Skip to content

Releases: cloudflare/cloudflare-typescript

v6.0.0-beta.1

20 Jan 19:55
99523f7

Choose a tag to compare

v6.0.0-beta.1 Pre-release
Pre-release

6.0.0-beta.1 (2026-01-20)

Disclaimer: Please note that v6.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v5.2.0...v6.0.0-beta.1

In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions,
which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce
our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

Some breaking changes were introduced due to bug fixes, also listed below.

Please ensure you read through the list of changes below before moving to this version - this will help you understand
any down or upstream issues it may cause to your environments.

Breaking Changes

Addressing - Parameter Requirements Changed

  • BGPPrefixCreateParams.cidr: optional → required
  • PrefixCreateParams.asn: number | nullnumber
  • PrefixCreateParams.loa_document_id: required → optional
  • ServiceBindingCreateParams.cidr: optional → required
  • ServiceBindingCreateParams.service_id: optional → required

API Gateway

  • ConfigurationUpdateResponse removed
  • PublicSchemaOldPublicSchema
  • SchemaUploadUserSchemaCreateResponse
  • ConfigurationUpdateParams.properties removed; use normalize

CloudforceOne - Response Type Changes

  • ThreatEventBulkCreateResponse: number → complex object with counts and errors

D1 Database - Query Parameters

  • DatabaseQueryParams: simple interface → union type (D1SingleQuery | MultipleQueries)
  • DatabaseRawParams: same change
  • Supports batch queries via batch array

DNS Records - Type Renames (21 types)

All record type interfaces renamed from *Record to short names:

  • RecordResponse.ARecordRecordResponse.A
  • RecordResponse.AAAARecordRecordResponse.AAAA
  • RecordResponse.CNAMERecordRecordResponse.CNAME
  • RecordResponse.MXRecordRecordResponse.MX
  • RecordResponse.NSRecordRecordResponse.NS
  • RecordResponse.PTRRecordRecordResponse.PTR
  • RecordResponse.TXTRecordRecordResponse.TXT
  • RecordResponse.CAARecordRecordResponse.CAA
  • RecordResponse.CERTRecordRecordResponse.CERT
  • RecordResponse.DNSKEYRecordRecordResponse.DNSKEY
  • RecordResponse.DSRecordRecordResponse.DS
  • RecordResponse.HTTPSRecordRecordResponse.HTTPS
  • RecordResponse.LOCRecordRecordResponse.LOC
  • RecordResponse.NAPTRRecordRecordResponse.NAPTR
  • RecordResponse.SMIMEARecordRecordResponse.SMIMEA
  • RecordResponse.SRVRecordRecordResponse.SRV
  • RecordResponse.SSHFPRecordRecordResponse.SSHFP
  • RecordResponse.SVCBRecordRecordResponse.SVCB
  • RecordResponse.TLSARecordRecordResponse.TLSA
  • RecordResponse.URIRecordRecordResponse.URI
  • RecordResponse.OpenpgpkeyRecordRecordResponse.Openpgpkey

IAM Resource Groups

  • ResourceGroupCreateResponse.scope: optional single → required array
  • ResourceGroupCreateResponse.id: optional → required

Origin CA Certificates - Parameter Requirements Changed

  • OriginCACertificateCreateParams.csr: optional → required
  • OriginCACertificateCreateParams.hostnames: optional → required
  • OriginCACertificateCreateParams.request_type: optional → required

Pages

  • Renamed: DeploymentsSinglePageDeploymentListResponsesV4PagePaginationArray
  • Domain response fields: many optional → required

Pipelines - v0 to v1 Migration

  • Entire v0 API deprecated; use v1 methods (createV1, listV1, etc.)
  • New sub-resources: Sinks, Streams

R2

  • EventNotificationUpdateParams.rules: optional → required
  • Super Slurper: bucket, secret now required in source params

Radar

  • dataSource: string → typed enum (23 values)
  • eventType: string → typed enum (6 values)
  • V2 methods require dimension parameter (breaking signature change)

Resource Sharing

  • Removed: status_message field from all recipient response types

Schema Validation

  • Consolidated SchemaCreateResponse, SchemaListResponse, SchemaEditResponse, SchemaGetResponsePublicSchema
  • Renamed: SchemaListResponsesV4PagePaginationArrayPublicSchemasV4PagePaginationArray

