Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. getApiToken
Viewing docs for Cloudflare v6.23.2
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

cloudflare.getApiToken

cloudflare logo cloudflare logo
Viewing docs for Cloudflare v6.23.2
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

    Accepted Permissions

    • API Tokens Read
    • API Tokens Write

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleApiToken = cloudflare.getApiToken({
    tokenId: "ed17574386854bf78a67040be0a770b0",
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_api_token = cloudflare.get_api_token(token_id="ed17574386854bf78a67040be0a770b0")

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.GetApiToken(ctx, &cloudflare.LookupApiTokenArgs{
			TokenId: pulumi.StringRef("ed17574386854bf78a67040be0a770b0"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleApiToken = Cloudflare.GetApiToken.Invoke(new()
    {
        TokenId = "ed17574386854bf78a67040be0a770b0",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetApiTokenArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleApiToken = CloudflareFunctions.getApiToken(GetApiTokenArgs.builder()
            .tokenId("ed17574386854bf78a67040be0a770b0")
            .build());

    }
}

    variables:
  exampleApiToken:
    fn::invoke:
      function: cloudflare:getApiToken
      arguments:
        tokenId: ed17574386854bf78a67040be0a770b0

    terraform {
  required_providers {
    cloudflare = {
      source = "pulumi/cloudflare"
    }
  }
}

data "cloudflare_api_token" "exampleApiToken" {
  token_id = "ed17574386854bf78a67040be0a770b0"
}

    Using getApiToken

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getApiToken(args: GetApiTokenArgs, opts?: InvokeOptions): Promise<GetApiTokenResult>
function getApiTokenOutput(args: GetApiTokenOutputArgs, opts?: InvokeOutputOptions): Output<GetApiTokenResult>
    def get_api_token(filter: Optional[GetApiTokenFilter] = None,
                  token_id: Optional[str] = None,
                  opts: Optional[InvokeOptions] = None) -> GetApiTokenResult
def get_api_token_output(filter: pulumi.Input[Optional[GetApiTokenFilterArgs]] = None,
                  token_id: pulumi.Input[Optional[str]] = None,
                  opts: Optional[InvokeOutputOptions] = None) -> Output[GetApiTokenResult]
    func LookupApiToken(ctx *Context, args *LookupApiTokenArgs, opts ...InvokeOption) (*LookupApiTokenResult, error)
func LookupApiTokenOutput(ctx *Context, args *LookupApiTokenOutputArgs, opts ...InvokeOption) LookupApiTokenResultOutput

    > Note: This function is named LookupApiToken in the Go SDK.

    public static class GetApiToken 
{
    public static Task<GetApiTokenResult> InvokeAsync(GetApiTokenArgs args, InvokeOptions? opts = null)
    public static Output<GetApiTokenResult> Invoke(GetApiTokenInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetApiTokenResult> Invoke(GetApiTokenInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetApiTokenResult> getApiToken(GetApiTokenArgs args, InvokeOptions options)
public static Output<GetApiTokenResult> getApiToken(GetApiTokenArgs args, InvokeOptions options)
public static Output<GetApiTokenResult> getApiToken(GetApiTokenArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: cloudflare:index/getApiToken:getApiToken
  arguments:
    # arguments dictionary
    data "cloudflare_get_api_token" "name" {
    # arguments
}

    The following arguments are supported:

    Filter GetApiTokenFilter
    TokenId string
    Token identifier tag.
    Filter GetApiTokenFilter
    TokenId string
    Token identifier tag.
    filter object
    token_id string
    Token identifier tag.
    filter GetApiTokenFilter
    tokenId String
    Token identifier tag.
    filter GetApiTokenFilter
    tokenId string
    Token identifier tag.
    filter GetApiTokenFilter
    token_id str
    Token identifier tag.
    filter Property Map
    tokenId String
    Token identifier tag.

    getApiToken Result

    The following output properties are available:

