID`** — correlate WebSocket connection events with your existing HTTP Request logs.  
The dataset also includes directional byte counts (`BytesSentClient`, `BytesReceivedClient`, `BytesSentOrigin`, `BytesReceivedOrigin`), connection timestamps, client IP, colo code, and request metadata from the original WebSocket upgrade.  
This data lets you build alerts on connection close patterns — for example, detecting spikes in TCP resets (`ConnectionCloseReason == "peerReset"`) grouped by host and data center — directly in your existing log analysis tools.  
For the full list of available fields, refer to [WebSocket Analytics](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/zone/websocket%5Fanalytics/).

Jul 02, 2026
1. ### [Updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-02-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### Updated fields in existing datasets

  * **Gateway DNS** (added): `AppliedMaxTTL` and `UpstreamRecordTTLs`.
  * **Gateway HTTP** (added): `Warnings`.
  * **HTTP requests** (added): `CacheLockWaitedMs`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

Jun 30, 2026
1. ### [New permissions and roles for Gateway policies and lists](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-gateway-granular-permissions/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now assign granular, resource-scoped roles for [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) firewall policies and [Zero Trust lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/). Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the following resource-scoped roles are now available:

| Role                                       | Description                                                                                 |
| ------------------------------------------ | ------------------------------------------------------------------------------------------- |
| Zero Trust Gateway Firewall Policies Admin | Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. |
| Zero Trust Gateway DNS Policies Admin      | Can view and edit Gateway DNS policies.                                                     |
| Zero Trust Gateway HTTP Policies Admin     | Can view and edit Gateway HTTP policies.                                                    |
| Zero Trust Gateway Network Policies Admin  | Can view and edit Gateway Network policies.                                                 |
| Zero Trust Gateway Egress Policies Admin   | Can view and edit Gateway Egress policies.                                                  |
| Zero Trust Gateway Resolver Policies Admin | Can view and edit Gateway Resolver policies.                                                |
| Zero Trust Gateway Policies Admin          | Can view and edit all Gateway policies.                                                     |
| Zero Trust Gateway Policies Read           | Can view all Gateway policies.                                                              |
| Zero Trust Gateway Read Only               | Can view all Gateway resources.                                                             |
| Zero Trust DNS Locations Admin             | Can view and edit DNS locations.                                                            |
| Zero Trust Proxy Endpoints Admin           | Can view and edit Gateway Proxy Endpoints.                                                  |
| Zero Trust Account Lists Admin             | Can view and edit all Gateway and Access lists.                                             |
| Zero Trust Account Lists Read              | Can view all Gateway and Access lists.                                                      |  
These roles allow you to:

  * Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.
  * Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.
  * Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.  
You can also now assign _Resource-scoped roles_. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. **Existing account-level roles continue to work.** A member with the `Cloudflare Gateway` or `Cloudflare Zero Trust` role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.  
#### Get started

  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.
  * Learn how to [create permission policies](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/) that use these roles.

Jun 30, 2026
1. ### [Account-scoped firewall events dataset in Logpush](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-account-level-firewall-events/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare Logpush now supports [firewall events as an account-scoped dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/). Configure a single Logpush job at the account level to receive firewall events for every zone in the account, instead of creating and maintaining a separate job per zone.  
The dataset includes a new [ZoneName](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/#zonename) field so you can identify which zone each event came from when consuming logs in your downstream pipeline.  
#### What's available

  * A new account-scoped `firewall_events` dataset, configurable via the [Logpush API](https://edgetunnel-b2h.pages.dev/api/resources/logpush/subresources/jobs/) or the Cloudflare dashboard.
  * The same fields and filter expressions supported by the existing [zone-scoped firewall events dataset](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/zone/firewall%5Fevents/), plus the new `ZoneName` field.
  * Support for all existing Logpush destinations.

Jun 25, 2026
1. ### [Search API tokens by name](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-25-api-token-search/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating.  
#### What's new

  * **Dashboard search**: Both [account API tokens ↗](https://dash.cloudflare.com/?to=/:account/account-api-tokens) and [user API tokens ↗](https://dash.cloudflare.com/profile/api-tokens) pages now include a search bar. Type a name to filter results.
  * **API search support**: The [/user/tokens](https://edgetunnel-b2h.pages.dev/api/resources/user/subresources/tokens/methods/list/) and [/accounts/{account\_id}/tokens](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/tokens/methods/list/) endpoints now accept a `name` query parameter to filter tokens by name.  
For more information, refer to [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) and [Account API tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/).

Jun 24, 2026
1. ### [Audit Logs v2 — Organization-level audit logs in Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-audit-logs-v2-organization-dashboard-ui/)  
[ Audit Logs ](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/review-audit-logs/)  
You can now, as an [Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/) Super Administrator, view organization-level [audit logs](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/) in the Cloudflare dashboard, in addition to the existing [API access](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/#organization-activity-logs).  
Organization audit logs help you monitor activity across your organization. You can see who performed an action, what changed, when it happened, how it was performed, and whether it succeeded or failed.  
You can filter and search logs by actor, action, result, resource, request details, and timestamp. Use these logs to troubleshoot changes, investigate unexpected access, and support security or compliance workflows.  
![Organization audit logs in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/Audit_logs_v2_organization_dashboard.De-uwPva_Z1QU6mw.webp)  
If you are viewing account-level audit logs and the account belongs to an organization where you are an Organization Super Administrator, select **View Organization Audit Logs** to open the parent organization's audit logs.  
![View Organization Audit Logs button](https://edgetunnel-b2h.pages.dev/_astro/Audit_logs_v2_view_organization_button.Ch7CaBB-_Z10mKrb.webp)  
To get started, go to **Organizations**, select your organization, then go to **Manage Organization** \> **Audit Logs**.  
For more information, refer to the [Audit Logs documentation](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/).

Jun 24, 2026
1. ### [New WebSocket Analytics Logpush dataset and updated fields](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-24-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### New datasets

  * **WebSocket Analytics**: A new dataset with fields including `BytesReceivedClient`, `BytesReceivedOrigin`, `BytesSentClient`, `BytesSentOrigin`, `ClientASN`, `ClientIP`, `ClientRequestHost`, `ClientRequestPath`, `ClientRequestUserAgent`, `ColoCode`, `ConnectionCloseReason`, `ConnectionCloseSource`, `ConnectionID`, `ConnectionTransportCloseCode`, `EdgeEndTimestamp`, `EdgeStartTimestamp`, and `RayID`.  
#### Updated fields in existing datasets

  * **Firewall events** (added): `ZoneName`. The Firewall events dataset is now also available for [account-scope Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/firewall%5Fevents/), in addition to the existing zone scope.
  * **Email Security Alerts** (added): `BCC`, `DKIMResult`, `DMARCPolicy`, `DMARCResult`, and `SPFResult`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

Jun 19, 2026
1. ### [Manage all your routes from one page in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-19-unified-routes-page/)  
[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
The **Routes** page in the Cloudflare dashboard now shows the routes across all of your connectors — [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) and [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) routes alongside [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) and [Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/) static routes — in a single table, instead of a separate routes view per product.  
![The unified Routes page in the Cloudflare dashboard, showing routes across connectors in a single table](https://edgetunnel-b2h.pages.dev/_astro/2026-06-19-unified-routes.B3igBY20_Z1awHp.webp)  
From the unified Routes page you can:

  * **Visualize your network with an interactive map** that shows how your destinations flow through to your connectors — including equal-cost multi-path (ECMP) routes where the same prefix is served by several connectors. Select a node to filter the table down to the routes behind it.
  * **See every route in one table**, with its destination, type, connector, priority, and source, and filter or sort to find what you need.
  * **Create, edit, and delete routes** of any supported type without leaving the page. When adding a Cloudflare WAN or Magic Transit static route, you now pick the next hop by **connector name** instead of typing its IP.
  * **Manage [virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/virtual-networks/)** from a dedicated tab.
  * **Test a route** to see which connector and next hop a destination resolves to before you commit a change.  
To find it, go to **Networking** \> **Routes** in the dashboard sidebar.  
[ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes)  
Your existing routes, APIs, and configurations are unchanged — this is a dashboard experience that brings them together in one place. Learn how to [add routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/add-routes/) and [manage virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/virtual-networks/).

Jun 12, 2026
1. ### [Terraform v5.20.0 now available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-12-terraform-v5200-provider/)  
[ Terraform ](https://edgetunnel-b2h.pages.dev/terraform/)  
Cloudflare's Terraform v5 Provider makes it easy for developers to manage their Cloudflare infrastructure using a configuration as code approach. It releases every [2-3 weeks ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5774) to ensure that you can always manage the latest features in the platform. This week, we launched Terraform v5.20.0, which adds 24 new resources, bumps the underlying Go SDK to cloudflare-go v7, and includes a range of bug fixes and state upgraders based on community feedback.  
#### New resources

  * **cloudflare\_ai\_search\_namespace:** Manage AI Search namespaces
  * **cloudflare\_custom\_csr:** Manage custom certificate signing requests
  * **cloudflare\_dls\_prefix\_binding:** Manage DLS regional service prefix bindings
  * **cloudflare\_flagship\_app:** Manage Flagship feature flag apps
  * **cloudflare\_flagship\_flag:** Manage Flagship feature flags
  * **cloudflare\_google\_tag\_gateway:** Manage Google Tag Gateway
  * **cloudflare\_load\_balancer\_monitor\_group:** Manage load balancer monitor groups
  * **cloudflare\_oauth\_client:** Manage IAM OAuth clients
  * **cloudflare\_origin\_cloud\_region:** Manage origin cloud regions (v2 endpoints)
  * **cloudflare\_secrets\_store:** Manage Secrets Store instances
  * **cloudflare\_secrets\_store\_secret:** Manage Secrets Store secrets
  * **cloudflare\_share:** Manage resource shares
  * **cloudflare\_share\_recipient:** Manage share recipients
  * **cloudflare\_share\_resource:** Manage shared resources
  * **cloudflare\_zero\_trust\_device\_deployment\_groups:** Manage Zero Trust device deployment groups
  * **cloudflare\_zero\_trust\_dlp\_data\_class:** Manage DLP data classes
  * **cloudflare\_zero\_trust\_dlp\_data\_tag:** Manage DLP data tags
  * **cloudflare\_zero\_trust\_dlp\_data\_tag\_category:** Manage DLP data tag categories
  * **cloudflare\_zero\_trust\_dlp\_sensitivity\_group:** Manage DLP sensitivity groups
  * **cloudflare\_zero\_trust\_dlp\_sensitivity\_level:** Manage DLP sensitivity levels
  * **cloudflare\_zero\_trust\_dlp\_sensitivity\_level\_order:** Manage DLP sensitivity level ordering
  * **cloudflare\_zero\_trust\_resource\_library\_application:** Manage Zero Trust resource library applications
  * **cloudflare\_zero\_trust\_resource\_library\_category:** Manage Zero Trust resource library categories
  * **cloudflare\_zero\_trust\_tunnel\_warp\_connector\_config:** Manage WARP connector tunnel configurations  
#### Features

  * **cache:** add create (POST) method for smart\_tiered\_cache
  * **cache:** update OPCR config to v2 endpoints
  * **dlp:** promote classification Stainless config to main
  * **dlp:** add custom prompt topics endpoint
  * **email\_security\_block\_sender:** state upgrader for v4 to v5 migration
  * **email\_security\_impersonation\_registry:** state upgrader for v4 to v5 migration
  * **email\_security\_trusted\_domains:** state upgrader for v4 to v5 migration
  * **snippets:** add Terraform `id_property` annotations for snippet and snippet\_rules
  * bump Go SDK to cloudflare-go v7  
#### Bug fixes

  * **account\_member:** missing upgrade path from v5.0–v5.15
  * **authenticated\_origin\_pulls\_settings:** nil pointer panic
  * **bot\_management:** restore `content_bots_protection` handling in model.go
  * **dns\_record:** prevent FQDN normalization from swallowing name shortening changes
  * **list:** nullify empty nested objects to prevent inconsistent result after apply
  * **load\_balancer\_pool:** accept early-v5 object-shape state at schema\_version=0
  * **load\_balancer\_pool:** add `UseStateForUnknown` for `load_shedding` attribute to prevent drift
  * **r2\_custom\_domain:** restore degraded-response handling in resource.go
  * **regional\_hostname:** update cloudflare-go imports from v6 to v7
  * **secrets\_store:** fix model/schema parity and guard acceptance tests
  * **spectrum\_application:** accept early-v5 object-shape state at schema\_version=0
  * **worker:** preserve `observability.traces.propagation_policy` across reads
  * **worker:** add `propagation_policy` to observability defaults
  * **worker\_version:** restore handwritten D1 `database_id` handling
  * **workers\_custom\_domain:** missing `CertId` field in state migration
  * **workers\_script:** restore annotations Read workaround stripped by codegen
  * **zero\_trust\_access\_identity\_provider:** change `read_only` from computed to optional
  * **zero\_trust\_access\_identity\_provider:** add `UseStateForUnknown` to SAML-only config fields
  * **zero\_trust\_access\_identity\_provider:** use `UseNonNullStateForUnknown` on scim\_config fields
  * **zero\_trust\_access\_policy:** populate `account_id` when migrating zone-scoped v4 state
  * **zero\_trust\_access\_policy:** missing `common_names` transform in migration
  * gracefully handle nil pointer dereference when config has `attributes_flat` during migration
  * set initial schema version to 500 for all new resources  
#### Refactors  
Extracted `MoveState` nil guard into shared helper  
#### For more information

  * [Terraform Provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs)
  * [Version 5 Migration Guide ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-migration)
  * [Documentation on using Terraform with Cloudflare](https://edgetunnel-b2h.pages.dev/terraform/)
  * [List of stabilized resources ↗](https://github.com/cloudflare/terraform-provider-cloudflare/issues/6237)

Jun 04, 2026
1. ### [Billable usage and budget alerts now in product sidebars](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-04-billable-usage-product-sidebar/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)[ D1 ](https://edgetunnel-b2h.pages.dev/d1/)[ R2 ](https://edgetunnel-b2h.pages.dev/r2/)[ KV ](https://edgetunnel-b2h.pages.dev/kv/)[ Queues ](https://edgetunnel-b2h.pages.dev/queues/)[ Vectorize ](https://edgetunnel-b2h.pages.dev/vectorize/)[ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/)[ Containers ](https://edgetunnel-b2h.pages.dev/containers/)  
Pay-as-you-go customers can now view billable usage and create [budget alerts](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) directly from the product overview pages for [Workers & Pages](https://edgetunnel-b2h.pages.dev/workers/), [D1](https://edgetunnel-b2h.pages.dev/d1/), [R2](https://edgetunnel-b2h.pages.dev/r2/), [Workers KV](https://edgetunnel-b2h.pages.dev/kv/), [Queues](https://edgetunnel-b2h.pages.dev/queues/), [Vectorize](https://edgetunnel-b2h.pages.dev/vectorize/), [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/), and [Containers](https://edgetunnel-b2h.pages.dev/containers/). A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.  
The widget pulls from the same data as the [Billable Usage dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) and aligns to your billing cycle (or the current day on Free plans), so the numbers match your invoice. Enterprise contract accounts are not yet supported.  
![Billable usage widget in the Durable Objects product sidebar showing current-period spend and a breakdown by service](https://edgetunnel-b2h.pages.dev/_astro/2026-06-04-billable-usage-product-sidebar.BUuIokn__ZAx1o6.webp)  
Selecting **Create budget alert** opens the budget alert flow inline so you can set a dollar threshold in the same place you are reviewing usage. Budget alerts apply to your total account-level spend across all products, not just the product page you create them from.  
For more information, refer to the [Usage-based billing documentation](https://edgetunnel-b2h.pages.dev/billing/).