Spectrum

  • Renamed union members: AppListResponse.UnionMember0SpectrumConfigAppConfig
  • Renamed union members: AppListResponse.UnionMember1SpectrumConfigPaygoAppConfig

Workers

  • Removed: WorkersBindingKindTailConsumer type (all occurrences)
  • Renamed: ScriptsSinglePageScriptListResponsesSinglePage
  • Removed: DeploymentsSinglePage

Zero-Trust DLP

  • datasets.create(), update(), get() return types changed
  • PredefinedGetResponse union members renamed to UnionMember0-5

Zero-Trust Tunnels

  • Removed: CloudflaredCreateResponse, CloudflaredListResponse, CloudflaredDeleteResponse, CloudflaredEditResponse, CloudflaredGetResponse
  • Removed: CloudflaredListResponsesV4PagePaginationArray

Features

Abuse Reports (client.abuseReports)

  • Reports: create, list, get
  • Mitigations: sub-resource for abuse mitigations

AI Search (client.aisearch)

  • Instances: create, update, list, delete, read, stats
  • Items: list, get
  • Jobs: create, list, get, logs
  • Tokens: create, update, list, delete, read

Connectivity (client.connectivity)

  • Directory Services: create, update, list, delete, get
  • Supports IPv4, IPv6, dual-stack, and hostname configurations

Organizations (client.organizations)

  • Organizations: create, update, list, delete, get
  • OrganizationProfile: update, get
  • Hierarchical organization support with parent/child relationships

R2 Data Catalog (client.r2DataCatalog)

  • Catalog: list, enable, disable, get
  • Credentials: create
  • MaintenanceConfigs: update, get
  • Namespaces: list
  • Tables: list, maintenance config management
  • Apache Iceberg integration

Realtime Kit (client.realtimeKit)

  • Apps: get, post
  • Meetings: create, get, participant management
  • Livestreams: 10+ methods for streaming
  • Recordings: start, pause, stop, get
  • Sessions: transcripts, summaries, chat
  • Webhooks: full CRUD
  • ActiveSession: polls, kick participants
  • Analytics: organization analytics

Token Validation (client.tokenValidation)

  • Configuration: create, list, delete, edit, get
  • Credentials: update
  • Rules: create, list, delete, bulkCreate, bulkEdit, edit, get
  • JWT validation with RS256/384/512, PS256/384/512, ES256, ES384

Alerting Silences (client.alerting.silences)

  • create, update, list, delete, get

IAM SSO (client.iam.sso)

  • create, update, list, delete, get, beginVerification

Pipelines v1 (client.pipelines)

  • Sinks: create, list, delete, get
  • Streams: create, update, list, delete, get

Zero-Trust AI Controls / MCP (client.zeroTrust.access.aiControls.mcp)

  • Portals: create, update, list, delete, read
  • Servers: create, update, list, delete, read, sync

Accounts

  • managed_by field with parent_org_id, parent_org_name

Addressing LOA Documents

  • auto_generated field on LOADocumentCreateResponse

Addressing Prefixes

  • delegate_loa_creation, irr_validation_state, ownership_validation_state, ownership_validation_token, rpki_validation_state

AI

  • Added toMarkdown.supported() method to get all supported conversion formats

AI Gateway

  • zdr field added to all responses and params

Alerting

  • New alert type: abuse_report_alert
  • type field added to PolicyFilter

Browser Rendering

  • ContentCreateParams: refined to discriminated union (Variant0 | Variant1)
  • Split into URL-based and HTML-based parameter variants for better type safety

Client Certificates

  • reactivate parameter in edit

CloudforceOne

  • ThreatEventCreateParams.indicatorType: required → optional
  • hasChildren field added to all threat event response types
  • datasetIds query parameter on AttackerListParams, CategoryListParams, TargetIndustryListParams
  • categoryUuid field on TagCreateResponse
  • indicators array for multi-indicator support per event
  • uuid and preserveUuid fields for UUID preservation in bulk create
  • format query parameter ('json' | 'stix2') on ThreatEventListParams
  • createdAt, datasetId fields on ThreatEventEditParams

Content Scanning

  • Added create(), update(), get() methods

Custom Pages

  • New page types: basic_challenge, under_attack, waf_challenge

D1

  • served_by_colo - colo that handled query
  • jurisdiction - 'eu' | 'fedramp'
  • Time Travel (client.d1.database.timeTravel): getBookmark(), restore() - point-in-time recovery

