---
title: Cloudflare Fundamentals Changelog
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

Cloudflare Fundamentals

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 13, 2026
1. ### [Origin Content Signals for Markdown for Agents](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-13-markdown-for-agents-header-preservation/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
[Markdown for Agents](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) now preserves security- and cache-relevant response headers from your origin when converting HTML to Markdown:

  * Markdown for Agents preserves security headers such as `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Frame-Options`, `Set-Cookie`, and CORS headers (for example, `Access-Control-Allow-Origin`) on the converted response.
  * Caching headers (`Cache-Control`, `Expires`, `Age`) continue to pass through.  
Your origin's [Content Signals ↗](https://contentsignals.org/) policy is now authoritative. If your origin sets a `content-signal` header, Markdown for Agents preserves it. When the origin does not send one, Cloudflare adds the default `Content-Signal: ai-train=yes, search=yes, ai-input=yes`.  
This release also fixes relative link resolution for directory-style base URLs (those ending in a trailing slash). Previously, relative links such as `../page/` could resolve one path segment too high and return a `404`. Links are now resolved correctly per [RFC 3986 ↗](https://www.rfc-editor.org/rfc/rfc3986#section-5.2.3).  
Refer to our [developer documentation](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) for more details.

Jun 30, 2026
1. ### [New permissions and roles for Gateway policies and lists](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-30-gateway-granular-permissions/)  
[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now assign granular, resource-scoped roles for [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) firewall policies and [Zero Trust lists](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/lists/). Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the following resource-scoped roles are now available:

| Role                                       | Description                                                                                 |
| ------------------------------------------ | ------------------------------------------------------------------------------------------- |
| Zero Trust Gateway Firewall Policies Admin | Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. |
| Zero Trust Gateway DNS Policies Admin      | Can view and edit Gateway DNS policies.                                                     |
| Zero Trust Gateway HTTP Policies Admin     | Can view and edit Gateway HTTP policies.                                                    |
| Zero Trust Gateway Network Policies Admin  | Can view and edit Gateway Network policies.                                                 |
| Zero Trust Gateway Egress Policies Admin   | Can view and edit Gateway Egress policies.                                                  |
| Zero Trust Gateway Resolver Policies Admin | Can view and edit Gateway Resolver policies.                                                |
| Zero Trust Gateway Policies Admin          | Can view and edit all Gateway policies.                                                     |
| Zero Trust Gateway Policies Read           | Can view all Gateway policies.                                                              |
| Zero Trust Gateway Read Only               | Can view all Gateway resources.                                                             |
| Zero Trust DNS Locations Admin             | Can view and edit DNS locations.                                                            |
| Zero Trust Proxy Endpoints Admin           | Can view and edit Gateway Proxy Endpoints.                                                  |
| Zero Trust Account Lists Admin             | Can view and edit all Gateway and Access lists.                                             |
| Zero Trust Account Lists Read              | Can view all Gateway and Access lists.                                                      |  
These roles allow you to:

  * Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.
  * Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.
  * Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.  
You can also now assign _Resource-scoped roles_. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. **Existing account-level roles continue to work.** A member with the `Cloudflare Gateway` or `Cloudflare Zero Trust` role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.  
#### Get started

  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.
  * Learn how to [create permission policies](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/) that use these roles.

Jun 25, 2026
1. ### [Search API tokens by name](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-25-api-token-search/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating.  
#### What's new

  * **Dashboard search**: Both [account API tokens ↗](https://dash.cloudflare.com/?to=/:account/account-api-tokens) and [user API tokens ↗](https://dash.cloudflare.com/profile/api-tokens) pages now include a search bar. Type a name to filter results.
  * **API search support**: The [/user/tokens](https://edgetunnel-b2h.pages.dev/api/resources/user/subresources/tokens/methods/list/) and [/accounts/{account\_id}/tokens](https://edgetunnel-b2h.pages.dev/api/resources/accounts/subresources/tokens/methods/list/) endpoints now accept a `name` query parameter to filter tokens by name.  
For more information, refer to [Create an API token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) and [Account API tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/).

Jun 04, 2026
1. ### [Billable usage and budget alerts now in product sidebars](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-04-billable-usage-product-sidebar/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)[ D1 ](https://edgetunnel-b2h.pages.dev/d1/)[ R2 ](https://edgetunnel-b2h.pages.dev/r2/)[ KV ](https://edgetunnel-b2h.pages.dev/kv/)[ Queues ](https://edgetunnel-b2h.pages.dev/queues/)[ Vectorize ](https://edgetunnel-b2h.pages.dev/vectorize/)[ Durable Objects ](https://edgetunnel-b2h.pages.dev/durable-objects/)[ Containers ](https://edgetunnel-b2h.pages.dev/containers/)  
Pay-as-you-go customers can now view billable usage and create [budget alerts](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) directly from the product overview pages for [Workers & Pages](https://edgetunnel-b2h.pages.dev/workers/), [D1](https://edgetunnel-b2h.pages.dev/d1/), [R2](https://edgetunnel-b2h.pages.dev/r2/), [Workers KV](https://edgetunnel-b2h.pages.dev/kv/), [Queues](https://edgetunnel-b2h.pages.dev/queues/), [Vectorize](https://edgetunnel-b2h.pages.dev/vectorize/), [Durable Objects](https://edgetunnel-b2h.pages.dev/durable-objects/), and [Containers](https://edgetunnel-b2h.pages.dev/containers/). A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.  
The widget pulls from the same data as the [Billable Usage dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/) and aligns to your billing cycle (or the current day on Free plans), so the numbers match your invoice. Enterprise contract accounts are not yet supported.  
![Billable usage widget in the Durable Objects product sidebar showing current-period spend and a breakdown by service](https://edgetunnel-b2h.pages.dev/_astro/2026-06-04-billable-usage-product-sidebar.BUuIokn__ZAx1o6.webp)  
Selecting **Create budget alert** opens the budget alert flow inline so you can set a dollar threshold in the same place you are reviewing usage. Budget alerts apply to your total account-level spend across all products, not just the product page you create them from.  
For more information, refer to the [Usage-based billing documentation](https://edgetunnel-b2h.pages.dev/billing/).

Jun 03, 2026
1. ### [Introducing self-managed OAuth clients](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-03-public-oauth-clients/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.  
OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into that account.  
#### What is new  
Cloudflare Developers can now create and manage their own OAuth applications to integrate with Cloudflare.  
#### Create an application  
To create an application, go to **Manage account** \> **OAuth clients** in your account on the Cloudflare dashboard.  
[ Go to **OAuth clients** ](https://dash.cloudflare.com/?to=/:account/oauth-clients)  
#### Select limited scopes  
If you have used an API token to call Cloudflare APIs, OAuth client scopes will look familiar. Select only the scopes your application needs during application creation, and include that scope list when sending users to Cloudflare for consent.  
Users can review the requested scopes before they consent.  
#### Apps for both private and public use  
Applications start with `private` visibility. Private applications can only be used by members of the account where the application was created.  
To make an application available to any Cloudflare user, complete the prerequisites for `public` visibility.  
For more information, refer to [client visibility](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/create-an-oauth-client/#private-and-public-clients).  
#### Client domain verification  
Before an application can be made public, you must verify the client domain. Domain verification helps users confirm that the application owner controls the domain shown on the consent page.  
After verification, users see a verified badge on the consent page.  
For more information, refer to [domain verification](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/create-an-oauth-client/#client-url-domain-ownership-verification).  
#### Learn more  
For more information, refer to [OAuth clients](https://edgetunnel-b2h.pages.dev/fundamentals/oauth/).

May 21, 2026
1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can:

  * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
  * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
  * Scope a single policy to one or many Tunnels and Mesh nodes at once.  
#### How it works  
Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

  * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
  * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource.
  * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to.  
#### Get started

  * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/).
  * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/).
  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.

May 04, 2026
1. ### [Keyboard shortcuts for the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-keyboard-shortcuts/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press `?` anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your [profile settings ↗](https://dash.cloudflare.com/profile/settings).  
#### Navigate

| Shortcut  | Action                                                 |
| --------- | ------------------------------------------------------ |
| g h       | Go to Home                                             |
| g a       | Go to account overview                                 |
| g z       | Go to zone overview                                    |
| g p       | Go to your profile                                     |
| g w       | Go to Workers & Pages                                  |
| g o       | Go to Zero Trust                                       |
| g b       | Go to billing                                          |
| g 1 – g 5 | Go to a recent or pinned item (by position in sidebar) |
| t →       | Move to the next tab                                   |
| t ←       | Move to the previous tab                               |
| p →       | Move to the next page of a table                       |
| p ←       | Move to the previous page of a table                   |  
#### Take action

| Shortcut | Action                               |
| -------- | ------------------------------------ |
| /        | Open quick search                    |
| ?        | Show keyboard shortcuts              |
| s a      | Switch account                       |
| s z      | Switch zone                          |
| s .      | Star or unstar the current zone      |
| p .      | Pin or unpin the current page        |
| t s      | Toggle the sidebar open or closed    |
| t m      | Expand or collapse all sidebar menus |
| t a      | Toggle Ask AI sidebar                |
| d .      | Toggle dark mode                     |
| c u      | Copy the current URL                 |
| c d      | Copy a deep link URL                 |

Apr 29, 2026
1. ### [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-29-instant-bank-payments-via-link/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
You can now pay for Cloudflare services directly from your bank account using [Instant Bank Payments via Link](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/).  
#### What changed  
[Link ↗](https://link.co/) now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow.  
![Instant Bank Payments via Link at checkout](https://edgetunnel-b2h.pages.dev/_astro/2026-04-29-instant-bank-payments-link.ChGd-t7M_ZVtvgM.webp)  
#### How to use it

  1. During checkout, select your bank account from your saved Link payment methods.
  2. Confirm the payment.  
After your first Link authentication, your bank account is available for future purchases without re-entering details.  
#### Who is eligible  
Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout.  
Bank-based Link payments appear in your billing history with the payment method shown as `link` and last four digits as `0000`. For details, refer to the [Instant Bank Payments via Link documentation](https://edgetunnel-b2h.pages.dev/billing/payment-methods/instant-bank-payments-link/).

Apr 27, 2026
1. ### [Structured error responses for Cloudflare 5xx errors](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-structured-responses-for-5xx-errors/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow [RFC 9457 (Problem Details for HTTP APIs) ↗](https://www.rfc-editor.org/rfc/rfc9457) and include a `Retry-After` HTTP header on retryable codes.  
#### Changes

**5xx coverage.** Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. These are errors Cloudflare itself generates when it cannot reach or understand the origin server. Origin-generated 5xx responses that Cloudflare passes through are not affected.

**Fault attribution.** The `error_category` field tells agents where the fault lies:

  * `origin` (502, 504, 520-524) — the origin server is responsible. Transient; retry with the backoff in `retry_after`.
  * `cloudflare` (500) — Cloudflare's fault, not the website or the request. Short retry.
  * `ssl` (525, 526) — the origin's TLS configuration is broken. Do not retry.

**Retry-After header.** Retryable codes (500, 502, 504, 520-524) include a `Retry-After` HTTP header matching the `retry_after` body field. Non-retryable codes (525, 526) do not include the header.  
#### Negotiation behavior

| Request header sent                           | Response format                              |
| --------------------------------------------- | -------------------------------------------- |
| Accept: application/json                      | JSON (application/json content type)         |
| Accept: application/problem+json              | JSON (application/problem+json content type) |
| Accept: application/json, text/markdown;q=0.9 | JSON                                         |
| Accept: text/markdown                         | Markdown                                     |
| Accept: text/markdown, application/json       | Markdown (equal q, first-listed wins)        |
| Accept: \*/\*                                 | HTML (default)                               |  
#### Availability  
Available now for all zones on all plans.  
#### Get started  
Get JSON response for error 522:  
```bash  
curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/522" | jq .  
```  
Check presence of the `Retry-After` HTTP header associated with the JSON response for error 521:  
```bash  
curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/521" | grep -i retry-after  
```  
References:

  * [RFC 9457 — Problem Details for HTTP APIs ↗](https://www.rfc-editor.org/rfc/rfc9457)
  * [Cloudflare 5xx error documentation](https://edgetunnel-b2h.pages.dev/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/)

Apr 27, 2026
1. ### [Resource Tagging enters public beta](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-resource-tagging-public-beta/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Resource Tagging ](https://edgetunnel-b2h.pages.dev/resource-tagging/)  
Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need.  
#### What's included

  * **Broad resource type support** — Tag zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, Durable Object namespaces, Queues, Stream videos, Images, Access applications, Gateway rules, AI Gateways, and more. Refer to the [full list of supported resource types](https://edgetunnel-b2h.pages.dev/resource-tagging/reference/resource-types/).
  * **Powerful filtering** — Query tagged resources using AND/OR logic, negation, and key-only matching. Combine up to 20 filters per query to build precise resource views.
  * **Account and zone-level endpoints** — Full CRUD operations across both scopes.
  * **Token-based authentication** — Tagging supports [Account Owned Tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/account-owned-tokens/) that persist independently of individual users, so your automation keeps running through credential rotations and team changes.
  * **Flexible role support** — Super Administrators, Workers Admins, and Tag Admins can all manage tags.  
#### API-first by design  
The API is the primary interface for Resource Tagging and the recommended path for all workflows — scripting tag assignments, building CI/CD pipelines, or integrating with your infrastructure-as-code toolchain.  
#### Dashboard UI  
You can also view and manage tagged resources directly in the Cloudflare dashboard. Navigate to **Manage Account** \> **Resource Tagging** to see all tagged resources across your account, filter by resource name or tag, and add or edit tags inline.  
![Tagged Resources dashboard](https://edgetunnel-b2h.pages.dev/_astro/tagged-resources-dashboard.Dg5WvwiN_24xl6P.webp)  
#### What's coming next  
In future releases, expect support for additional resource types across the Cloudflare platform, tag-based access control policies for scoping user permissions to tagged resources, billing and usage attribution by tag for breaking down costs by team, project, or environment, and Terraform provider support for managing tags declaratively.  
#### Current limitations

  * `PUT` replaces all tags on a resource (no partial update). Use the [GET, merge, PUT workflow](https://edgetunnel-b2h.pages.dev/resource-tagging/how-to/manage-tags/#add-a-single-tag) to modify individual tags safely.
  * `DELETE` removes all tags from a resource. To remove a single tag, PUT the remaining tags back.
  * Querying tags for a resource that has never been tagged returns `500` instead of `404`. This is a known beta limitation.  
To get started, refer to the [Resource Tagging documentation](https://edgetunnel-b2h.pages.dev/resource-tagging/).

Apr 21, 2026
1. ### [Network Overview page in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-network-overview-page/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
A new **Network Overview** page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products.  
From the Network Overview page, you can:

  * **Connect resources with [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/)** \- Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet.
  * **Monitor traffic with Network Flow** \- Get real-time visibility into traffic volume from your routers.
  * **Configure Address Maps** \- Map dedicated static IPs or BYOIP prefixes to specific hostnames.
  * **Explore Magic Transit and Cloudflare WAN** \- Set up DDoS protection for your networks and connectivity for your branch offices and data centers.  
To find it, go to [**Networking** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/overview) in the dashboard sidebar.  
If you already use [Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/), [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/), or other Cloudflare network services products, your existing experience is unchanged.  
![Network Overview page in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/network-overview.4FLDtULW_Z1MDOti.webp)

Apr 21, 2026
1. ### [Introducing Billable Usage dashboard and Budget alerts](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-13-billable-usage-dashboard-and-budget-alerts/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/)  
Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts.  
#### Billable Usage dashboard  
The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill.  
The dashboard displays:

  * A bar chart showing daily usage charges for your billing period
  * A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs
  * Ability to view previous billing periods  
Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice.  
To access the dashboard, go to **Manage Account** \> **Billing** \> **Billable Usage**.  
![Screenshot of the Billable Usage dashboard in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/billable-usage-dashboard.CQvMdtrp_Z2qynps.webp)  
#### Budget alerts  
Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end.  
To configure a budget alert:

  1. Go to **Manage Account** \> **Billing** \> **Billable Usage**.
  2. Select **Set Budget Alert**.
  3. Enter a budget threshold amount greater than $0.
  4. Select **Create**.  
Alternatively, configure alerts via **Notifications** \> **Add** \> **Budget Alert**.  
![Create Budget Alert modal in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/budget-alert-modal.BjIzGOLV_Zr8DX5.webp)  
You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold.  
Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported.  
For more information, refer to the [Usage based billing documentation](https://edgetunnel-b2h.pages.dev/billing/understand/usage-based-billing/).

Apr 14, 2026
1. ### [Improved OAuth experience for consent and management](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-14-oauth-consent-and-revoke/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
OAuth allows third-party applications to access your Cloudflare account on your behalf — like when Wrangler deploys Workers or when monitoring tools read your analytics. You now have **granular control** over which accounts these applications can access, plus the ability to revoke access anytime.  
#### What's new  
#### Choose which accounts to authorize  
When authorizing an OAuth application, you can now **select specific accounts** instead of granting access to all your accounts:

  * **Account-by-account selection** — Choose exactly which accounts the application can access
  * **"All accounts" option** — Still available for trusted tools like Wrangler This gives you precise control who can access your data.  
#### Clear consent screens  
The OAuth consent screen now shows:

  * **What the application can access** — Explicit list of permissions being requested
  * **Who created the application** — Application owner and contact information
  * **Which accounts you're authorizing** — Checkboxes for account selection  
#### Revoke access anytime  
Manage authorized OAuth applications from your profile:

  * **See all connected apps** — View every OAuth application with access to your accounts
  * **Review permissions and scope** — Check what each application can do and which accounts it can access
  * **Revoke instantly** — Remove access with one click when you no longer need it To manage your OAuth applications, navigate to **Profile** \> **Access Management** \> **[Connected Applications ↗](https://dash.cloudflare.com/profile/access-management/authorization)**.  
#### Why this matters  
These updates give you:

  * **Granular control** — Authorize apps per-account instead of all-or-nothing
  * **Transparency** — Know exactly what you're authorizing before you consent
  * **Security** — Limit blast radius by restricting access to only necessary accounts
  * **Easy cleanup** — Revoke access when applications are no longer needed  
#### Learn more  
Read more about these improvements in our blog post: [Improving the OAuth consent experience ↗](https://blog.cloudflare.com/improved-developer-security/#improving-the-oauth-consent-experience).

Apr 10, 2026
1. ### [API tokens now detectable by secret scanning tools](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-10-secret-scanning-support/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare API tokens now include **identifiable patterns** that enable secret scanning tools to automatically detect them when leaked in code repositories, configuration files, or other public locations.  
#### What changed  
API tokens generated by Cloudflare now follow a standardized format that secret scanning tools can recognize. When a Cloudflare token is accidentally committed to GitHub, GitLab, or another platform with secret scanning enabled, the tool will flag it and alert you.  
#### Why this matters  
Leaked credentials are a common security risk. By making Cloudflare tokens detectable by scanning tools, you can:

  * **Detect leaks faster** — Get notified immediately when a token is exposed.
  * **Reduce risk window** — Exposed tokens are deactivated immediately, before they can be exploited.
  * **Automate security** — Leverage existing secret scanning infrastructure without additional configuration.  
#### What happens when a leak is detected  
When a third-party secret scanning tool detects a leaked Cloudflare API token:

  1. **Cloudflare immediately deactivates the token** to prevent unauthorized access.
  2. **The token creator receives an email notification** alerting them to the leak.
  3. **The token is marked as "Exposed"** in the Cloudflare dashboard.
  4. **You can then roll or delete the token** from the token management pages.  
#### Supported platforms

  * **GitHub Secret Scanning** — Automatically enabled for public repositories  
For more information on token formats and secret scanning, refer to [API token formats](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/token-formats/).

Apr 06, 2026
1. ### [Organizations is now in public beta for enterprises](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-06-organizations-public-beta/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/)  
We're announcing the public beta of **Organizations** for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location.

**What's New**

**Organizations \[BETA\]**: [Organizations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/) are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale.

**Self-serve onboarding**: Enterprise customers can [create an Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/setup/) in the dashboard and assign accounts where they are already Super Administrators.

**Centralized Account Management**: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. **Shared policies**: Share [WAF](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) or [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/tiered-policies/organizations/) policies across multiple accounts within your Organization to simplify centralized policy management. **Implicit access**: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year.

**Unified analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events.

**Terraform provider support**: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/organization).

**Shared policies**: Share [WAF](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) or [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) policies across multiple accounts within your Organization to simplify centralized policy management.  
Note  
Organizations is in Public Beta. You must have an Enterprise account to create an organization, but once created, you can add accounts of any plan type where you are a Super Administrator.  
For more info:

  * [Get started with Organizations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/)
  * [Set up your Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/setup/)
  * [Review limitations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/limitations/)

Mar 19, 2026
1. ### [Service Key authentication deprecated](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-19-service-key-authentication-deprecated/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026.  
[API Tokens](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) replace Service Keys with fine-grained permissions, expiration, and revocation.  
#### What you need to do  
Replace any use of the `X-Auth-User-Service-Key` header with an [API Token](https://edgetunnel-b2h.pages.dev/fundamentals/api/get-started/create-token/) scoped to the permissions your integration requires.  
If you use `cloudflared`, update to a version from November 2022 or later. These versions already use API Tokens.  
If you use [origin-ca-issuer ↗](https://github.com/cloudflare/origin-ca-issuer), update to a version that supports API Token authentication.  
For more information, refer to [API deprecations](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/deprecations/).

Mar 18, 2026
1. ### [SCIM provisioning for Authentik is now Generally Available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-17-scim-authentik-support/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare dashboard SCIM provisioning now supports [Authentik ↗](https://goauthentik.io/) as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers.  
Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik Identity Provider.  
Note  
SCIM provisioning for the Cloudflare dashboard is available to Enterprise customers. You must be a Super Administrator to complete the initial setup.  
For more information:

  * [SCIM provisioning overview](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/scim-setup/)
  * [Provision with Authentik](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/scim-setup/authentik/)

Mar 18, 2026
1. ### [SCIM audit logging Support](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-18-scim-audit-logging/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare dashboard SCIM provisioning operations are now captured in [Audit Logs v2](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/), giving you visibility into user and group changes made by your identity provider.  
![SCIM audit logging](https://edgetunnel-b2h.pages.dev/_astro/2026-03-18-scim-audit-logging.DPKMiE8X_ZojL4c.webp)  

**Logged actions:**

| Action Type       | Description                             |
| ----------------- | --------------------------------------- |
| Create SCIM User  | User provisioned from IdP               |
| Replace SCIM User | User fully replaced (PUT)               |
| Update SCIM User  | User attributes modified (PATCH)        |
| Delete SCIM User  | Member deprovisioned                    |
| Create SCIM Group | Group provisioned from IdP              |
| Update SCIM Group | Group membership or attributes modified |
| Delete SCIM Group | Group deprovisioned                     |  
For more details, refer to the [Audit Logs v2 documentation](https://edgetunnel-b2h.pages.dev/fundamentals/account/account-security/audit-logs/).

Mar 12, 2026
1. ### [Retry-After HTTP header for retryable 1xxx errors](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-12-retry-after-header-for-1xxx-errors/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare-generated 1xxx error responses now include a standard `Retry-After` HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone — no body parsing required.  
#### Changes  
Seven retryable error codes now emit `Retry-After`:

| Error code | Retry-After (seconds) | Error name                  |
| ---------- | --------------------- | --------------------------- |
| 1004       | 120                   | DNS resolution error        |
| 1005       | 120                   | Banned zone                 |
| 1015       | 30                    | Rate limited                |
| 1033       | 120                   | Argo Tunnel error           |
| 1038       | 60                    | HTTP headers limit exceeded |
| 1200       | 60                    | Cache connection limit      |
| 1205       | 5                     | Too many redirects          |  
The header value matches the existing `retry_after` body field in JSON and Markdown responses.  
If a WAF rate limiting rule has already set a dynamic `Retry-After` value on the response, that value takes precedence.  
#### Availability  
Available for all zones on all plans.  
#### Verify  
Check for the header on any retryable error:  
```bash  
curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | grep -i retry-after  
```  
References:

  * [RFC 9110 section 10.2.3 - Retry-After ↗](https://www.rfc-editor.org/rfc/rfc9110#section-10.2.3)
  * [Cloudflare 1xxx error documentation](https://edgetunnel-b2h.pages.dev/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/)

Mar 11, 2026
1. ### [JSON responses and RFC 9457 support for Cloudflare 1xxx errors](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-11-json-rfc9457-responses-for-1xxx-errors/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare-generated 1xxx errors now return structured JSON when clients send `Accept: application/json` or `Accept: application/problem+json`. JSON responses follow [RFC 9457 (Problem Details for HTTP APIs) ↗](https://www.rfc-editor.org/rfc/rfc9457), so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code.  
#### Breaking change  
The Markdown frontmatter field `http_status` has been renamed to `status`. Agents consuming Markdown frontmatter should update parsers accordingly.  
#### Changes

**JSON format.** Clients sending `Accept: application/json` or `Accept: application/problem+json` now receive a structured JSON object with the same operational fields as Markdown frontmatter, plus RFC 9457 standard members.

**RFC 9457 standard members (JSON only):**

  * `type` — URI pointing to Cloudflare documentation for the specific error code
  * `status` — HTTP status code (matching the response status)
  * `title` — short, human-readable summary
  * `detail` — human-readable explanation specific to this occurrence
  * `instance` — Ray ID identifying this specific error occurrence

**Field renames:**

  * `http_status` \-> `status` (JSON and Markdown)
  * `what_happened` \-> `detail` (JSON only — Markdown prose sections are unchanged)

**Content-Type mirroring.** Clients sending `Accept: application/problem+json` receive `Content-Type: application/problem+json; charset=utf-8` back; `Accept: application/json` receives `application/json; charset=utf-8`. Same body in both cases.  
#### Negotiation behavior

| Request header sent                           | Response format                              |
| --------------------------------------------- | -------------------------------------------- |
| Accept: application/json                      | JSON (application/json content type)         |
| Accept: application/problem+json              | JSON (application/problem+json content type) |
| Accept: application/json, text/markdown;q=0.9 | JSON                                         |
| Accept: text/markdown                         | Markdown                                     |
| Accept: text/markdown, application/json       | Markdown (equal q, first-listed wins)        |
| Accept: \*/\*                                 | HTML (default)                               |  
#### Availability  
Available now for Cloudflare-generated 1xxx errors.  
#### Get started  
```bash  
curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .  
```  
```bash  
curl -s --compressed -H "Accept: application/problem+json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .  
```  
References:

  * [RFC 9457 — Problem Details for HTTP APIs ↗](https://www.rfc-editor.org/rfc/rfc9457)
  * [Cloudflare 1xxx error documentation](https://edgetunnel-b2h.pages.dev/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/)

Feb 26, 2026
1. ### [Markdown responses for Cloudflare 1xxx errors](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-26-markdown-responses-for-1xxx-errors/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare now returns structured Markdown responses for Cloudflare-generated 1xxx errors when clients send `Accept: text/markdown`.  
Each response includes YAML frontmatter plus guidance sections (`What happened` / `What you should do`) so agents can make deterministic retry and escalation decisions without parsing HTML.  
In measured 1,015 comparisons, Markdown reduced payload size and token footprint by over 98% versus HTML.  
Included frontmatter fields:

  * `error_code`, `error_name`, `error_category`, `http_status`
  * `ray_id`, `timestamp`, `zone`
  * `cloudflare_error`, `retryable`, `retry_after` (when applicable), `owner_action_required`  
Default behavior is unchanged: clients that do not explicitly request Markdown continue to receive HTML error pages.  
#### Negotiation behavior  
Cloudflare uses standard HTTP content negotiation on the `Accept` header.

  * `Accept: text/markdown` \-> Markdown
  * `Accept: text/markdown, text/html;q=0.9` \-> Markdown
  * `Accept: text/*` \-> Markdown
  * `Accept: */*` \-> HTML (default browser behavior)  
When multiple values are present, Cloudflare selects the highest-priority supported media type using `q` values. If Markdown is not explicitly preferred, HTML is returned.  
#### Availability  
Available now for Cloudflare-generated 1xxx errors.  
#### Get started  
```bash  
curl -H "Accept: text/markdown" https://<your-domain>/cdn-cgi/error/1015  
```  
Reference: [Cloudflare 1xxx error documentation](https://edgetunnel-b2h.pages.dev/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/)

Feb 16, 2026
1. ### [Content encoding support for Markdown for Agents and other improvements](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-16-markdown-for-agents-improvements/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
When AI systems request pages from any website that uses Cloudflare and has [Markdown for Agents](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) enabled, they can express the preference for `text/markdown` in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.  
This release adds the following improvements:

  * The origin response limit was raised from 1 MB to 2 MB (2,097,152 bytes).
  * We no longer require the origin to send the `content-length` header.
  * We now support content encoded responses from the origin.  
If you haven’t enabled automatic Markdown conversion yet, visit the [AI Crawl Control ↗](https://dash.cloudflare.com/?to=/:account/:zone/ai) section of the Cloudflare dashboard and enable **Markdown for Agents**.  
Refer to our [developer documentation](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) for more details.

Feb 13, 2026
1. ### [Fine-grained permissions for Access policies and service tokens](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-13-access-policy-service-token-permissions/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)  
Fine-grained permissions for **Access policies** and **Access service tokens** are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources.  
#### New roles

  * **Cloudflare Access policy admin**: Can edit a specific [Access policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) in an account.
  * **Cloudflare Access service token admin**: Can edit a specific [Access service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/) in an account.  
These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets.  
For more information:

  * [Resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles)
  * [Role scopes](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/scope/)  
Note  
Resource-scoped roles is currently in beta.

Feb 13, 2026
1. ### [Cloudflare Python SDK v5.0.0-beta.1 now available](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-13-cloudflare-python-v500-beta1/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ SDK ](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/sdks/)  
> **Disclaimer:** Please note that v5.0.0-beta.1 is in Beta and we are still testing it for stability.  
Full Changelog: [v4.3.1...v5.0.0-beta.1 ↗](https://github.com/cloudflare/cloudflare-python/compare/v4.3.1...v5.0.0-beta.1)  
In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.  
There may be changes that are not captured in this changelog. Feel free to open an issue to report any inaccuracies, and we will make sure it gets into the changelog before the v5.0.0 release.  
Most of the breaking changes below are caused by improvements to the accuracy of the base OpenAPI schemas, which sometimes translates to breaking changes in downstream clients that depend on those schemas.  
Please ensure you read through the list of changes below and the migration guide before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.  
#### Breaking Changes

**The following resources have breaking changes. See the [v5 Migration Guide ↗](https://github.com/cloudflare/cloudflare-python/blob/main/docs/v5-migration-guide.md) for detailed migration instructions.**

  * `abusereports`
  * `acm.totaltls`
  * `apigateway.configurations`
  * `cloudforceone.threatevents`
  * `d1.database`
  * `intel.indicatorfeeds`
  * `logpush.edge`
  * `origintlsclientauth.hostnames`
  * `queues.consumers`
  * `radar.bgp`
  * `rulesets.rules`
  * `schemavalidation.schemas`
  * `snippets`
  * `zerotrust.dlp`
  * `zerotrust.networks`  
#### Features  
#### New API Resources

  * `abusereports` \- Abuse report management
  * `abusereports.mitigations` \- Abuse report mitigation actions
  * `ai.tomarkdown` \- AI-powered markdown conversion
  * `aigateway.dynamicrouting` \- AI Gateway dynamic routing configuration
  * `aigateway.providerconfigs` \- AI Gateway provider configurations
  * `aisearch` \- AI-powered search functionality
  * `aisearch.instances` \- AI Search instance management
  * `aisearch.tokens` \- AI Search authentication tokens
  * `alerting.silences` \- Alert silence management
  * `brandprotection.logomatches` \- Brand protection logo match detection
  * `brandprotection.logos` \- Brand protection logo management
  * `brandprotection.matches` \- Brand protection match results
  * `brandprotection.queries` \- Brand protection query management
  * `cloudforceone.binarystorage` \- CloudForce One binary storage
  * `connectivity.directory` \- Connectivity directory services
  * `d1.database` \- D1 database management
  * `diagnostics.endpointhealthchecks` \- Endpoint health check diagnostics
  * `fraud` \- Fraud detection and prevention
  * `iam.sso` \- IAM Single Sign-On configuration
  * `loadbalancers.monitorgroups` \- Load balancer monitor groups
  * `organizations` \- Organization management
  * `organizations.organizationprofile` \- Organization profile settings
  * `origintlsclientauth.hostnamecertificates` \- Origin TLS client auth hostname certificates
  * `origintlsclientauth.hostnames` \- Origin TLS client auth hostnames
  * `origintlsclientauth.zonecertificates` \- Origin TLS client auth zone certificates
  * `pipelines` \- Data pipeline management
  * `pipelines.sinks` \- Pipeline sink configurations
  * `pipelines.streams` \- Pipeline stream configurations
  * `queues.subscriptions` \- Queue subscription management
  * `r2datacatalog` \- R2 Data Catalog integration
  * `r2datacatalog.credentials` \- R2 Data Catalog credentials
  * `r2datacatalog.maintenanceconfigs` \- R2 Data Catalog maintenance configurations
  * `r2datacatalog.namespaces` \- R2 Data Catalog namespaces
  * `radar.bots` \- Radar bot analytics
  * `radar.ct` \- Radar certificate transparency data
  * `radar.geolocations` \- Radar geolocation data
  * `realtimekit.activesession` \- Real-time Kit active session management
  * `realtimekit.analytics` \- Real-time Kit analytics
  * `realtimekit.apps` \- Real-time Kit application management
  * `realtimekit.livestreams` \- Real-time Kit live streaming
  * `realtimekit.meetings` \- Real-time Kit meeting management
  * `realtimekit.presets` \- Real-time Kit preset configurations
  * `realtimekit.recordings` \- Real-time Kit recording management
  * `realtimekit.sessions` \- Real-time Kit session management
  * `realtimekit.webhooks` \- Real-time Kit webhook configurations
  * `tokenvalidation.configuration` \- Token validation configuration
  * `tokenvalidation.rules` \- Token validation rules
  * `workers.beta` \- Workers beta features  
#### New Endpoints (Existing Resources)  
#### `acm.totaltls`

  * `edit()`
  * `update()`  
#### `cloudforceone.threatevents`

  * `list()`  
#### `contentscanning`

  * `create()`
  * `get()`
  * `update()`  
#### `dns.records`

  * `scan_list()`
  * `scan_review()`
  * `scan_trigger()`  
#### `intel.indicatorfeeds`

  * `create()`
  * `delete()`
  * `list()`  
#### `leakedcredentialchecks.detections`

  * `get()`  
#### `queues.consumers`

  * `list()`  
#### `radar.ai`

  * `summary()`
  * `timeseries()`
  * `timeseries_groups()`  
#### `radar.bgp`

  * `changes()`
  * `snapshot()`  
#### `workers.subdomains`

  * `delete()`  
#### `zerotrust.networks`

  * `create()`
  * `delete()`
  * `edit()`
  * `get()`
  * `list()`  
#### General Fixes and Improvements  
#### Type System & Compatibility

  * **Type inference improvements**: Allow Pyright to properly infer TypedDict types within SequenceNotStr
  * **Type completeness**: Add missing types to method arguments and response models
  * **Pydantic compatibility**: Ensure compatibility with Pydantic versions prior to 2.8.0 when using additional fields  
#### Request/Response Handling

  * **Multipart form data**: Correctly handle sending multipart/form-data requests with JSON data
  * **Header handling**: Do not send headers with default values set to omit
  * **GET request headers**: Don't send Content-Type header on GET requests
  * **Response body model accuracy**: Broad improvements to the correctness of models  
#### Parsing & Data Processing

  * **Discriminated unions**: Correctly handle nested discriminated unions in response parsing
  * **Extra field types**: Parse extra field types correctly
  * **Empty metadata**: Ignore empty metadata fields during parsing
  * **Singularization rules**: Update resource name singularization rules for better consistency

Feb 12, 2026
1. ### [Introducing Markdown for Agents](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-12-markdown-for-agents/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)  
Cloudflare's network now supports real-time content conversion at the source, for enabled zones using [content negotiation ↗](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Content%5Fnegotiation) headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for `text/markdown` in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.  
Here is a curl example with the `Accept` negotiation header requesting this page from our developer documentation:  
```bash  
curl https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/ \
  -H "Accept: text/markdown"  
```  
The response to this request is now formatted in markdown:  
```http  
HTTP/2 200  
date: Wed, 11 Feb 2026 11:44:48 GMT  
content-type: text/markdown; charset=utf-8  
content-length: 2899  
vary: accept  
x-markdown-tokens: 725  
content-signal: ai-train=yes, search=yes, ai-input=yes


---  
title: Markdown for Agents · Cloudflare Agents docs
---  
## What is Markdown for Agents  
Markdown has quickly become the lingua franca for agents and AI systems  
as a whole. The format’s explicit structure makes it ideal for AI processing,  
ultimately resulting in better results while minimizing token waste.  
...  
```  
Refer to our [developer documentation](https://edgetunnel-b2h.pages.dev/fundamentals/reference/markdown-for-agents/) and our [blog announcement ↗](https://blog.cloudflare.com/markdown-for-agents/) for more details.

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product/fundamentals/#page","headline":"Cloudflare Fundamentals Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product/fundamentals/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```