schema

Cloudflare Schema

graph LR
    CloudflareAccount -- RESOURCE --> CloudflareDNSRecord
    CloudflareAccount -- RESOURCE --> CloudflareMember
    CloudflareAccount -- RESOURCE --> CloudflareR2Bucket
    CloudflareAccount -- RESOURCE --> CloudflareRole
    CloudflareAccount -- RESOURCE --> CloudflareRuleset
    CloudflareAccount -- RESOURCE --> CloudflareRulesetRule
    CloudflareAccount -- RESOURCE --> CloudflareWorkerRoute
    CloudflareAccount -- RESOURCE --> CloudflareWorkerScript
    CloudflareAccount -- RESOURCE --> CloudflareZone
    CloudflareMember -- HAS_ROLE --> CloudflareRole
    CloudflareRuleset -- HAS_RULE --> CloudflareRulesetRule
    CloudflareRulesetRule -- EXECUTES --> CloudflareRuleset
    CloudflareWorkerRoute -- ROUTES_TO --> CloudflareWorkerScript
    CloudflareZone -- HAS_R2_CUSTOM_DOMAIN --> CloudflareR2Bucket
    CloudflareZone -- HAS_RECORD --> CloudflareDNSRecord
    CloudflareZone -- HAS_ROUTE --> CloudflareWorkerRoute
    CloudflareZone -- HAS_RULESET --> CloudflareRuleset
    CloudflareZone -- RESOURCE --> CloudflareDNSRecord

CloudflareAccount

A Cloudflare account that contains managed resources.

Ontology Mapping: This node uses the ontology label Tenant.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Cloudflare account ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
abuse_contact_email Contact email for abuse reports.
created_on Timestamp when the account was created.
default_nameservers Deprecated default nameserver setting for new zones.
enforce_twofactor Whether account membership requires two-factor authentication.
name Account name.
use_account_custom_ns_by_default Deprecated setting for using account custom nameservers by default.
_ont_name Yes Normalized field sourced from name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareDNSRecord)

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareMember): The account contains the member.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareR2Bucket): The account contains the R2 bucket.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRole): The account contains the role.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRuleset): The account contains the ruleset.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRulesetRule): The account contains the ruleset rule.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareWorkerRoute): The account contains the Worker route.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareWorkerScript): The account contains the Worker script.

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareZone): The account contains the DNS zone.

CloudflareDNSRecord

A DNS record in Cloudflare.

Ontology Mapping: This node uses the ontology label DNSRecord.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes DNS record ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
comment DNS record comment.
created_on Timestamp when the record was created.
modified_on Timestamp when the record was last modified.
name Yes DNS record name.
proxiable Whether Cloudflare can proxy the record.
proxied Whether Cloudflare proxies the record.
ttl DNS record TTL; 1 indicates automatic TTL.
type DNS record type.
value Value or address to which the record points.
_ont_name Yes Normalized field sourced from name.
_ont_source Module that populated this node's ontology fields.
_ont_type Yes Normalized field sourced from type.
_ont_value Yes Normalized field sourced from value.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareDNSRecord)

  • (:CloudflareZone)-[:HAS_RECORD]->(:CloudflareDNSRecord): The DNS zone contains the DNS record.

  • (:CloudflareZone)-[:RESOURCE]->(:CloudflareDNSRecord)

CloudflareMember

A user membership in a Cloudflare account.

Ontology Mapping: This node uses the ontology label UserAccount.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Membership ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
email Related user's email address.
firstname Related user's first name.
lastname Related user's last name.
status Membership status in the account.
two_factor_authentication_enabled Whether the related user enabled two-factor authentication.
user_id Related user's ID.
_ont_active Yes Normalized field sourced from status.
_ont_email Yes Normalized field sourced from email.
_ont_firstname Yes Normalized field sourced from firstname.
_ont_has_mfa Yes Normalized field sourced from two_factor_authentication_enabled.
_ont_lastname Yes Normalized field sourced from lastname.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareMember): The account contains the member.

  • (:CloudflareMember)-[:HAS_ROLE]->(:CloudflareRole): The member has the assigned role.

  • (:User)-[:HAS_ACCOUNT]->(:UserAccount)

CloudflareR2Bucket

An R2 object storage bucket in Cloudflare.

Ontology Mapping: This node uses the ontology label ObjectStorage.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Bucket ID, built as <account_id>/<jurisdiction>/<bucket name>.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
creation_date Timestamp when the bucket was created.
exposed_internet Yes True when an enabled r2.dev or custom domain serves the bucket. Left null when either domain source could not be read, since a partial read must not downgrade a reachable bucket.
exposed_internet_type Yes How it is exposed. Always direct, since the bucket is served at its own hostname.
jurisdiction Jurisdiction the bucket objects are guaranteed to be stored in.
location Location hint of the bucket, such as weur or enam.
name Yes Bucket name.
public Whether the bucket is reachable from the internet through its managed r2.dev domain or an enabled custom domain.
public_domains Hostnames serving the bucket publicly, including the managed r2.dev domain and any enabled custom domain.
r2_dev_enabled Whether the bucket is served on its managed r2.dev domain.
storage_class Default storage class applied to newly uploaded objects.
_ont_encrypted Yes Property generated by the ontology mapping.
_ont_location Yes Normalized field sourced from location.
_ont_name Yes Normalized field sourced from name.
_ont_public Yes Normalized field sourced from public.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareR2Bucket): The account contains the R2 bucket.

  • (:CloudflareZone)-[:HAS_R2_CUSTOM_DOMAIN]->(:CloudflareR2Bucket): The DNS zone hosts an enabled custom domain serving the R2 bucket.

CloudflareRole

A permission role in Cloudflare.

Ontology Mapping: This node uses the ontology label PermissionRole.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Role ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
description Description of the role's permissions.
name Role name.
_ont_name Yes Normalized field sourced from name.
_ont_scope Yes Property generated by the ontology mapping.
_ont_source Module that populated this node's ontology fields.
_ont_type Yes Property generated by the ontology mapping.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRole): The account contains the role.

  • (:CloudflareMember)-[:HAS_ROLE]->(:CloudflareRole): The member has the assigned role.

CloudflareRuleset

A Cloudflare ruleset, as deployed in one scope. Rulesets are the engine behind the Cloudflare WAF: the security phases carry the request filtering, rate limiting and bot mitigation configuration, while other phases handle caching, transforms and redirects.

Only deployed rulesets are ingested, that is the phase entry point rulesets of a scope and whatever an enabled execute rule in them turns on. A ruleset that merely exists, such as a Cloudflare-provided one nothing executes, has no node.

Conditional Labels:

  • NetworkAccessControl (ontology label) when security_ruleset equals true. A cross-provider NetworkAccessControl resource in Cartography's ontology.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Ruleset deployment ID, built as <zone_id>/<ruleset_id> for a zone-level ruleset and <account_id>/<ruleset_id> for an account-level one.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
description Informative description of the ruleset.
kind Kind of the ruleset: managed for Cloudflare-provided rulesets, custom, root or zone for customer-authored ones.
last_updated Timestamp when the ruleset was last modified.
name Yes Human-readable name of the ruleset.
phase Request-processing phase the ruleset runs in, such as http_request_firewall_custom.
ruleset_id Yes Ruleset ID as returned by the Cloudflare API. Shared by every deployment of a Cloudflare-provided ruleset, and the value that CloudflareRulesetRule.executed_ruleset_id points at.
scope Level the ruleset is deployed at: account for a ruleset covering every zone in the account, zone for a single-zone ruleset.
security_ruleset Whether the ruleset phase performs access control, as opposed to caching, transforming or redirecting requests. Drives the NetworkAccessControl ontology label.
version Version of the ruleset.
_ont_name Yes Normalized field sourced from name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRuleset): The account contains the ruleset.

  • (:CloudflareRuleset)-[:HAS_RULE]->(:CloudflareRulesetRule): The ruleset contains the rule.

  • (:CloudflareRulesetRule)-[:EXECUTES]->(:CloudflareRuleset): The rule turns on another ruleset, typically a Cloudflare managed one. The target is the deployment in the scope the rule was read from, not every deployment sharing the executed ruleset's API ID.

  • (:CloudflareZone)-[:HAS_RULESET]->(:CloudflareRuleset): The DNS zone applies the ruleset to its incoming requests. Absent on account-level rulesets, which are not tied to a single zone.

CloudflareRulesetRule

A rule inside a Cloudflare ruleset.

Properties

Field Index Description
id Yes Rule ID, built as <ruleset deployment id>/<rule_id>.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
action Action performed when the rule matches, such as block, managed_challenge or execute.
categories Categories of the rule.
description Informative description of the rule.
enabled Whether the rule is executed.
executed_deployment_id Deployment ID of the ruleset this rule executes, resolved in the scope the rule itself was read from.
executed_ruleset_id Cloudflare API ID of the ruleset this rule executes, shared by every deployment of that ruleset. Set only on execute rules, which is how a zone or an account turns on a Cloudflare managed ruleset. Follow the EXECUTES relationship to reach the single deployment this rule actually turns on.
expression Expression defining which traffic matches the rule.
last_updated Timestamp when the rule was last modified.
logging_enabled Whether the rule logs its matches.
ratelimit_period Period in seconds over which the rate limit counter increments.
ratelimit_requests_per_period Request threshold per period before the action is executed.
ref Reference of the rule, defaulting to the rule ID.
rule_id Yes Rule ID as returned by the Cloudflare API.
ruleset_id Deployment ID of the ruleset the rule belongs to, matching CloudflareRuleset.id.
version Version of the rule.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareRulesetRule): The account contains the ruleset rule.

  • (:CloudflareRuleset)-[:HAS_RULE]->(:CloudflareRulesetRule): The ruleset contains the rule.

  • (:CloudflareRulesetRule)-[:EXECUTES]->(:CloudflareRuleset): The rule turns on another ruleset, typically a Cloudflare managed one. The target is the deployment in the scope the rule was read from, not every deployment sharing the executed ruleset's API ID.

CloudflareWorkerRoute

A route binding a zone URL pattern to a Cloudflare Worker script.

Properties

Field Index Description
id Yes Route ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
pattern Yes URL pattern incoming requests are matched against.
script Name of the Worker script invoked when the route matches.
zone_id ID of the zone the route is defined in.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareWorkerRoute): The account contains the Worker route.

  • (:CloudflareWorkerRoute)-[:ROUTES_TO]->(:CloudflareWorkerScript): The route invokes the Worker script.

  • (:CloudflareZone)-[:HAS_ROUTE]->(:CloudflareWorkerRoute): The DNS zone routes matching requests through the Worker route.

CloudflareWorkerScript

A Worker script deployed in Cloudflare.

Ontology Mapping: This node uses the ontology label Function.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Script ID, built as <account_id>/<script name>.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
compatibility_date Workers runtime version the script targets.
compatibility_flags Runtime feature flags enabled or disabled for the script.
created_on Timestamp when the script was created.
etag Hash of the script content.
has_assets Whether the script serves static assets.
has_modules Whether the script uses ES modules.
last_deployed_from Client most recently used to deploy the script.
logpush Whether Logpush is turned on for the script.
modified_on Timestamp when the script was last modified.
name Yes Script name.
observability_enabled Whether observability is enabled for the script.
placement_mode Placement mode of the script, such as smart or targeted.
tag Immutable Cloudflare ID of the script.
usage_model Usage model billed for the script invocations.
_ont_deployment_type Yes Property generated by the ontology mapping.
_ont_name Yes Normalized field sourced from name.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareWorkerScript): The account contains the Worker script.

  • (:CloudflareWorkerRoute)-[:ROUTES_TO]->(:CloudflareWorkerScript): The route invokes the Worker script.

CloudflareZone

A DNS zone managed by Cloudflare.

Ontology Mapping: This node uses the ontology label DNSZone.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Cloudflare zone ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
activated_on Timestamp when ownership was verified and the zone became active.
cdn_only Whether the zone is configured only for CDN.
created_on Timestamp when the zone was created.
custom_certificate_quota Number of custom certificates allowed for the zone.
development_mode Seconds until development mode expires, or since it expired.
dns_only Whether the zone is configured only for DNS.
foundation_dns Whether the zone uses Foundation DNS.
modified_on Timestamp when the zone was last modified.
name Domain name.
original_dnshost DNS host used before switching to Cloudflare.
original_registrar Registrar used before switching to Cloudflare.
page_rule_quota Number of page rules allowed for the zone.
paused Whether the zone only uses Cloudflare DNS services.
phishing_detected Whether the zone was flagged for phishing.
status Cloudflare zone status.
type Zone type, such as full or partial.
verification_key Verification key for partial zone setup.
_ont_name Yes Normalized field sourced from name.
_ont_public Yes Property generated by the ontology mapping.
_ont_source Module that populated this node's ontology fields.

Relationships

  • (:CloudflareAccount)-[:RESOURCE]->(:CloudflareZone): The account contains the DNS zone.

  • (:CloudflareZone)-[:HAS_R2_CUSTOM_DOMAIN]->(:CloudflareR2Bucket): The DNS zone hosts an enabled custom domain serving the R2 bucket.

  • (:CloudflareZone)-[:HAS_RECORD]->(:CloudflareDNSRecord): The DNS zone contains the DNS record.

  • (:CloudflareZone)-[:HAS_ROUTE]->(:CloudflareWorkerRoute): The DNS zone routes matching requests through the Worker route.

  • (:CloudflareZone)-[:HAS_RULESET]->(:CloudflareRuleset): The DNS zone applies the ruleset to its incoming requests. Absent on account-level rulesets, which are not tied to a single zone.

  • (:CloudflareZone)-[:RESOURCE]->(:CloudflareDNSRecord)

On this page
Cloudflare SchemaCloudflareAccountCloudflareDNSRecordCloudflareMemberCloudflareR2BucketCloudflareRoleCloudflareRulesetCloudflareRulesetRuleCloudflareWorkerRouteCloudflareWorkerScriptCloudflareZone