Email Security

  • New fields on InvestigateListResponse/InvestigateGetResponse: envelope_from, envelope_to, postfix_id_outbound, replyto
  • New detection classification: 'outbound_ndr'
  • Enhanced Finding interface with attachment, detection, field, portion, reason, score
  • Added cursor query parameter to InvestigateListParams

Gateway Lists

  • New list types: CATEGORY, LOCATION, DEVICE

Intel

  • New issue type: 'configuration_suggestion'
  • payload field: unknown → typed Payload interface with detection_method, zone_tag

Leaked Credential Checks

  • Added detections.get() method

Logpush

  • New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

Load Balancers

  • Monitor.port: number → `...
Read more

v5.2.0

02 Oct 10:20
9df7c8f

Choose a tag to compare

5.2.0 (2025-09-30)

Full Changelog: v5.1.0...v5.2.0

Features

  • Add load balancer monitor groups endpoints (5764b60)
  • Add Radar AS-SET lookup endpoint (e8480e8)
  • Add to_markdown subresource to AI resource (770500f)
  • Rename duplicate parameter in the to_markdown subresource (98ccef7)
  • Deprecate Radar AI inference and leaked credential endpoints (932e696)
  • Remove created_at and updated_at fields from Zero Trust organization (4656a4e)

Performance Improvements

Chores

v5.1.0

12 Sep 17:35
5cebea6

Choose a tag to compare

5.1.0 (2025-09-12)

Full Changelog: v5.0.0...v5.1.0

Features

  • Merge branch 'vaishak/skip-worker-test' into 'main' (a556698)

Bug Fixes

  • coerce nullable values to undefined (7847e84)
  • correctly handle sending multipart/form-data requests with JSON (e9deab6)

Chores

  • ci build action (23d3577)
  • fix lint on the examples (dd14379)
  • fix lint on the examples (dd14379)
  • fix lint on the examples (5b2f145)
  • internal: codegen related update (2860479)

v5.0.0

02 Sep 20:15
83fb4ef

Choose a tag to compare

Full Changelog: v4.5.0...v5.0.0

This is a retroactive changelog for our v5.0.0 release. Cloudflare recognizes that the changelog originally published did not provide the detail needed for users to feel confident in this release and failed to outline the meaningful amount of breaking changes it included.

The large amount of breaking changes in this release are primarily due to a change in OpenAPI definitions, which our libraries are based off of, bug fixes and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

Breaking Changes

Abuse Reports

  • create

    • reportType parameter changed from restricted literal union to generic string type
      • 'abuse_dmca' | 'abuse_trademark' | 'abuse_general' | 'abuse_phishing' | 'abuse_children' | 'abuse_threat' | 'abuse_registrar_whois' | 'abuse_ncsei' -> string
  • AbuseReportsChildrenAbuseReportAbuseReportsCsamReport

  • All Report Types

    • URL separator changed from space/newline to newline only in urls field
    • IP address separator changed from space/newline to newline only in source_ips and destination_ips fields
    • Each report type now requires a specific act value instead of a union of all types:
      • AbuseReportsDmcaReport.act: must be 'abuse_dmca'
      • AbuseReportsTrademarkReport.act: must be 'abuse_trademark'
      • AbuseReportsGeneralReport.act: must be 'abuse_general'
      • AbuseReportsPhishingReport.act: must be 'abuse_phishing'
      • AbuseReportsCsamReport.act: must be 'abuse_children'
      • AbuseReportsThreatReport.act: must be 'abuse_threat'
      • AbuseReportsRegistrarWhoisReport.act: must be 'abuse_registrar_whois'
      • AbuseReportsNcseiReport.act: must be 'abuse_ncsei'
  • AbuseReportsDmcaReport

    • agree: changed from 0 | 1 to 1
    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send'
    • owner_notification: changed from 'send' | 'send-anon' | 'none' to 'send'
    • Optional → Required: address1, agent_name, agree, city, country, original_work, signature, state, host_notification, owner_notification
    • Removed fields: destination_ips, justification, ncmec_notification, ncsei_subject_representation, ports_protocols, source_ips, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsTrademarkReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' only
    • owner_notification: changed from 'send' | 'send-anon' | 'none' to 'send' only
    • Optional → Required: host_notification, justification, owner_notification, trademark_number, trademark_office, trademark_symbol
    • Removed fields: address1, agent_name, agree, city, country, destination_ips, ncmec_notification, ncsei_subject_representation, original_work, ports_protocols, signature, source_ips, state
  • AbuseReportsGeneralReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • Optional → Required: host_notification, justification, owner_notification
    • Removed fields: address1, agent_name, agree, city, country, ncmec_notification, ncsei_subject_representation, original_work, signature, state, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsPhishingReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • owner_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • Optional → Required: host_notification, justification, owner_notification
    • Removed fields: address1, agent_name, agree, city, country, destination_ips, ncmec_notification, ncsei_subject_representation, ports_protocols, signature, source_ips, state, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsCsamReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • ncmec_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • Optional → Required: host_notification, justification, ncmec_notification, owner_notification
    • Removed fields: address1, agent_name, agree, city, destination_ips, ncsei_subject_representation, original_work, ports_protocols, signature, source_ips, state, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsThreatReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • owner_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • Optional → Required: host_notification, justification, owner_notification
    • Removed fields: address1, agent_name, agree, city, country, destination_ips, ncmec_notification, ncsei_subject_representation, original_work, ports_protocols, signature, source_ips, state, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsRegistrarWhoisReport

    • Optional → Required: owner_notification
    • Removed fields: address1, agent_name, agree, city, country, destination_ips, host_notification, justification, ncmec_notification, ncsei_subject_representation, original_work, ports_protocols, signature, source_ips, state, trademark_number, trademark_office, trademark_symbol
  • AbuseReportsNcseiReport

    • host_notification: changed from 'send' | 'send-anon' | 'none' to 'send' | 'send-anon' (removed 'none')
    • ncsei_subject_representation: changed from optional to required boolean
    • Optional → Required: host_notification, ncsei_subject_representation, owner_notification
    • Removed fields: address1, agent_name, agree, city, destination_ips, justification, ncmec_notification, original_work, ports_protocols, signature, source_ips, state, trademark_number, trademark_office, trademark_symbol

Accounts

  • Account
    • Added required field type: 'standard' | 'enterprise'
  • AccountUpdateParams.type
    • Added required field type: 'standard' | 'enterprise'
  • AuditListResponsesCursorLimitPaginationAuditListResponsesCursorPaginationAfter
    • AuditListParams: now extends CursorPaginationAfterParams instead of CursorLimitPaginationParams

Addressing

  • BGPPrefix.withdraw_if_no_routeBGPPrefix.auto_advertise_withdraw

  • BGPPrefixEditParams.withdraw_if_no_routeBGPPrefixEditParams.auto_advertise_withdraw

    Note: This is functionally a rename - the new auto_advertise_withdraw field provides the same functionality as the removed withdraw_if_no_route field.

AI

  • AssetCreateResponse: simplified from object to boolean success flag
    • { success: boolean } -> { id: string, bucket_name: string, created_at: string, file_name: string, finetune_id: string, modified_at: string }

Argo

  • SmartRoutingEditResponse: changed from unknown | string | null to structured interface
    • id: string
    • editable: boolean
    • value: 'on' | 'off'
    • modified_on?: string
  • SmartRoutingGetResponse: changed from unknown | string | null to structured interface
    • id: string
    • editable: boolean
    • value: 'on' | 'off'
    • modified_on?: string

Brand Protection

  • submit:
    • BrandProtectionSubmitParams: removed url parameter
    • Return type: SubmitBrandProtectionSubmitResponse
      • BrandProtectionSubmitResponse structure: { skipped_urls?: Array<{ [key: string]: unknown }>, submitted_urls?: Array<{ [key: string]: unknown }> }
  • urlInfo:
    • BrandProtectionURLInfoParams: removed url and url_id parameters
    • Return type changed from Core.APIPromise<Info> to Core.PagePromise<BrandProtectionURLInfoResponsesSinglePage, BrandProtectionURLInfoResponse>
      • Method now returns paginated results using SinglePage instead of a single object
      • BrandProtectionURLInfoResponse type: { [key: string]: unknown }
    • RuleMatchInfo.RuleMatch
    • ScanStatusInfo.ScanStatus
    • URLInfoModelResultsInfo.ModelResult

Cache

  • VariantEditResponse.value: changed from string to VariantEditResponse.Value
  • VariantGetResponse.value: changed from string to VariantGetResponse.Value
  • VariantGetResponse.Value:
    • avif?: Array<string>
    • bmp?: Array<string>
    • gif?: Array<string>
    • jp2?: Array<string>
    • jpeg?: Array<string>
    • jpg?: Array<string>
    • jpg2?: Array<string>
    • png?: Array<string>
    • tif?: Array<string>
    • tiff?: Array<string>
    • webp?: Array<string>

Cloudforce One

  • Insights class

    • Removed create method
    • Removed delete method
    • Removed edit method
    • Removed get method
    • Removed all associated response and parameter types
  • ThreatEventCreateResponse

    • removed fields id, accountId, indicator, indicatorTypeId, rawId, releasabilityId
  • ThreatEventListResponse.ThreatEvent

    • removed fields id, accountId, indicator, indicatorTypeId, rawId, releasabilityId
  • ThreatEventEditResponse

    • removed fields id, accountId, indicator, indicatorTypeId, rawId, releasabilityId
  • ThreatEventGetResponse

    • removed fields id, accountId, indicator, `indicat...
Read more

v4.5.0

16 Jul 21:36
bb67f21

Choose a tag to compare

4.5.0 (2025-07-16)

Full Changelog: v4.4.1...v4.5.0

Features

Bug Fixes

  • always use multipart/form-data for some endpoints (d4ce21e)
  • api: add missing items param (d9937a1)
  • ci: correct conditional (5257b08)
  • ci: release-doctor — report correct token name (c4f2ddf)
  • client: don't send Content-Type for bodyless methods (cdfc263)

Chores

  • api: Skip broken prism test for updating custom DLP entries (3c50a16)
  • api: skip broken prism tests (0f0ba6e)
  • api: TTL is required on DNS records (a492965)
  • ci: enable for pull requests (6898174)
  • ci: only run for pushes and fork pull requests (ed461eb)
  • internal: codegen related update (6a94ed9)
  • make some internal functions async (4e89649)
  • mention unit type in timeout docs (a5ad7f3)

v4.4.1

16 Jun 21:44
980edbf

Choose a tag to compare

4.4.1 (2025-06-16)

Full Changelog: v4.4.0...v4.4.1

Features

  • client: add support for endpoint-specific base URLs (f399656)

Bug Fixes

  • api: Update zone subscription paths (f0ff0b7)

v4.4.0

16 Jun 18:15
26c2dc7

Choose a tag to compare

4.4.0 (2025-06-16)

Full Changelog: v4.3.0...v4.4.0

Features

Bug Fixes

  • add back kv.namespaces bulk methods (d9218c8)
  • add missing properties (289d3da)
  • AI: Add explicit variant names for union types (9a0b96d)
  • api: 'name' and 'type' are required on dns_record (113bfec)
  • config: Diagnostic errors (383f29e)
  • DLP: Add explicit variant names (557a827)
  • publish script — handle NPM errors correctly (0c1aa10)
  • types: generate missing types (7e6a67f)
  • workers: send multipart as json (27be8af)

Chores

  • api: Fix config indentation (40aefb4)
  • api: Fix edge IPs variant names (73bf59d)
  • api: mark some methods as deprecated (d9a9e71)
  • docs: use top-level-await in example snippets (faf2d8e)
  • improve publish-npm script --latest tag logic (438a2ee)
  • internal: make base APIResource abstract (cec7bde)

v4.3.0

21 May 21:34
7c8244d

Choose a tag to compare

4.3.0 (2025-05-21)

Full Changelog: v4.2.0...v4.3.0

Features

Bug Fixes

  • api: fix path placeholders (61b35dd)
  • client: fix bug where subresource has the same name as its parent resource (1d17818)
  • client: reexported types for subresource with the same name as its parent (a91a792)
  • urlscanner: don't unwwrap scan response (643bd93)

Chores

  • ci: bump node version for release workflows (57c53b4)
  • docs: add missing deprecation warnings (6ddef2c)

Documentation

v4.2.0

18 Mar 04:43
f2ce1b4

Choose a tag to compare

4.2.0 (2025-03-18)

Full Changelog: v4.1.0...v4.2.0

Features

Read more

v4.1.0

11 Feb 03:35
d9aca69

Choose a tag to compare

4.1.0 (2025-02-11)

Full Changelog: v4.0.0...v4.1.0

Features

Read more