1. Registry
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. getAccountToken
Viewing docs for Cloudflare v6.22.1
published on Tuesday, Oct 13, 2026 by Pulumi
cloudflare logo cloudflare logo
Viewing docs for Cloudflare v6.22.1
published on Tuesday, Oct 13, 2026 by Pulumi

    Accepted Permissions

    • Account API Tokens Read
    • Account API Tokens Write

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as cloudflare from "@pulumi/cloudflare";
    
    const exampleAccountToken = cloudflare.getAccountToken({
        accountId: "023e105f4ecef8ad9ca31a8372d0c353",
        tokenId: "ed17574386854bf78a67040be0a770b0",
    });
    
    import pulumi
    import pulumi_cloudflare as cloudflare
    
    example_account_token = cloudflare.get_account_token(account_id="023e105f4ecef8ad9ca31a8372d0c353",
        token_id="ed17574386854bf78a67040be0a770b0")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := cloudflare.GetAccountToken(ctx, &cloudflare.LookupAccountTokenArgs{
    			AccountId: pulumi.StringRef("023e105f4ecef8ad9ca31a8372d0c353"),
    			TokenId:   pulumi.StringRef("ed17574386854bf78a67040be0a770b0"),
    		}, nil)
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Cloudflare = Pulumi.Cloudflare;
    
    return await Deployment.RunAsync(() => 
    {
        var exampleAccountToken = Cloudflare.GetAccountToken.Invoke(new()
        {
            AccountId = "023e105f4ecef8ad9ca31a8372d0c353",
            TokenId = "ed17574386854bf78a67040be0a770b0",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.cloudflare.CloudflareFunctions;
    import com.pulumi.cloudflare.inputs.GetAccountTokenArgs;
    import java.util.ArrayList;
    import java.util.Arrays;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            final var exampleAccountToken = CloudflareFunctions.getAccountToken(GetAccountTokenArgs.builder()
                .accountId("023e105f4ecef8ad9ca31a8372d0c353")
                .tokenId("ed17574386854bf78a67040be0a770b0")
                .build());
    
        }
    }
    
    variables:
      exampleAccountToken:
        fn::invoke:
          function: cloudflare:getAccountToken
          arguments:
            accountId: 023e105f4ecef8ad9ca31a8372d0c353
            tokenId: ed17574386854bf78a67040be0a770b0
    
    terraform {
      required_providers {
        cloudflare = {
          source = "pulumi/cloudflare"
        }
      }
    }
    
    data "cloudflare_account_token" "exampleAccountToken" {
      account_id = "023e105f4ecef8ad9ca31a8372d0c353"
      token_id   = "ed17574386854bf78a67040be0a770b0"
    }
    

    Using getAccountToken

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getAccountToken(args: GetAccountTokenArgs, opts?: InvokeOptions): Promise<GetAccountTokenResult>
    function getAccountTokenOutput(args: GetAccountTokenOutputArgs, opts?: InvokeOutputOptions): Output<GetAccountTokenResult>
    def get_account_token(account_id: Optional[str] = None,
                          filter: Optional[GetAccountTokenFilter] = None,
                          token_id: Optional[str] = None,
                          opts: Optional[InvokeOptions] = None) -> GetAccountTokenResult
    def get_account_token_output(account_id: pulumi.Input[Optional[str]] = None,
                          filter: pulumi.Input[Optional[GetAccountTokenFilterArgs]] = None,
                          token_id: pulumi.Input[Optional[str]] = None,
                          opts: Optional[InvokeOutputOptions] = None) -> Output[GetAccountTokenResult]
    func LookupAccountToken(ctx *Context, args *LookupAccountTokenArgs, opts ...InvokeOption) (*LookupAccountTokenResult, error)
    func LookupAccountTokenOutput(ctx *Context, args *LookupAccountTokenOutputArgs, opts ...InvokeOption) LookupAccountTokenResultOutput

    > Note: This function is named LookupAccountToken in the Go SDK.

    public static class GetAccountToken 
    {
        public static Task<GetAccountTokenResult> InvokeAsync(GetAccountTokenArgs args, InvokeOptions? opts = null)
        public static Output<GetAccountTokenResult> Invoke(GetAccountTokenInvokeArgs args, InvokeOptions? opts = null)
        public static Output<GetAccountTokenResult> Invoke(GetAccountTokenInvokeArgs args, InvokeOutputOptions opts)
    }
    public static CompletableFuture<GetAccountTokenResult> getAccountToken(GetAccountTokenArgs args, InvokeOptions options)
    public static Output<GetAccountTokenResult> getAccountToken(GetAccountTokenArgs args, InvokeOptions options)
    public static Output<GetAccountTokenResult> getAccountToken(GetAccountTokenArgs args, InvokeOutputOptions options)
    
    fn::invoke:
      function: cloudflare:index/getAccountToken:getAccountToken
      arguments:
        # arguments dictionary
    data "cloudflare_get_account_token" "name" {
        # arguments
    }

    The following arguments are supported:

    AccountId string
    Account identifier tag.
    Filter GetAccountTokenFilter
    TokenId string
    Token identifier tag.
    AccountId string
    Account identifier tag.
    Filter GetAccountTokenFilter
    TokenId string
    Token identifier tag.
    account_id string
    Account identifier tag.
    filter object
    token_id string
    Token identifier tag.
    accountId String
    Account identifier tag.
    filter GetAccountTokenFilter
    tokenId String
    Token identifier tag.
    accountId string
    Account identifier tag.
    filter GetAccountTokenFilter
    tokenId string
    Token identifier tag.
    account_id str
    Account identifier tag.
    filter GetAccountTokenFilter
    token_id str
    Token identifier tag.
    accountId String
    Account identifier tag.
    filter Property Map
    tokenId String
    Token identifier tag.

    getAccountToken Result

    The following output properties are available:

    Condition GetAccountTokenCondition
    CreatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    ExpiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    Id string
    Token identifier tag.
    IssuedOn string
    The time on which the token was created.
    LastUsedOn string
    Last time the token was used.
    ModifiedOn string
    Last time the token was modified.
    Name string
    Token name.
    NotBefore string
    The time before which the token MUST NOT be accepted for processing.
    Policies List<GetAccountTokenPolicy>
    List of access policies assigned to the token.
    ProvisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    ProvisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    Status string
    Status of the token. Available values: "active", "disabled", "expired".
    AccountId string
    Account identifier tag.
    Filter GetAccountTokenFilter
    TokenId string
    Token identifier tag.
    Condition GetAccountTokenCondition
    CreatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    ExpiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    Id string
    Token identifier tag.
    IssuedOn string
    The time on which the token was created.
    LastUsedOn string
    Last time the token was used.
    ModifiedOn string
    Last time the token was modified.
    Name string
    Token name.
    NotBefore string
    The time before which the token MUST NOT be accepted for processing.
    Policies []GetAccountTokenPolicy
    List of access policies assigned to the token.
    ProvisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    ProvisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    Status string
    Status of the token. Available values: "active", "disabled", "expired".
    AccountId string
    Account identifier tag.
    Filter GetAccountTokenFilter
    TokenId string
    Token identifier tag.
    condition object
    creator_email_at_creation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expires_on string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id string
    Token identifier tag.
    issued_on string
    The time on which the token was created.
    last_used_on string
    Last time the token was used.
    modified_on string
    Last time the token was modified.
    name string
    Token name.
    not_before string
    The time before which the token MUST NOT be accepted for processing.
    policies list(object)
    List of access policies assigned to the token.
    provisioner_id string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisioner_type string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status string
    Status of the token. Available values: "active", "disabled", "expired".
    account_id string
    Account identifier tag.
    filter object
    token_id string
    Token identifier tag.
    condition GetAccountTokenCondition
    creatorEmailAtCreation String
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn String
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id String
    Token identifier tag.
    issuedOn String
    The time on which the token was created.
    lastUsedOn String
    Last time the token was used.
    modifiedOn String
    Last time the token was modified.
    name String
    Token name.
    notBefore String
    The time before which the token MUST NOT be accepted for processing.
    policies List<GetAccountTokenPolicy>
    List of access policies assigned to the token.
    provisionerId String
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType String
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status String
    Status of the token. Available values: "active", "disabled", "expired".
    accountId String
    Account identifier tag.
    filter GetAccountTokenFilter
    tokenId String
    Token identifier tag.
    condition GetAccountTokenCondition
    creatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id string
    Token identifier tag.
    issuedOn string
    The time on which the token was created.
    lastUsedOn string
    Last time the token was used.
    modifiedOn string
    Last time the token was modified.
    name string
    Token name.
    notBefore string
    The time before which the token MUST NOT be accepted for processing.
    policies GetAccountTokenPolicy[]
    List of access policies assigned to the token.
    provisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status string
    Status of the token. Available values: "active", "disabled", "expired".
    accountId string
    Account identifier tag.
    filter GetAccountTokenFilter
    tokenId string
    Token identifier tag.
    condition GetAccountTokenCondition
    creator_email_at_creation str
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expires_on str
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id str
    Token identifier tag.
    issued_on str
    The time on which the token was created.
    last_used_on str
    Last time the token was used.
    modified_on str
    Last time the token was modified.
    name str
    Token name.
    not_before str
    The time before which the token MUST NOT be accepted for processing.
    policies Sequence[GetAccountTokenPolicy]
    List of access policies assigned to the token.
    provisioner_id str
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisioner_type str
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status str
    Status of the token. Available values: "active", "disabled", "expired".
    account_id str
    Account identifier tag.
    filter GetAccountTokenFilter
    token_id str
    Token identifier tag.
    condition Property Map
    creatorEmailAtCreation String
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn String
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id String
    Token identifier tag.
    issuedOn String
    The time on which the token was created.
    lastUsedOn String
    Last time the token was used.
    modifiedOn String
    Last time the token was modified.
    name String
    Token name.
    notBefore String
    The time before which the token MUST NOT be accepted for processing.
    policies List<Property Map>
    List of access policies assigned to the token.
    provisionerId String
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType String
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status String
    Status of the token. Available values: "active", "disabled", "expired".
    accountId String
    Account identifier tag.
    filter Property Map
    tokenId String
    Token identifier tag.

    Supporting Types

    GetAccountTokenCondition

    request_ip object
    Client IP restrictions.
    requestIp Property Map
    Client IP restrictions.

    GetAccountTokenConditionRequestIp

    Ins List<string>
    List of IPv4/IPv6 CIDR addresses.
    NotIns List<string>
    List of IPv4/IPv6 CIDR addresses.
    Ins []string
    List of IPv4/IPv6 CIDR addresses.
    NotIns []string
    List of IPv4/IPv6 CIDR addresses.
    ins list(string)
    List of IPv4/IPv6 CIDR addresses.
    not_ins list(string)
    List of IPv4/IPv6 CIDR addresses.
    ins List<String>
    List of IPv4/IPv6 CIDR addresses.
    notIns List<String>
    List of IPv4/IPv6 CIDR addresses.
    ins string[]
    List of IPv4/IPv6 CIDR addresses.
    notIns string[]
    List of IPv4/IPv6 CIDR addresses.
    ins Sequence[str]
    List of IPv4/IPv6 CIDR addresses.
    not_ins Sequence[str]
    List of IPv4/IPv6 CIDR addresses.
    ins List<String>
    List of IPv4/IPv6 CIDR addresses.
    notIns List<String>
    List of IPv4/IPv6 CIDR addresses.

    GetAccountTokenFilter

    IncludeExpired bool
    When true, includes recently-expired tokens in the response.
    Direction string
    Direction to order results. Available values: "asc", "desc".
    IncludeExpired bool
    When true, includes recently-expired tokens in the response.
    Direction string
    Direction to order results. Available values: "asc", "desc".
    include_expired bool
    When true, includes recently-expired tokens in the response.
    direction string
    Direction to order results. Available values: "asc", "desc".
    includeExpired Boolean
    When true, includes recently-expired tokens in the response.
    direction String
    Direction to order results. Available values: "asc", "desc".
    includeExpired boolean
    When true, includes recently-expired tokens in the response.
    direction string
    Direction to order results. Available values: "asc", "desc".
    include_expired bool
    When true, includes recently-expired tokens in the response.
    direction str
    Direction to order results. Available values: "asc", "desc".
    includeExpired Boolean
    When true, includes recently-expired tokens in the response.
    direction String
    Direction to order results. Available values: "asc", "desc".

    GetAccountTokenPolicy

    Effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    Id string
    Policy identifier.
    PermissionGroups List<GetAccountTokenPolicyPermissionGroup>
    A set of permission groups that are specified to the policy.
    Resources Dictionary<string, string>
    A list of resource names that the policy applies to.
    Effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    Id string
    Policy identifier.
    PermissionGroups []GetAccountTokenPolicyPermissionGroup
    A set of permission groups that are specified to the policy.
    Resources map[string]string
    A list of resource names that the policy applies to.
    effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id string
    Policy identifier.
    permission_groups list(object)
    A set of permission groups that are specified to the policy.
    resources map(string)
    A list of resource names that the policy applies to.
    effect String
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id String
    Policy identifier.
    permissionGroups List<GetAccountTokenPolicyPermissionGroup>
    A set of permission groups that are specified to the policy.
    resources Map<String,String>
    A list of resource names that the policy applies to.
    effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id string
    Policy identifier.
    permissionGroups GetAccountTokenPolicyPermissionGroup[]
    A set of permission groups that are specified to the policy.
    resources {[key: string]: string}
    A list of resource names that the policy applies to.
    effect str
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id str
    Policy identifier.
    permission_groups Sequence[GetAccountTokenPolicyPermissionGroup]
    A set of permission groups that are specified to the policy.
    resources Mapping[str, str]
    A list of resource names that the policy applies to.
    effect String
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id String
    Policy identifier.
    permissionGroups List<Property Map>
    A set of permission groups that are specified to the policy.
    resources Map<String>
    A list of resource names that the policy applies to.

    GetAccountTokenPolicyPermissionGroup

    Id string
    Identifier of the permission group.
    Meta GetAccountTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    Name string
    Name of the permission group.
    Id string
    Identifier of the permission group.
    Meta GetAccountTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    Name string
    Name of the permission group.
    id string
    Identifier of the permission group.
    meta object
    Attributes associated to the permission group.
    name string
    Name of the permission group.
    id String
    Identifier of the permission group.
    meta GetAccountTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name String
    Name of the permission group.
    id string
    Identifier of the permission group.
    meta GetAccountTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name string
    Name of the permission group.
    id str
    Identifier of the permission group.
    meta GetAccountTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name str
    Name of the permission group.
    id String
    Identifier of the permission group.
    meta Property Map
    Attributes associated to the permission group.
    name String
    Name of the permission group.

    GetAccountTokenPolicyPermissionGroupMeta

    Category string
    A category used to group permission groups.
    Deprecated string
    Indicates whether the permission group is deprecated.
    Description string
    Additional information about the permission group.
    Editable string
    Indicates whether the permission group can be edited.
    EolAt string
    The planned end-of-life date and time, when provided.
    Label string
    A label identifying the permission group.
    Scopes string
    The scope associated with the permission group.
    Visibility string
    Indicates the permission group's availability or visibility.
    Category string
    A category used to group permission groups.
    Deprecated string
    Indicates whether the permission group is deprecated.
    Description string
    Additional information about the permission group.
    Editable string
    Indicates whether the permission group can be edited.
    EolAt string
    The planned end-of-life date and time, when provided.
    Label string
    A label identifying the permission group.
    Scopes string
    The scope associated with the permission group.
    Visibility string
    Indicates the permission group's availability or visibility.
    category string
    A category used to group permission groups.
    deprecated string
    Indicates whether the permission group is deprecated.
    description string
    Additional information about the permission group.
    editable string
    Indicates whether the permission group can be edited.
    eol_at string
    The planned end-of-life date and time, when provided.
    label string
    A label identifying the permission group.
    scopes string
    The scope associated with the permission group.
    visibility string
    Indicates the permission group's availability or visibility.
    category String
    A category used to group permission groups.
    deprecated String
    Indicates whether the permission group is deprecated.
    description String
    Additional information about the permission group.
    editable String
    Indicates whether the permission group can be edited.
    eolAt String
    The planned end-of-life date and time, when provided.
    label String
    A label identifying the permission group.
    scopes String
    The scope associated with the permission group.
    visibility String
    Indicates the permission group's availability or visibility.
    category string
    A category used to group permission groups.
    deprecated string
    Indicates whether the permission group is deprecated.
    description string
    Additional information about the permission group.
    editable string
    Indicates whether the permission group can be edited.
    eolAt string
    The planned end-of-life date and time, when provided.
    label string
    A label identifying the permission group.
    scopes string
    The scope associated with the permission group.
    visibility string
    Indicates the permission group's availability or visibility.
    category str
    A category used to group permission groups.
    deprecated str
    Indicates whether the permission group is deprecated.
    description str
    Additional information about the permission group.
    editable str
    Indicates whether the permission group can be edited.
    eol_at str
    The planned end-of-life date and time, when provided.
    label str
    A label identifying the permission group.
    scopes str
    The scope associated with the permission group.
    visibility str
    Indicates the permission group's availability or visibility.
    category String
    A category used to group permission groups.
    deprecated String
    Indicates whether the permission group is deprecated.
    description String
    Additional information about the permission group.
    editable String
    Indicates whether the permission group can be edited.
    eolAt String
    The planned end-of-life date and time, when provided.
    label String
    A label identifying the permission group.
    scopes String
    The scope associated with the permission group.
    visibility String
    Indicates the permission group's availability or visibility.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo cloudflare logo
    Viewing docs for Cloudflare v6.22.1
    published on Tuesday, Oct 13, 2026 by Pulumi

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial