What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Cloudflare account:- Accounts - every member of the account, including pending invitations (shown as disabled), with two-factor authentication and single sign-on status where Cloudflare exposes it.
- Non-human identities - account API tokens, the account’s OAuth clients, and, if you use Cloudflare Zero Trust, Access service tokens. Each one is paired with a credential that shows its status, expiry, and scope.
- Groups - user groups and their members. If your account belongs to a Cloudflare organization, Oleria adds a group for the organization’s Super Administrators, because Cloudflare doesn’t list them through the account API.
- Roles - account-, domain-, and resource-scoped permission groups, with each member’s and group’s role assignments, their scope, and whether the policy allows or denies access.
- Activity - events from the account audit log, up to the 18 months Cloudflare retains.
Prerequisites
- The Super Administrator role in your Cloudflare account, or the permission to create account API tokens (API Token Provisioning). Without Super Administrator, you can grant the token only permissions you hold yourself, so you also need every permission in the tables below. To create an OAuth client, you need Super Administrator, Administrator, or OAuth Client Write.
- Your Cloudflare account ID.
- Admin access to the Oleria workspace.
Choose an authentication method
Get your account ID
In the Cloudflare dashboard, press Cmd/Ctrl+K, enter Copy account ID, and select the result. The ID is 32 characters long.Set up an API token
1
Create an account API token
In the Cloudflare dashboard, go to Manage account -> Account API tokens and select Create Token. Make sure the account you want to connect is selected, then enter a token name and grant the permissions in the tables below. Select Continue to summary, review the details, and select Create Token.
2
Copy the token
Copy the token before you leave the page. Cloudflare shows it only once.
If you leave out an optional permission, Oleria skips that inventory and still syncs the rest.
Write permissions, only if you want Oleria to take remediation actions:
Set up OAuth
1
Create a private OAuth client
In the Cloudflare dashboard, go to Manage account -> OAuth clients and select Create client. Keep the client private, choose the response type
code, the grant types authorization_code and refresh_token, and the token authentication method client_secret_post.2
Add the redirect URLs
Add two redirect URLs: your Oleria workspace URL (the one in your browser’s address bar) followed by
/workspace/integrations/cloudflare/connect, and the same URL followed by /workspace/integrations/edit. For example:3
Add the scopes
Add the scopes
account-settings.read, memberships.read, and user-details.read.To let Oleria take remediation actions, also add account-settings.write, scim-provisioning.write, and account-api-tokens.write, and turn off Required for them. Then select the write-actions box when you connect in Oleria.4
Copy the client credentials
Copy the Client ID and Client secret. Cloudflare shows the secret only once.
Connect Cloudflare to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Cloudflare.
2
Complete the connection form
Choose the authentication method and provide the following:
3
Authenticate
Select Authenticate. With an API token, Oleria checks the token and saves the integration. With OAuth, you’re redirected to Cloudflare to approve access, then back to Oleria automatically.
Verify the integration
Confirm Cloudflare appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered members, groups, roles, and tokens in your Oleria workspace.If you roll or replace the API token in Cloudflare, update it in Oleria by editing the integration.
Remediation actions
Beyond discovery, Oleria can act on Cloudflare access to remediate risk. Remediation needs the write permissions described above. Oleria checks the permission before an action runs and reports it if it’s missing.
Disable NHI accounts needs Account API Tokens Write for account API tokens and Access: Service Tokens Write for Access service tokens. Every other action needs SCIM Provisioning or Account Settings Write. With OAuth, the matching scopes are
account-api-tokens.write and scim-provisioning.write or account-settings.write; an OAuth connection can’t disable Access service tokens.
Oleria won’t act on the user or token your connection runs as, or on a token created through your connection’s OAuth client, and it won’t remove or demote the last Super Administrator. User groups that Cloudflare synchronizes from an identity provider are read-only.
Known limitations
- Dormant account detection is partial. Cloudflare doesn’t expose a last login for members. Oleria uses the newest audit log event a member performed, which covers configuration changes only. Dashboard logins aren’t in the audit log. Oleria looks this up for up to 500 members per sync, and members beyond that show no last activity.
- Admin status comes from directly assigned roles. A member who is an administrator only through a user group isn’t marked as an admin. The group’s role assignments still show that access.
- OAuth connections see less. An OAuth connection can’t read the OAuth client inventory or single sign-on status, so those fields report as unavailable. It reads API tokens only when
account-api-tokens.writeis granted, because Cloudflare has no read scope for them, and it doesn’t read Access service tokens. Use an API token for full coverage. - Some tokens can’t be listed. Cloudflare has no account-level list for user-owned API tokens, Global API keys, or third-party OAuth authorizations, so Oleria doesn’t inventory them.
- Organization Super Administrators are implicit. They can’t be listed with an account credential, so Oleria represents them with a single group.
- The audit log has gaps. Cloudflare’s audit log v2 doesn’t record user group or OAuth client creation.
- One account per integration. Add one integration for each Cloudflare account.
Existing SCIM connections
If you connected Cloudflare earlier with the SCIM setup, that connection keeps syncing members, groups, and roles. Oleria now also reads the audit log, which needs the Account Settings Read permission. A token that only holds SCIM Provisioning reports partial activity data until you add it. To use the rest of what’s described on this page, edit the integration and enter an API token with the permissions above. Edit the existing integration rather than adding a new one: Oleria doesn’t recognize the same account connected through both setups. After the switch, the first sync re-creates your Cloudflare accounts with new IDs, adds pending invitations as disabled accounts, and replaces theCF-<account> - <role> groups with Cloudflare roles and user groups. Update any access reviews or workflows that used the old groups. The Disable user accounts action now removes the member from the account, because Cloudflare has no suspended state. Reverting it invites the member again, and they have to accept the invitation.
If your SCIM token was created under My Profile -> API Tokens, it belongs to a person. Replace it with an account API token so the connection survives that person leaving.