Jun 03, 2026
1. ### [Introducing self-managed OAuth clients](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-03-public-oauth-clients/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.  
OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into that account.  
#### What is new  
Cloudflare Developers can now create and manage their own OAuth applications to integrate with Cloudflare.  
#### Create an application  
To create an application, go to **Manage account** \> **OAuth clients** in your account on the Cloudflare dashboard.  
[ Go to **OAuth clients** ](https://dash.cloudflare.com/?to=/:account/oauth-clients)  
#### Select limited scopes  
If you have used an API token to call Cloudflare APIs, OAuth client scopes will look familiar. Select only the scopes your application needs during application creation, and include that scope list when sending users to Cloudflare for consent.  
Users can review the requested scopes before they consent.  
#### Apps for both private and public use  
Applications start with `private` visibility. Private applications can only be used by members of the account where the application was created.  
To make an application available to any Cloudflare user, complete the prerequisites for `public` visibility.  
For more information, refer to [client visibility](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/create-an-oauth-client/#private-and-public-clients).  
#### Client domain verification  
Before an application can be made public, you must verify the client domain. Domain verification helps users confirm that the application owner controls the domain shown on the consent page.  
After verification, users see a verified badge on the consent page.  
For more information, refer to [domain verification](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/create-an-oauth-client/#client-url-domain-ownership-verification).  
#### Learn more  
For more information, refer to [OAuth clients](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/).

Jun 01, 2026
1. ### [New Turnstile Events Logpush dataset in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-01-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### New datasets

  * **Turnstile Events**: A new dataset with fields including `ASN`, `Action`, `BrowserMajor`, `BrowserName`, `ClientIP`, `CountryCode`, `EventType`, `Hostname`, `OSMajor`, `OSName`, `Sitekey`, `Timestamp`, and `UserAgent`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

May 29, 2026
1. ### [Updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### Updated fields in existing datasets

  * **DEX Device State Events** (added): `DeviceRegistrationProfileID`.
  * **Gateway HTTP** (added): `AddedHeaders`, `DeletedHeaders`, and `SetHeaders`.
  * **HTTP requests** (added): `MatchedRules`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

May 27, 2026
1. ### [Cloudflare Tunnel now runs connectivity pre-checks at startup](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudflared-connectivity-prechecks/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting with [cloudflared version 2026.5.2 ↗](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) automates the entire [connectivity pre-checks workflow](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked.  
![cloudflared connectivity pre-checks output](https://edgetunnel-b2h.pages.dev/_astro/cloudflared-connectivity-prechecks.DRwN6tGe_c1XGu.webp)  
On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks:

  * **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs.
  * **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`.
  * **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates.  
Results are printed in a scannable CLI table with three states:

  * ✅ **Pass** — the check succeeded.
  * ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up.
  * ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`).  
If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors.  
Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide.  
To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/).

May 21, 2026
1. ### [Modernized Billing Profile with new payment options](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-modernised-billing-profile/)  
[ Billing ](https://edgetunnel-b2h.pages.dev/billing/)  
The [Billing Profile](https://edgetunnel-b2h.pages.dev/billing/get-started/update-billing-info/) now has a modern UI and a single space that unifies billing information, payment method management and an enhanced subscriptions view under a single **Subscriptions** tab.  
#### What changed  
The **Subscriptions** tab brings billing information, payment method management, and your subscriptions together in one place. The payment management and **Pay overdue balances** flows now use the latest checkout as product purchase flows, so you can pay with Apple Pay, Google Pay, Link, and [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/) alongside cards and PayPal.  
New cards complete 3D Secure authentication when the issuer requires it — for example, the EU under PSD2 and India under RBI.  
![Modernized Billing Profile with the Subscriptions tab](https://edgetunnel-b2h.pages.dev/_astro/2026-05-21-modernised-billing-profile.D6PysUnl_Z1dpUam.webp)  
For details, refer to the [Billing Home](https://edgetunnel-b2h.pages.dev/billing/) documentation.

May 21, 2026
1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can:

  * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
  * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
  * Scope a single policy to one or many Tunnels and Mesh nodes at once.  
#### How it works  
Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

  * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
  * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource.
  * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to.  
#### Get started

  * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/).
  * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/).
  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.

May 13, 2026
1. ### [New Logpush datasets and updated fields across multiple Logpush datasets in Cloudflare Logs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-13-log-fields-updated/)  
[ Logs ](https://edgetunnel-b2h.pages.dev/logs/)  
Cloudflare has updated [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/):  
#### New datasets

  * **Email Security Post-Delivery Events**: A new dataset with fields including `AlertID`, `CompletedAt`, `Destination`, `FinalDisposition`, `Folder`, `From`, `FromName`, `MessageID`, `MessageTimestamp`, `MicrosoftTenantID`, `Operation`, `PostfixID`, `Reasons`, `Recipient`, `RequestedAt`, `RequestedBy`, `RequestedDisposition`, `Status`, `Subject`, `Success`, and `To`.
  * **Magic Network Monitoring Flow Logs**: A new dataset with fields including `AWSVPCFlowJSON`, `Bits`, `DestinationAS`, `DestinationAddress`, `DestinationPort`, `DeviceID`, `EgressBits`, `EgressPackets`, `Ethertype`, `FlowProtocol`, `FlowTimestamp`, `NumFlows`, `PacketID`, `Packets`, `Protocol`, `RuleIDs`, `SampleRate`, `SampleRateType`, `SamplerAddress`, `SourceAS`, `SourceAddress`, `SourcePort`, `TcpFlags`, and `Timestamp`.  
#### Updated fields in existing datasets

  * **Firewall events** (added): `AISecurityInjectionScore`, `AISecurityPIICategories`, `AISecurityTokenCount`, and `AISecurityUnsafeTopicCategories`.
  * **HTTP requests** (added): `AISecurityInjectionScore`, `AISecurityPIICategories`, `AISecurityTokenCount`, `AISecurityUnsafeTopicCategories`, and `Subrequests`.  
For the complete field definitions for each dataset, refer to [Logpush datasets](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/).

May 04, 2026
1. ### [Keyboard shortcuts for the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-keyboard-shortcuts/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press `?` anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your [profile settings ↗](https://dash.cloudflare.com/profile/settings).  
#### Navigate

| Shortcut  | Action                                                 |
| --------- | ------------------------------------------------------ |
| g h       | Go to Home                                             |
| g a       | Go to account overview                                 |
| g z       | Go to zone overview                                    |
| g p       | Go to your profile                                     |
| g w       | Go to Workers & Pages                                  |
| g o       | Go to Zero Trust                                       |
| g b       | Go to billing                                          |
| g 1 – g 5 | Go to a recent or pinned item (by position in sidebar) |
| t →       | Move to the next tab                                   |
| t ←       | Move to the previous tab                               |
| p →       | Move to the next page of a table                       |
| p ←       | Move to the previous page of a table                   |  
#### Take action

| Shortcut | Action                               |
| -------- | ------------------------------------ |
| /        | Open quick search                    |
| ?        | Show keyboard shortcuts              |
| s a      | Switch account                       |
| s z      | Switch zone                          |
| s .      | Star or unstar the current zone      |
| p .      | Pin or unpin the current page        |
| t s      | Toggle the sidebar open or closed    |
| t m      | Expand or collapse all sidebar menus |
| t a      | Toggle Ask AI sidebar                |
| d .      | Toggle dark mode                     |
| c u      | Copy the current URL                 |
| c d      | Copy a deep link URL                 |

Apr 30, 2026
1. ### [Go SDK v7.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-go-sdk-v700/)  
[ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)[ Go SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)  
Full Changelog: [v6.10.0...v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/compare/v6.10.0...v7.0.0)  
This is a major version release that includes breaking changes to three packages: `ai_search`, `email_security`, and `workers`. These changes reflect upstream API specification updates that improve type correctness and consistency.

**Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments.  
#### Breaking Changes  
See the [v7.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md) for before/after code examples and actions needed for each change.  
#### AI Search - SearchForAgents Metadata Removed  
The `SearchForAgents` nested type has been removed from all instance metadata structs. This field is no longer part of the API specification.

**Removed Types:**

  * `InstanceNewResponseMetadataSearchForAgents`
  * `InstanceUpdateResponseMetadataSearchForAgents`
  * `InstanceListResponseMetadataSearchForAgents`
  * `InstanceDeleteResponseMetadataSearchForAgents`
  * `InstanceReadResponseMetadataSearchForAgents`
  * `InstanceNewParamsMetadataSearchForAgents`
  * `InstanceUpdateParamsMetadataSearchForAgents`
  * `NamespaceInstanceNewResponseMetadataSearchForAgents`
  * `NamespaceInstanceUpdateResponseMetadataSearchForAgents`
  * `NamespaceInstanceListResponseMetadataSearchForAgents`
  * `NamespaceInstanceDeleteResponseMetadataSearchForAgents`
  * `NamespaceInstanceReadResponseMetadataSearchForAgents`
  * `NamespaceInstanceNewParamsMetadataSearchForAgents`
  * `NamespaceInstanceUpdateParamsMetadataSearchForAgents`  
#### Email Security - Path Parameter Type Changes  
Multiple Email Security settings sub-resources have changed their path parameter types from `int64` to `string`:

  * `AllowPolicies` (`policyID int64` \-> `policyID string`)
  * `BlockSenders` (`patternID int64` \-> `patternID string`)
  * `Domains` (`domainID int64` \-> `domainID string`)
  * `ImpersonationRegistry` (`displayNameID int64` \-> `impersonationRegistryID string`)
  * `TrustedDomains` (`trustedDomainID int64` \-> `trustedDomainID string`)  
#### Email Security - Investigate Parameter Rename  
The `Investigate.Get`, `Investigate.Move.New`, and `Investigate.Reclassify.New` methods now use `investigateID` instead of `postfixID` as the path parameter name.  
#### Email Security - Domains BulkDelete Method Removed  
The `SettingDomainService.BulkDelete` method and its associated types have been removed:

  * `SettingDomainBulkDeleteResponse`
  * `SettingDomainBulkDeleteParams`  
#### Email Security - TrustedDomains Return Type Change  
`SettingTrustedDomainService.New` now returns `*SettingTrustedDomainNewResponse` instead of `*SettingTrustedDomainNewResponseUnion`.  
#### Email Security - Investigate.Move Return Type Change  
`InvestigateMoveService.New` now returns `*pagination.SinglePage[InvestigateMoveNewResponse]` instead of `*[]InvestigateMoveNewResponse`.  
#### Workers - Observability Telemetry Filter Restructuring  
The observability telemetry filter parameter types have been restructured to support nested filter groups. New discriminated union types replace the previous flat filter arrays:

  * `ObservabilityTelemetryKeysParams.Filters` now accepts `FiltersObjectFilterUnion` (was `[]interface\{\}`)
  * `ObservabilityTelemetryQueryParams.Parameters.Filters` now accepts `FiltersObjectFilterUnion`
  * `ObservabilityTelemetryValuesParams.Filters` now accepts `FiltersObjectFilterUnion`  
New types include `FiltersObjectFiltersObject` (for group filters with `FilterCombination`) and `FiltersWorkersObservabilityFilterLeaf` (for leaf filters with typed `Operation`, `Type`, and `Value` fields).  
#### Features  
#### Organizations - Audit Logs (`client.Organizations.Logs.Audit`)

**NEW SERVICE:** Query organization audit logs with cursor-based pagination.

  * `List()` \- Retrieve audit logs  
#### Browser Rendering (`client.BrowserRendering`)

  * `client.BrowserRendering.Devtools.Browser.Targets.Close()` \- Close a specific browser target (tab, page) by ID  
#### Queues (`client.Queues`)

  * `client.Queues.GetMetrics()` \- Retrieve queue metrics for a specific queue  
#### AI Search (`client.AISearch`)

  * Added `WaitForCompletion` parameter to `NamespaceInstanceItemNewOrUpdateParams` and `NamespaceInstanceItemSyncParams` for synchronous indexing confirmation  
#### Bug Fixes

  * **Magic Transit**: `ConnectorService.List` parameter name corrected from `query` to `params` (non-functional, affects generated documentation only)  
#### Deprecations  
None in this release.  
#### Get started

  * [Download Go SDK v7.0.0 ↗](https://github.com/cloudflare/cloudflare-go/releases/tag/v7.0.0)
  * [Go SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/go/)
  * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-go/blob/main/docs/migration-guides/v7.0.0-migration-guide.md)

Apr 30, 2026
1. ### [Cloudflare Python SDK v5.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-python-v500/)  
[ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)  
Full Changelog: [v4.3.1...v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/compare/v4.3.1...v5.0.0)  
This is a major release of the Cloudflare Python SDK. It drops support for Python 3.8, adds 11 new API services, introduces optional aiohttp backend support for improved async concurrency, and includes hundreds of type and method updates across the entire API surface.

**Please review the breaking changes below before upgrading.** A migration guide is available at [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md).  
#### Breaking Changes

  * **Python 3.8 is no longer supported.** The minimum required version is now Python 3.9.
  * **`typing-extensions` minimum version bumped** from `>=4.10` to `>=4.14`.  
The following resources have breaking changes. See the [v5.0.0 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md) for detailed migration instructions.

  * `abusereports`
  * `acm.totaltls`
  * `apigateway.configurations`
  * `cloudforceone.threatevents`
  * `d1.database`
  * `intel.indicatorfeeds`
  * `logpush.edge`
  * `origintlsclientauth.hostnames`
  * `queues.consumers`
  * `radar.bgp`
  * `rulesets.rules`
  * `schemavalidation.schemas`
  * `snippets`
  * `zerotrust.dlp`
  * `zerotrust.networks`  
#### Features  
#### aiohttp Backend Support  
The async client now supports an optional `aiohttp` HTTP backend for improved concurrency performance. Install with `pip install cloudflare[aiohttp]` and use `DefaultAioHttpClient()` as the `http_client` parameter.  
#### Python 3.13 and 3.14 Support  
Python 3.13 and 3.14 are now tested and supported.  
#### New Services  
The following top-level resources are new in this release:

| Resource              | Client Path            | Description                                                      |
| --------------------- | ---------------------- | ---------------------------------------------------------------- |
| AI Search             | aisearch               | AI-powered search capabilities                                   |
| Connectivity          | connectivity           | Connectivity testing and diagnostics                             |
| Email Sending         | email\_sending         | Email send and send\_raw endpoints                               |
| Fraud                 | fraud                  | Fraud detection and prevention                                   |
| Google Tag Gateway    | google\_tag\_gateway   | Google Tag Gateway management                                    |
| Organizations         | organizations          | Organization audit logs and management                           |
| R2 Data Catalog       | r2\_data\_catalog      | R2 Data Catalog operations                                       |
| Realtime Kit          | realtime\_kit          | Realtime communication (Calls/TURN)                              |
| Resource Tagging      | resource\_tagging      | Resource tagging and labeling                                    |
| Token Validation      | token\_validation      | Token validation configuration and rules                         |
| Vulnerability Scanner | vulnerability\_scanner | Vulnerability scanning, credential sets, and target environments |  
#### New Endpoints on Existing Services

  * **api\_gateway**: Labels endpoints
  * **billing**: Billable usage PayGo endpoint
  * **brand\_protection**: v2 endpoints
  * **browser\_rendering**: DevTools methods
  * **cache**: Origin cloud regions resource
  * **custom\_origin\_trust\_store**: Custom origin trust store
  * **dns**: `dns_records/usage` endpoints
  * **email\_security**: Phishguard reports endpoint
  * **iam**: User groups and user group members resources
  * **radar**: Botnet Threat Feed and Post-Quantum endpoints
  * **workers**: Observability Destinations resources
  * **zero\_trust**: Access Users, DEX rules, Device IP Profile, Device Subnet, WARP Connector connections and failover, WARP Subnet, Gateway PAC files
  * **zones**: Zone environments endpoints  
#### Bug Fixes

  * Fixed `polymorphic_serialization` parameter in `model_dump` overrides
  * Added `BaseModel` base to response `SchemaFieldStruct`/`SchemaFieldList` stubs in Pipelines
  * Added missing `model_rebuild`/`update_forward_refs` for `SharedEntryCustomEntry` classes in DLP
  * Made `RunQueryParametersNeedleValue` a `BaseModel` with `arbitrary_types_allowed` in Workers
  * Removed duplicate `notification_url` field in webhook response types for Stream
  * Resolved pre-existing codegen type errors
  * Fixed `type: ignore[call-arg]` placement for mypy compatibility in Radar  
#### Deprecations  
Resources with `@deprecated` annotations on some methods include: `accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `kv`, `logpush`, `origin-tls-client-auth`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones`  
#### Get started

  * [Download Python SDK v5.0.0 ↗](https://github.com/cloudflare/cloudflare-python/releases/tag/v5.0.0)
  * [Python SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/python/)
  * [Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/migration-guides/v5.0.0-migration-guide.md)

Apr 30, 2026
1. ### [Cloudflare TypeScript SDK v6.0.0 Released](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-cloudflare-typescript-v600/)  
[ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)  
Full Changelog: [v6.0.0-beta.2...v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/compare/v6.0.0-beta.2...v6.0.0)  
This is a major version release of the Cloudflare TypeScript SDK. It includes 11 entirely new top-level API resources, new sub-resources and methods across 50+ existing resources, SDK infrastructure improvements, and breaking changes to the generated API surface from the v5.x line.

**Please ensure you read through the list of changes below before moving to this version** \- this will help you understand any down or upstream issues it may cause to your environments.  
#### Breaking Changes  
#### SDK Infrastructure

  * **Retry-After handling changed**: The SDK now respects any server-specified `Retry-After` value for rate-limited requests. Previously, values over 60 seconds were ignored and a default backoff was used instead.
  * **Empty response handling**: Responses with `content-length: 0` now return `undefined` instead of attempting to parse the body.
  * **Environment variable reading**: Empty string env vars (for example, `CLOUDFLARE_API_TOKEN=""`) are now treated as unset.
  * **Path query parameter merging**: URL search params embedded in endpoint paths are now extracted and merged into the query object.  
#### Removed Endpoints (17)  
17 HTTP endpoints were removed from the SDK, affecting `abuse-reports`, `cloudforce-one`, `dlp/profiles/predefined`, `email-security/investigate`, `email-security/settings`, and `intel/ip-list`.  
#### Method Signature Changes

  * `client.ai.toMarkdown.transform(file, \{ ...params \})` \-> `client.ai.toMarkdown.transform(\{ ...params \})` \-- `file` moved from positional arg into params body
  * `client.radar.ai.toMarkdown.create(body, \{ ...params \})` \-> `client.radar.ai.toMarkdown.create(\{ ...params \})` \-- `body` moved from positional arg into params
  * `client.abuseReports.create(reportType, \{ ...params \})` \-> `client.abuseReports.create(reportParam, \{ ...params \})` \-- positional arg renamed
  * `client.iam.userGroups.members.create(userGroupId, [ ...body ])` \-> `client.iam.userGroups.members.create(userGroupId, [ ...members ])` \-- body array param renamed  
#### Renamed Client Paths

  * `client.originTLSClientAuth.hostnames.certificates` \-> `client.originTLSClientAuth.zoneCertificates`
  * `client.radar.netflows` \-> `client.radar.netFlows` (casing change)  
#### Return Type Changes (179)

  * **133 methods now return `null`** instead of a typed response object. This primarily affects delete operations across `accounts`, `cache`, `d1`, `filters`, `firewall`, `hyperdrive`, `iam`, `kv`, `logpush`, `logs`, `r2`, `stream`, `workers`, `zero-trust`, `zones`, and others.
  * **17 methods changed pagination type** (for example, `KeysCursorPaginationAfter` \-> `KeysCursorLimitPagination`).
  * **29 methods changed to a different named type** (for example, `CloudflaredCreateResponse` \-> `CloudflareTunnel`).  
#### Removed Types (43)  
24 shared types removed from root namespace (`ASN`, `AuditLog`, `Member`, `Permission`, `Role`, `Subscription`, `Token`, etc.). 19 response types consolidated or renamed.  
#### Resource Restructuring  
19 resources were restructured from single files to directories. Public API client paths are unchanged, but deep imports may break.  
#### New Top-Level Resources  
11 entirely new resources added to the client:

| Resource              | Client Path                 | Methods | Description                              |
| --------------------- | --------------------------- | ------- | ---------------------------------------- |
| AI Search             | client.aiSearch             | 46      | Instances, namespaces, tokens, and items |
| Connectivity          | client.connectivity         | 5       | Directory service APIs                   |
| Email Sending         | client.emailSending         | 7       | Send and send\_raw endpoints             |
| Fraud                 | client.fraud                | 2       | Fraud detection API                      |
| Google Tag Gateway    | client.googleTagGateway     | 2       | Google Tag Gateway management            |
| Organizations         | client.organizations        | 8       | Organization profiles and audit logs     |
| R2 Data Catalog       | client.r2DataCatalog        | 11      | R2 Data Catalog routes                   |
| Realtime Kit          | client.realtimeKit          | 54      | Realtime Kit APIs                        |
| Resource Tagging      | client.resourceTagging      | 9       | Resource tagging routes                  |
| Token Validation      | client.tokenValidation      | 13      | Token validation rules                   |
| Vulnerability Scanner | client.vulnerabilityScanner | 21      | Vulnerability scanning                   |  
#### New Sub-Resources on Existing Resources

  * **browser-rendering**: `crawl`, `devtools` \- Crawl endpoints and DevTools methods
  * **cache**: `origin-cloud-regions` \- Origin cloud regions resource
  * **dns**: `usage` \- DNS records usage endpoints
  * **d1**: `time-travel` \- Time travel get\_bookmark and restore
  * **email-security**: `phishguard` \- Phishguard reports endpoint
  * **pipelines**: `sinks`, `streams` \- Pipelines restructure
  * **radar**: `agent-readiness`, `geolocations`, `post-quantum` \- New analytics endpoints
  * **workers**: `observability` \- Observability destinations
  * **zones**: `environments` \- Zone environments endpoints
  * **api-gateway**: `labels` \- Labels endpoints
  * **brand-protection**: `v2` \- V2 endpoints
  * **alerting**: `silences` \- Alert silencing API
  * **billing**: `usage` \- Billable usage PayGo endpoint
  * **iam**: `sso` \- SSO Connectors resource
  * **queues**: `getMetrics` method - Queues metrics endpoint
  * **registrar**: `registration-status`, `update-status` \- Registrar API convergence
  * **zero-trust**: DLP settings, DEX rules, Access Users, WARP Connector, WARP Subnets, Gateway PAC files, Gateway tenants  
#### Bug Fixes

  * Resolved type errors from codegen overwriting manual fixes
  * Fixed `post()` usage for to-markdown endpoints to resolve async type error
  * Added least-privilege permissions to all workflow jobs
  * Reverted erroneous removal of rulesets resource methods and types
  * Resolved prettier formatting errors in codegen output  
#### Deprecations  
The following resources now include `@deprecated` annotations on some methods:  
`accounts`, `addressing`, `ai-gateway`, `aisearch`, `api-gateway`, `billing`, `cloudforce-one`, `custom-nameservers`, `dns`, `email-routing`, `email-security`, `filters`, `firewall`, `images`, `intel`, `keyless-certificates`, `kv`, `logpush`, `origin-tls-client-auth`, `page-shield`, `pages`, `pipelines`, `radar`, `rate-limits`, `registrar`, `rulesets`, `ssl`, `user`, `workers`, `workers-for-platforms`, `zero-trust`, `zones`  
#### Get started

  * [Download TypeScript SDK v6.0.0 ↗](https://github.com/cloudflare/cloudflare-typescript/releases/tag/v6.0.0)
  * [TypeScript SDK documentation ↗](https://edgetunnel-b2h.pages.dev/api/sdks/typescript/)
  * [Full Changelog ↗](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md)

Apr 29, 2026
1. ### [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-instant-bank-payments-via-link/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now pay for Cloudflare services directly from your bank account using [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/).  
#### What changed  
[Link ↗](https://link.co/) now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow.  
![Instant Bank Payments via Link at checkout](https://edgetunnel-b2h.pages.dev/_astro/2026-04-29-instant-bank-payments-link.ChGd-t7M_ZVtvgM.webp)  
#### How to use it

  1. During checkout, select your bank account from your saved Link payment methods.
  2. Confirm the payment.  
After your first Link authentication, your bank account is available for future purchases without re-entering details.  
#### Who is eligible  
Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout.  
Bank-based Link payments appear in your billing history with the payment method shown as `link` and last four digits as `0000`. For details, refer to the [Instant Bank Payments via Link documentation](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/).

Apr 28, 2026
1. ### [Direct access to Support from the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-28-direct-support-navigation/)  
[ Support ](https://edgetunnel-b2h.pages.dev/support/)  
#### Direct access to Support from the dashboard  
The **Support** button in the dashboard global navigation header now takes you directly to the [Cloudflare Support Portal ↗](https://support.cloudflare.com), eliminating the previous dropdown menu.  
This change ensures that when you need help, you spend less time navigating the UI and more time getting the answers you need.  
#### What changed?

  * **Previous behavior**: Selecting **? Support** opened a dropdown menu with various links (Help Center, Cloudflare Community, etc.).
  * **New behavior**: Selecting **Support** immediately redirects your current tab to the Support Portal.  
To learn more about the resources available to you, refer to the [Cloudflare Support documentation ↗](https://edgetunnel-b2h.pages.dev/support/contacting-cloudflare-support/).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/core-platform/#page","headline":"Core platform Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/core-platform/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```