Changelog

Markdown for Agents now preserves security- and cache-relevant response headers from your origin when converting HTML to Markdown:

• Markdown for Agents preserves security headers such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, Set-Cookie, and CORS headers (for example, Access-Control-Allow-Origin) on the converted response.
• Caching headers (Cache-Control, Expires, Age) continue to pass through.

Your origin's Content Signals ↗ policy is now authoritative. If your origin sets a content-signal header, Markdown for Agents preserves it. When the origin does not send one, Cloudflare adds the default Content-Signal: ai-train=yes, search=yes, ai-input=yes.

This release also fixes relative link resolution for directory-style base URLs (those ending in a trailing slash). Previously, relative links such as ../page/ could resolve one path segment too high and return a 404. Links are now resolved correctly per RFC 3986 ↗.

Refer to our developer documentation for more details.

You can now assign granular, resource-scoped roles for Cloudflare Gateway firewall policies and Zero Trust lists. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.

When you add a member or create a permission policy, the following resource-scoped roles are now available:

These roles allow you to:

• Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.
• Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.
• Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.

You can also now assign Resource-scoped roles. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. Existing account-level roles continue to work. A member with the Cloudflare Gateway or Cloudflare Zero Trust role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.

• Review the resource-scoped roles on the Cloudflare role reference.
• Learn how to create permission policies that use these roles.

You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating.

• Dashboard search: Both account API tokens ↗ and user API tokens ↗ pages now include a search bar. Type a name to filter results.
• API search support: The /user/tokens and /accounts/{account_id}/tokens endpoints now accept a name query parameter to filter tokens by name.

For more information, refer to Create an API token and Account API tokens.

Pay-as-you-go customers can now view billable usage and create budget alerts directly from the product overview pages for Workers & Pages, D1, R2, Workers KV, Queues, Vectorize, Durable Objects, and Containers. A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.

The widget pulls from the same data as the Billable Usage dashboard and aligns to your billing cycle (or the current day on Free plans), so the numbers match your invoice. Enterprise contract accounts are not yet supported.

Selecting Create budget alert opens the budget alert flow inline so you can set a dollar threshold in the same place you are reviewing usage. Budget alerts apply to your total account-level spend across all products, not just the product page you create them from.

For more information, refer to the Usage-based billing documentation.

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.

OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into that account.

Cloudflare Developers can now create and manage their own OAuth applications to integrate with Cloudflare.

To create an application, go to Manage account > OAuth clients in your account on the Cloudflare dashboard.

If you have used an API token to call Cloudflare APIs, OAuth client scopes will look familiar. Select only the scopes your application needs during application creation, and include that scope list when sending users to Cloudflare for consent.

Users can review the requested scopes before they consent.

Applications start with private visibility. Private applications can only be used by members of the account where the application was created.

To make an application available to any Cloudflare user, complete the prerequisites for public visibility.

For more information, refer to client visibility.

Before an application can be made public, you must verify the client domain. Domain verification helps users confirm that the application owner controls the domain shown on the consent page.

After verification, users see a verified badge on the consent page.

For more information, refer to domain verification.

For more information, refer to OAuth clients.

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopable resource types. You can:

• Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
• Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
• Scope a single policy to one or many Tunnels and Mesh nodes at once.

Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

• Existing account-level roles continue to work. A member with Cloudflare Access or Cloudflare Zero Trust retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
• Granular permissions are additive. For any API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
• Resource enumeration is authorization-aware. Listing endpoints (GET /accounts/{id}/cfd_tunnel, GET /accounts/{id}/warp_connector) return only the resources the principal has at least read access to.

• Configure granular permissions for Cloudflare Tunnel.
• Configure granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One.
• Review the resource-scoped roles on the Cloudflare role reference.

You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press ? anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your profile settings ↗.

You can now pay for Cloudflare services directly from your bank account using Instant Bank Payments via Link.

Link ↗ now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow.

1. During checkout, select your bank account from your saved Link payment methods.
2. Confirm the payment.

After your first Link authentication, your bank account is available for future purchases without re-entering details.

Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout.

Bank-based Link payments appear in your billing history with the payment method shown as link and last four digits as 0000. For details, refer to the Instant Bank Payments via Link documentation.

Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow RFC 9457 (Problem Details for HTTP APIs) ↗ and include a Retry-After HTTP header on retryable codes.

5xx coverage. Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. These are errors Cloudflare itself generates when it cannot reach or understand the origin server. Origin-generated 5xx responses that Cloudflare passes through are not affected.

Fault attribution. The error_category field tells agents where the fault lies:

• origin (502, 504, 520-524) — the origin server is responsible. Transient; retry with the backoff in retry_after.
• cloudflare (500) — Cloudflare's fault, not the website or the request. Short retry.
• ssl (525, 526) — the origin's TLS configuration is broken. Do not retry.

Retry-After header. Retryable codes (500, 502, 504, 520-524) include a Retry-After HTTP header matching the retry_after body field. Non-retryable codes (525, 526) do not include the header.

Available now for all zones on all plans.

Get JSON response for error 522:

curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/522" | jq .

Check presence of the Retry-After HTTP header associated with the JSON response for error 521:

curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/521" | grep -i retry-after

References:

• RFC 9457 — Problem Details for HTTP APIs ↗
• Cloudflare 5xx error documentation

Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need.

• Broad resource type support — Tag zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, Durable Object namespaces, Queues, Stream videos, Images, Access applications, Gateway rules, AI Gateways, and more. Refer to the full list of supported resource types.
• Powerful filtering — Query tagged resources using AND/OR logic, negation, and key-only matching. Combine up to 20 filters per query to build precise resource views.
• Account and zone-level endpoints — Full CRUD operations across both scopes.
• Token-based authentication — Tagging supports Account Owned Tokens that persist independently of individual users, so your automation keeps running through credential rotations and team changes.
• Flexible role support — Super Administrators, Workers Admins, and Tag Admins can all manage tags.

The API is the primary interface for Resource Tagging and the recommended path for all workflows — scripting tag assignments, building CI/CD pipelines, or integrating with your infrastructure-as-code toolchain.

You can also view and manage tagged resources directly in the Cloudflare dashboard. Navigate to Manage Account > Resource Tagging to see all tagged resources across your account, filter by resource name or tag, and add or edit tags inline.

In future releases, expect support for additional resource types across the Cloudflare platform, tag-based access control policies for scoping user permissions to tagged resources, billing and usage attribution by tag for breaking down costs by team, project, or environment, and Terraform provider support for managing tags declaratively.

• PUT replaces all tags on a resource (no partial update). Use the GET, merge, PUT workflow to modify individual tags safely.
• DELETE removes all tags from a resource. To remove a single tag, PUT the remaining tags back.
• Querying tags for a resource that has never been tagged returns 500 instead of 404. This is a known beta limitation.

To get started, refer to the Resource Tagging documentation.

A new Network Overview page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products.

From the Network Overview page, you can:

• Connect resources with Cloudflare Tunnel - Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet.
• Monitor traffic with Network Flow - Get real-time visibility into traffic volume from your routers.
• Configure Address Maps - Map dedicated static IPs or BYOIP prefixes to specific hostnames.
• Explore Magic Transit and Cloudflare WAN - Set up DDoS protection for your networks and connectivity for your branch offices and data centers.

To find it, go to Networking ↗ in the dashboard sidebar.

If you already use Magic Transit, Cloudflare WAN, or other Cloudflare network services products, your existing experience is unchanged.

Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts.

The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill.

The dashboard displays:

• A bar chart showing daily usage charges for your billing period
• A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs
• Ability to view previous billing periods

Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice.

To access the dashboard, go to Manage Account > Billing > Billable Usage.

Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end.

To configure a budget alert:

1. Go to Manage Account > Billing > Billable Usage.
2. Select Set Budget Alert.
3. Enter a budget threshold amount greater than $0.
4. Select Create.

Alternatively, configure alerts via Notifications > Add > Budget Alert.

You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold.

Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported.

For more information, refer to the Usage based billing documentation.

OAuth allows third-party applications to access your Cloudflare account on your behalf — like when Wrangler deploys Workers or when monitoring tools read your analytics. You now have granular control over which accounts these applications can access, plus the ability to revoke access anytime.

When authorizing an OAuth application, you can now select specific accounts instead of granting access to all your accounts:

• Account-by-account selection — Choose exactly which accounts the application can access
• "All accounts" option — Still available for trusted tools like Wrangler This gives you precise control who can access your data.

The OAuth consent screen now shows:

• What the application can access — Explicit list of permissions being requested
• Who created the application — Application owner and contact information
• Which accounts you're authorizing — Checkboxes for account selection

Manage authorized OAuth applications from your profile:

• See all connected apps — View every OAuth application with access to your accounts
• Review permissions and scope — Check what each application can do and which accounts it can access
• Revoke instantly — Remove access with one click when you no longer need it To manage your OAuth applications, navigate to Profile > Access Management > Connected Applications ↗.

These updates give you:

• Granular control — Authorize apps per-account instead of all-or-nothing
• Transparency — Know exactly what you're authorizing before you consent
• Security — Limit blast radius by restricting access to only necessary accounts
• Easy cleanup — Revoke access when applications are no longer needed

Read more about these improvements in our blog post: Improving the OAuth consent experience ↗.

Cloudflare API tokens now include identifiable patterns that enable secret scanning tools to automatically detect them when leaked in code repositories, configuration files, or other public locations.

API tokens generated by Cloudflare now follow a standardized format that secret scanning tools can recognize. When a Cloudflare token is accidentally committed to GitHub, GitLab, or another platform with secret scanning enabled, the tool will flag it and alert you.

Leaked credentials are a common security risk. By making Cloudflare tokens detectable by scanning tools, you can:

• Detect leaks faster — Get notified immediately when a token is exposed.
• Reduce risk window — Exposed tokens are deactivated immediately, before they can be exploited.
• Automate security — Leverage existing secret scanning infrastructure without additional configuration.

When a third-party secret scanning tool detects a leaked Cloudflare API token:

1. Cloudflare immediately deactivates the token to prevent unauthorized access.
2. The token creator receives an email notification alerting them to the leak.
3. The token is marked as "Exposed" in the Cloudflare dashboard.
4. You can then roll or delete the token from the token management pages.

• GitHub Secret Scanning — Automatically enabled for public repositories

For more information on token formats and secret scanning, refer to API token formats.

We're announcing the public beta of Organizations for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location.

What's New

Organizations [BETA]: Organizations are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale.

Self-serve onboarding: Enterprise customers can create an Organization in the dashboard and assign accounts where they are already Super Administrators.

Centralized Account Management: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. Shared policies: Share WAF or Gateway policies across multiple accounts within your Organization to simplify centralized policy management. Implicit access: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year.

Unified analytics: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events.

Terraform provider support: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the Cloudflare Terraform provider ↗.

Shared policies: Share WAF or Gateway policies across multiple accounts within your Organization to simplify centralized policy management.

For more info:

• Get started with Organizations
• Set up your Organization
• Review limitations

Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026.

API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation.

Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires.

If you use cloudflared, update to a version from November 2022 or later. These versions already use API Tokens.

If you use origin-ca-issuer ↗, update to a version that supports API Token authentication.

For more information, refer to API deprecations.

Cloudflare dashboard SCIM provisioning now supports Authentik ↗ as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers.

Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik Identity Provider.

For more information:

• SCIM provisioning overview
• Provision with Authentik

Cloudflare dashboard SCIM provisioning operations are now captured in Audit Logs v2, giving you visibility into user and group changes made by your identity provider.

Logged actions:

For more details, refer to the Audit Logs v2 documentation.

Cloudflare-generated 1xxx error responses now include a standard Retry-After HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone — no body parsing required.

Seven retryable error codes now emit Retry-After:

The header value matches the existing retry_after body field in JSON and Markdown responses.

If a WAF rate limiting rule has already set a dynamic Retry-After value on the response, that value takes precedence.

Available for all zones on all plans.

Check for the header on any retryable error:

curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | grep -i retry-after

References:

• RFC 9110 section 10.2.3 - Retry-After ↗
• Cloudflare 1xxx error documentation

Cloudflare-generated 1xxx errors now return structured JSON when clients send Accept: application/json or Accept: application/problem+json. JSON responses follow RFC 9457 (Problem Details for HTTP APIs) ↗, so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code.

The Markdown frontmatter field http_status has been renamed to status. Agents consuming Markdown frontmatter should update parsers accordingly.

JSON format. Clients sending Accept: application/json or Accept: application/problem+json now receive a structured JSON object with the same operational fields as Markdown frontmatter, plus RFC 9457 standard members.

RFC 9457 standard members (JSON only):

• type — URI pointing to Cloudflare documentation for the specific error code
• status — HTTP status code (matching the response status)
• title — short, human-readable summary
• detail — human-readable explanation specific to this occurrence
• instance — Ray ID identifying this specific error occurrence

Field renames:

• http_status -> status (JSON and Markdown)
• what_happened -> detail (JSON only — Markdown prose sections are unchanged)

Content-Type mirroring. Clients sending Accept: application/problem+json receive Content-Type: application/problem+json; charset=utf-8 back; Accept: application/json receives application/json; charset=utf-8. Same body in both cases.

Available now for Cloudflare-generated 1xxx errors.

curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

curl -s --compressed -H "Accept: application/problem+json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

References:

• RFC 9457 — Problem Details for HTTP APIs ↗
• Cloudflare 1xxx error documentation

Cloudflare now returns structured Markdown responses for Cloudflare-generated 1xxx errors when clients send Accept: text/markdown.

Each response includes YAML frontmatter plus guidance sections (What happened / What you should do) so agents can make deterministic retry and escalation decisions without parsing HTML.

In measured 1,015 comparisons, Markdown reduced payload size and token footprint by over 98% versus HTML.

Included frontmatter fields:

• error_code, error_name, error_category, http_status
• ray_id, timestamp, zone
• cloudflare_error, retryable, retry_after (when applicable), owner_action_required

Default behavior is unchanged: clients that do not explicitly request Markdown continue to receive HTML error pages.

Cloudflare uses standard HTTP content negotiation on the Accept header.

• Accept: text/markdown -> Markdown
• Accept: text/markdown, text/html;q=0.9 -> Markdown
• Accept: text/* -> Markdown
• Accept: */* -> HTML (default browser behavior)

When multiple values are present, Cloudflare selects the highest-priority supported media type using q values. If Markdown is not explicitly preferred, HTML is returned.

Available now for Cloudflare-generated 1xxx errors.

curl -H "Accept: text/markdown" https://<your-domain>/cdn-cgi/error/1015

Reference: Cloudflare 1xxx error documentation

When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

This release adds the following improvements:

• The origin response limit was raised from 1 MB to 2 MB (2,097,152 bytes).
• We no longer require the origin to send the content-length header.
• We now support content encoded responses from the origin.

If you haven’t enabled automatic Markdown conversion yet, visit the AI Crawl Control ↗ section of the Cloudflare dashboard and enable Markdown for Agents.

Refer to our developer documentation for more details.

Fine-grained permissions for Access policies and Access service tokens are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources.

• Cloudflare Access policy admin: Can edit a specific Access policy in an account.
• Cloudflare Access service token admin: Can edit a specific Access service token in an account.

These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets.

For more information:

• Resource-scoped roles
• Role scopes

Disclaimer: Please note that v5.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v4.3.1...v5.0.0-beta.1 ↗

In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

There may be changes that are not captured in this changelog. Feel free to open an issue to report any inaccuracies, and we will make sure it gets into the changelog before the v5.0.0 release.

Most of the breaking changes below are caused by improvements to the accuracy of the base OpenAPI schemas, which sometimes translates to breaking changes in downstream clients that depend on those schemas.

Please ensure you read through the list of changes below and the migration guide before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

The following resources have breaking changes. See the v5 Migration Guide ↗ for detailed migration instructions.

• abusereports
• acm.totaltls
• apigateway.configurations
• cloudforceone.threatevents
• d1.database
• intel.indicatorfeeds
• logpush.edge
• origintlsclientauth.hostnames
• queues.consumers
• radar.bgp
• rulesets.rules
• schemavalidation.schemas
• snippets
• zerotrust.dlp
• zerotrust.networks

• abusereports - Abuse report management
• abusereports.mitigations - Abuse report mitigation actions
• ai.tomarkdown - AI-powered markdown conversion
• aigateway.dynamicrouting - AI Gateway dynamic routing configuration
• aigateway.providerconfigs - AI Gateway provider configurations
• aisearch - AI-powered search functionality
• aisearch.instances - AI Search instance management
• aisearch.tokens - AI Search authentication tokens
• alerting.silences - Alert silence management
• brandprotection.logomatches - Brand protection logo match detection
• brandprotection.logos - Brand protection logo management
• brandprotection.matches - Brand protection match results
• brandprotection.queries - Brand protection query management
• cloudforceone.binarystorage - CloudForce One binary storage
• connectivity.directory - Connectivity directory services
• d1.database - D1 database management
• diagnostics.endpointhealthchecks - Endpoint health check diagnostics
• fraud - Fraud detection and prevention
• iam.sso - IAM Single Sign-On configuration
• loadbalancers.monitorgroups - Load balancer monitor groups
• organizations - Organization management
• organizations.organizationprofile - Organization profile settings
• origintlsclientauth.hostnamecertificates - Origin TLS client auth hostname certificates
• origintlsclientauth.hostnames - Origin TLS client auth hostnames
• origintlsclientauth.zonecertificates - Origin TLS client auth zone certificates
• pipelines - Data pipeline management
• pipelines.sinks - Pipeline sink configurations
• pipelines.streams - Pipeline stream configurations
• queues.subscriptions - Queue subscription management
• r2datacatalog - R2 Data Catalog integration
• r2datacatalog.credentials - R2 Data Catalog credentials
• r2datacatalog.maintenanceconfigs - R2 Data Catalog maintenance configurations
• r2datacatalog.namespaces - R2 Data Catalog namespaces
• radar.bots - Radar bot analytics
• radar.ct - Radar certificate transparency data
• radar.geolocations - Radar geolocation data
• realtimekit.activesession - Real-time Kit active session management
• realtimekit.analytics - Real-time Kit analytics
• realtimekit.apps - Real-time Kit application management
• realtimekit.livestreams - Real-time Kit live streaming
• realtimekit.meetings - Real-time Kit meeting management
• realtimekit.presets - Real-time Kit preset configurations
• realtimekit.recordings - Real-time Kit recording management
• realtimekit.sessions - Real-time Kit session management
• realtimekit.webhooks - Real-time Kit webhook configurations
• tokenvalidation.configuration - Token validation configuration
• tokenvalidation.rules - Token validation rules
• workers.beta - Workers beta features

• edit()
• update()

• list()

• create()
• get()
• update()

• scan_list()
• scan_review()
• scan_trigger()

• create()
• delete()
• list()

• get()

• list()

• summary()
• timeseries()
• timeseries_groups()

• changes()
• snapshot()

• delete()

• create()
• delete()
• edit()
• get()
• list()

• Type inference improvements: Allow Pyright to properly infer TypedDict types within SequenceNotStr
• Type completeness: Add missing types to method arguments and response models
• Pydantic compatibility: Ensure compatibility with Pydantic versions prior to 2.8.0 when using additional fields

• Multipart form data: Correctly handle sending multipart/form-data requests with JSON data
• Header handling: Do not send headers with default values set to omit
• GET request headers: Don't send Content-Type header on GET requests
• Response body model accuracy: Broad improvements to the correctness of models

• Discriminated unions: Correctly handle nested discriminated unions in response parsing
• Extra field types: Parse extra field types correctly
• Empty metadata: Ignore empty metadata fields during parsing
• Singularization rules: Update resource name singularization rules for better consistency

Cloudflare's network now supports real-time content conversion at the source, for enabled zones using content negotiation ↗ headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

Here is a curl example with the Accept negotiation header requesting this page from our developer documentation:

curl https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/ \
  -H "Accept: text/markdown"

The response to this request is now formatted in markdown:

HTTP/2 200
date: Wed, 11 Feb 2026 11:44:48 GMT
content-type: text/markdown; charset=utf-8
content-length: 2899
vary: accept
x-markdown-tokens: 725
content-signal: ai-train=yes, search=yes, ai-input=yes

---
title: Markdown for Agents · Cloudflare Agents docs
---

## What is Markdown for Agents

Markdown has quickly become the lingua franca for agents and AI systems
as a whole. The format’s explicit structure makes it ideal for AI processing,
ultimately resulting in better results while minimizing token waste.
...

Refer to our developer documentation and our blog announcement ↗ for more details.