    Condition GetApiTokenCondition
    CreatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    ExpiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    Id string
    Token identifier tag.
    IssuedOn string
    The time on which the token was created.
    LastUsedOn string
    Last time the token was used.
    ModifiedOn string
    Last time the token was modified.
    Name string
    Token name.
    NotBefore string
    The time before which the token MUST NOT be accepted for processing.
    Policies List<GetApiTokenPolicy>
    List of access policies assigned to the token.
    ProvisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    ProvisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    Status string
    Status of the token. Available values: "active", "disabled", "expired".
    Filter GetApiTokenFilter
    TokenId string
    Token identifier tag.
    Condition GetApiTokenCondition
    CreatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    ExpiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    Id string
    Token identifier tag.
    IssuedOn string
    The time on which the token was created.
    LastUsedOn string
    Last time the token was used.
    ModifiedOn string
    Last time the token was modified.
    Name string
    Token name.
    NotBefore string
    The time before which the token MUST NOT be accepted for processing.
    Policies []GetApiTokenPolicy
    List of access policies assigned to the token.
    ProvisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    ProvisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    Status string
    Status of the token. Available values: "active", "disabled", "expired".
    Filter GetApiTokenFilter
    TokenId string
    Token identifier tag.
    condition object
    creator_email_at_creation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expires_on string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id string
    Token identifier tag.
    issued_on string
    The time on which the token was created.
    last_used_on string
    Last time the token was used.
    modified_on string
    Last time the token was modified.
    name string
    Token name.
    not_before string
    The time before which the token MUST NOT be accepted for processing.
    policies list(object)
    List of access policies assigned to the token.
    provisioner_id string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisioner_type string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status string
    Status of the token. Available values: "active", "disabled", "expired".
    filter object
    token_id string
    Token identifier tag.
    condition GetApiTokenCondition
    creatorEmailAtCreation String
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn String
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id String
    Token identifier tag.
    issuedOn String
    The time on which the token was created.
    lastUsedOn String
    Last time the token was used.
    modifiedOn String
    Last time the token was modified.
    name String
    Token name.
    notBefore String
    The time before which the token MUST NOT be accepted for processing.
    policies List<GetApiTokenPolicy>
    List of access policies assigned to the token.
    provisionerId String
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType String
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status String
    Status of the token. Available values: "active", "disabled", "expired".
    filter GetApiTokenFilter
    tokenId String
    Token identifier tag.
    condition GetApiTokenCondition
    creatorEmailAtCreation string
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn string
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id string
    Token identifier tag.
    issuedOn string
    The time on which the token was created.
    lastUsedOn string
    Last time the token was used.
    modifiedOn string
    Last time the token was modified.
    name string
    Token name.
    notBefore string
    The time before which the token MUST NOT be accepted for processing.
    policies GetApiTokenPolicy[]
    List of access policies assigned to the token.
    provisionerId string
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType string
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status string
    Status of the token. Available values: "active", "disabled", "expired".
    filter GetApiTokenFilter
    tokenId string
    Token identifier tag.
    condition GetApiTokenCondition
    creator_email_at_creation str
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expires_on str
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id str
    Token identifier tag.
    issued_on str
    The time on which the token was created.
    last_used_on str
    Last time the token was used.
    modified_on str
    Last time the token was modified.
    name str
    Token name.
    not_before str
    The time before which the token MUST NOT be accepted for processing.
    policies Sequence[GetApiTokenPolicy]
    List of access policies assigned to the token.
    provisioner_id str
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisioner_type str
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status str
    Status of the token. Available values: "active", "disabled", "expired".
    filter GetApiTokenFilter
    token_id str
    Token identifier tag.
    condition Property Map
    creatorEmailAtCreation String
    The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.
    expiresOn String
    The expiration time on or after which the JWT MUST NOT be accepted for processing.
    id String
    Token identifier tag.
    issuedOn String
    The time on which the token was created.
    lastUsedOn String
    Last time the token was used.
    modifiedOn String
    Last time the token was modified.
    name String
    Token name.
    notBefore String
    The time before which the token MUST NOT be accepted for processing.
    policies List<Property Map>
    List of access policies assigned to the token.
    provisionerId String
    The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisionerType is present and null when the identifier is unavailable.
    provisionerType String
    The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.
    status String
    Status of the token. Available values: "active", "disabled", "expired".
    filter Property Map
    tokenId String
    Token identifier tag.

    Supporting Types

    GetApiTokenCondition

    request_ip object
    Client IP restrictions.
    requestIp Property Map
    Client IP restrictions.

    GetApiTokenConditionRequestIp

    Ins List<string>
    List of IPv4/IPv6 CIDR addresses.
    NotIns List<string>
    List of IPv4/IPv6 CIDR addresses.
    Ins []string
    List of IPv4/IPv6 CIDR addresses.
    NotIns []string
    List of IPv4/IPv6 CIDR addresses.
    ins list(string)
    List of IPv4/IPv6 CIDR addresses.
    not_ins list(string)
    List of IPv4/IPv6 CIDR addresses.
    ins List<String>
    List of IPv4/IPv6 CIDR addresses.
    notIns List<String>
    List of IPv4/IPv6 CIDR addresses.
    ins string[]
    List of IPv4/IPv6 CIDR addresses.
    notIns string[]
    List of IPv4/IPv6 CIDR addresses.
    ins Sequence[str]
    List of IPv4/IPv6 CIDR addresses.
    not_ins Sequence[str]
    List of IPv4/IPv6 CIDR addresses.
    ins List<String>
    List of IPv4/IPv6 CIDR addresses.
    notIns List<String>
    List of IPv4/IPv6 CIDR addresses.

    GetApiTokenFilter

    IncludeExpired bool
    When true, includes recently-expired tokens in the response.
    Direction string
    Direction to order results. Available values: "asc", "desc".
    IncludeExpired bool
    When true, includes recently-expired tokens in the response.
    Direction string
    Direction to order results. Available values: "asc", "desc".
    include_expired bool
    When true, includes recently-expired tokens in the response.
    direction string
    Direction to order results. Available values: "asc", "desc".
    includeExpired Boolean
    When true, includes recently-expired tokens in the response.
    direction String
    Direction to order results. Available values: "asc", "desc".
    includeExpired boolean
    When true, includes recently-expired tokens in the response.
    direction string
    Direction to order results. Available values: "asc", "desc".
    include_expired bool
    When true, includes recently-expired tokens in the response.
    direction str
    Direction to order results. Available values: "asc", "desc".
    includeExpired Boolean
    When true, includes recently-expired tokens in the response.
    direction String
    Direction to order results. Available values: "asc", "desc".

    GetApiTokenPolicy

    Effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    Id string
    Policy identifier.
    PermissionGroups List<GetApiTokenPolicyPermissionGroup>
    A set of permission groups that are specified to the policy.
    Resources Dictionary<string, string>
    A list of resource names that the policy applies to.
    Effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    Id string
    Policy identifier.
    PermissionGroups []GetApiTokenPolicyPermissionGroup
    A set of permission groups that are specified to the policy.
    Resources map[string]string
    A list of resource names that the policy applies to.
    effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id string
    Policy identifier.
    permission_groups list(object)
    A set of permission groups that are specified to the policy.
    resources map(string)
    A list of resource names that the policy applies to.
    effect String
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id String
    Policy identifier.
    permissionGroups List<GetApiTokenPolicyPermissionGroup>
    A set of permission groups that are specified to the policy.
    resources Map<String,String>
    A list of resource names that the policy applies to.
    effect string
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id string
    Policy identifier.
    permissionGroups GetApiTokenPolicyPermissionGroup[]
    A set of permission groups that are specified to the policy.
    resources {[key: string]: string}
    A list of resource names that the policy applies to.
    effect str
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id str
    Policy identifier.
    permission_groups Sequence[GetApiTokenPolicyPermissionGroup]
    A set of permission groups that are specified to the policy.
    resources Mapping[str, str]
    A list of resource names that the policy applies to.
    effect String
    Allow or deny operations against the resources. Available values: "allow", "deny".
    id String
    Policy identifier.
    permissionGroups List<Property Map>
    A set of permission groups that are specified to the policy.
    resources Map<String>
    A list of resource names that the policy applies to.

    GetApiTokenPolicyPermissionGroup

    Id string
    Identifier of the permission group.
    Meta GetApiTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    Name string
    Name of the permission group.
    Id string
    Identifier of the permission group.
    Meta GetApiTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    Name string
    Name of the permission group.
    id string
    Identifier of the permission group.
    meta object
    Attributes associated to the permission group.
    name string
    Name of the permission group.
    id String
    Identifier of the permission group.
    meta GetApiTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name String
    Name of the permission group.
    id string
    Identifier of the permission group.
    meta GetApiTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name string
    Name of the permission group.
    id str
    Identifier of the permission group.
    meta GetApiTokenPolicyPermissionGroupMeta
    Attributes associated to the permission group.
    name str
    Name of the permission group.
    id String
    Identifier of the permission group.
    meta Property Map
    Attributes associated to the permission group.
    name String
    Name of the permission group.

    GetApiTokenPolicyPermissionGroupMeta

    Category string
    A category used to group permission groups.
    Deprecated string
    Indicates whether the permission group is deprecated.
    Description string
    Additional information about the permission group.
    Editable string
    Indicates whether the permission group can be edited.
    EolAt string
    The planned end-of-life date and time, when provided.
    Label string
    A label identifying the permission group.
    Scopes string
    The scope associated with the permission group.
    Visibility string
    Indicates the permission group's availability or visibility.
    Category string
    A category used to group permission groups.
    Deprecated string
    Indicates whether the permission group is deprecated.
    Description string
    Additional information about the permission group.
    Editable string
    Indicates whether the permission group can be edited.
    EolAt string
    The planned end-of-life date and time, when provided.
    Label string
    A label identifying the permission group.
    Scopes string
    The scope associated with the permission group.
    Visibility string
    Indicates the permission group's availability or visibility.
    category string
    A category used to group permission groups.
    deprecated string
    Indicates whether the permission group is deprecated.
    description string
    Additional information about the permission group.
    editable string
    Indicates whether the permission group can be edited.
    eol_at string
    The planned end-of-life date and time, when provided.
    label string
    A label identifying the permission group.
    scopes string
    The scope associated with the permission group.
    visibility string
    Indicates the permission group's availability or visibility.
    category String
    A category used to group permission groups.
    deprecated String
    Indicates whether the permission group is deprecated.
    description String
    Additional information about the permission group.
    editable String
    Indicates whether the permission group can be edited.
    eolAt String
    The planned end-of-life date and time, when provided.
    label String
    A label identifying the permission group.
    scopes String
    The scope associated with the permission group.
    visibility String
    Indicates the permission group's availability or visibility.
    category string
    A category used to group permission groups.
    deprecated string
    Indicates whether the permission group is deprecated.
    description string
    Additional information about the permission group.
    editable string
    Indicates whether the permission group can be edited.
    eolAt string
    The planned end-of-life date and time, when provided.
    label string
    A label identifying the permission group.
    scopes string
    The scope associated with the permission group.
    visibility string
    Indicates the permission group's availability or visibility.
    category str
    A category used to group permission groups.
    deprecated str
    Indicates whether the permission group is deprecated.
    description str
    Additional information about the permission group.
    editable str
    Indicates whether the permission group can be edited.
    eol_at str
    The planned end-of-life date and time, when provided.
    label str
    A label identifying the permission group.
    scopes str
    The scope associated with the permission group.
    visibility str
    Indicates the permission group's availability or visibility.
    category String
    A category used to group permission groups.
    deprecated String
    Indicates whether the permission group is deprecated.
    description String
    Additional information about the permission group.
    editable String
    Indicates whether the permission group can be edited.
    eolAt String
    The planned end-of-life date and time, when provided.
    label String
    A label identifying the permission group.
    scopes String
    The scope associated with the permission group.
    visibility String
    Indicates the permission group's availability or visibility.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo cloudflare logo
    Viewing docs for Cloudflare v6.23.2
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudflare

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial