1. Packages
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. getZeroTrustOrganization
Viewing docs for Cloudflare v6.15.0
published on Saturday, May 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

cloudflare.getZeroTrustOrganization

cloudflare logo
Viewing docs for Cloudflare v6.15.0
published on Saturday, May 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

    Accepted Permissions

    • Access: Organizations, Identity Providers, and Groups Read
    • Access: Organizations, Identity Providers, and Groups Revoke
    • Access: Organizations, Identity Providers, and Groups Write

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustOrganization = cloudflare.getZeroTrustOrganization({
    accountId: "account_id",
    zoneId: "zone_id",
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_organization = cloudflare.get_zero_trust_organization(account_id="account_id",
    zone_id="zone_id")

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.GetZeroTrustOrganization(ctx, &cloudflare.LookupZeroTrustOrganizationArgs{
			AccountId: pulumi.StringRef("account_id"),
			ZoneId:    pulumi.StringRef("zone_id"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustOrganization = Cloudflare.Index.GetZeroTrustOrganization.Invoke(new()
    {
        AccountId = "account_id",
        ZoneId = "zone_id",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetZeroTrustOrganizationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleZeroTrustOrganization = CloudflareFunctions.getZeroTrustOrganization(GetZeroTrustOrganizationArgs.builder()
            .accountId("account_id")
            .zoneId("zone_id")
            .build());

    }
}

    variables:
  exampleZeroTrustOrganization:
    fn::invoke:
      function: cloudflare:getZeroTrustOrganization
      arguments:
        accountId: account_id
        zoneId: zone_id

    Using getZeroTrustOrganization

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getZeroTrustOrganization(args: GetZeroTrustOrganizationArgs, opts?: InvokeOptions): Promise<GetZeroTrustOrganizationResult>
function getZeroTrustOrganizationOutput(args: GetZeroTrustOrganizationOutputArgs, opts?: InvokeOptions): Output<GetZeroTrustOrganizationResult>
    def get_zero_trust_organization(account_id: Optional[str] = None,
                                zone_id: Optional[str] = None,
                                opts: Optional[InvokeOptions] = None) -> GetZeroTrustOrganizationResult
def get_zero_trust_organization_output(account_id: Optional[pulumi.Input[str]] = None,
                                zone_id: Optional[pulumi.Input[str]] = None,
                                opts: Optional[InvokeOptions] = None) -> Output[GetZeroTrustOrganizationResult]
    func LookupZeroTrustOrganization(ctx *Context, args *LookupZeroTrustOrganizationArgs, opts ...InvokeOption) (*LookupZeroTrustOrganizationResult, error)
func LookupZeroTrustOrganizationOutput(ctx *Context, args *LookupZeroTrustOrganizationOutputArgs, opts ...InvokeOption) LookupZeroTrustOrganizationResultOutput

    > Note: This function is named LookupZeroTrustOrganization in the Go SDK.

    public static class GetZeroTrustOrganization 
{
    public static Task<GetZeroTrustOrganizationResult> InvokeAsync(GetZeroTrustOrganizationArgs args, InvokeOptions? opts = null)
    public static Output<GetZeroTrustOrganizationResult> Invoke(GetZeroTrustOrganizationInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetZeroTrustOrganizationResult> getZeroTrustOrganization(GetZeroTrustOrganizationArgs args, InvokeOptions options)
public static Output<GetZeroTrustOrganizationResult> getZeroTrustOrganization(GetZeroTrustOrganizationArgs args, InvokeOptions options)

    fn::invoke:
  function: cloudflare:index/getZeroTrustOrganization:getZeroTrustOrganization
  arguments:
    # arguments dictionary

    The following arguments are supported:

    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    getZeroTrustOrganization Result

    The following output properties are available:

    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages GetZeroTrustOrganizationCustomPages
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames List<string>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    Id string
    The provider-assigned unique ID for this managed resource.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign GetZeroTrustOrganizationLoginDesign
    MfaConfig GetZeroTrustOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    MfaSshPivKeyRequirements GetZeroTrustOrganizationMfaSshPivKeyRequirements
    Configures SSH PIV key requirements for MFA using hardware security keys.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages GetZeroTrustOrganizationCustomPages
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames []string
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    Id string
    The provider-assigned unique ID for this managed resource.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign GetZeroTrustOrganizationLoginDesign
    MfaConfig GetZeroTrustOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    MfaSshPivKeyRequirements GetZeroTrustOrganizationMfaSshPivKeyRequirements
    Configures SSH PIV key requirements for MFA using hardware security keys.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages GetZeroTrustOrganizationCustomPages
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    id String
    The provider-assigned unique ID for this managed resource.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign GetZeroTrustOrganizationLoginDesign
    mfaConfig GetZeroTrustOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    mfaSshPivKeyRequirements GetZeroTrustOrganizationMfaSshPivKeyRequirements
    Configures SSH PIV key requirements for MFA using hardware security keys.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    allowAuthenticateViaWarp boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain string
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity boolean
    When set to true, users skip the identity provider selection step during login.
    customPages GetZeroTrustOrganizationCustomPages
    denyUnmatchedRequests boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames string[]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    id string
    The provider-assigned unique ID for this managed resource.
    isUiReadOnly boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign GetZeroTrustOrganizationLoginDesign
    mfaConfig GetZeroTrustOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaRequiredForAllApps boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    mfaSshPivKeyRequirements GetZeroTrustOrganizationMfaSshPivKeyRequirements
    Configures SSH PIV key requirements for MFA using hardware security keys.
    name string
    The name of your Zero Trust organization.
    sessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    allow_authenticate_via_warp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    auth_domain str
    The unique subdomain assigned to your Zero Trust organization.
    auto_redirect_to_identity bool
    When set to true, users skip the identity provider selection step during login.
    custom_pages GetZeroTrustOrganizationCustomPages
    deny_unmatched_requests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    deny_unmatched_requests_exempted_zone_names Sequence[str]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    id str
    The provider-assigned unique ID for this managed resource.
    is_ui_read_only bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    login_design GetZeroTrustOrganizationLoginDesign
    mfa_config GetZeroTrustOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfa_required_for_all_apps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    mfa_ssh_piv_key_requirements GetZeroTrustOrganizationMfaSshPivKeyRequirements
    Configures SSH PIV key requirements for MFA using hardware security keys.
    name str
    The name of your Zero Trust organization.
    session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    ui_read_only_toggle_reason str
    A description of the reason why the UI read only field is being toggled.
    user_seat_expiration_inactive_time str
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warp_auth_session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages Property Map
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    id String
    The provider-assigned unique ID for this managed resource.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign Property Map
    mfaConfig Property Map
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    mfaSshPivKeyRequirements Property Map
    Configures SSH PIV key requirements for MFA using hardware security keys.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Supporting Types

    GetZeroTrustOrganizationCustomPages

    Forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    IdentityDenied string
    The uid of the custom page to use when a user is denied access.
    Forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    IdentityDenied string
    The uid of the custom page to use when a user is denied access.
    forbidden String
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied String
    The uid of the custom page to use when a user is denied access.
    forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied string
    The uid of the custom page to use when a user is denied access.
    forbidden str
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identity_denied str
    The uid of the custom page to use when a user is denied access.
    forbidden String
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied String
    The uid of the custom page to use when a user is denied access.

    GetZeroTrustOrganizationLoginDesign

    BackgroundColor string
    The background color on your login page.
    FooterText string
    The text at the bottom of your login page.
    HeaderText string
    The text at the top of your login page.
    LogoPath string
    The URL of the logo on your login page.
    TextColor string
    The text color on your login page.
    BackgroundColor string
    The background color on your login page.
    FooterText string
    The text at the bottom of your login page.
    HeaderText string
    The text at the top of your login page.
    LogoPath string
    The URL of the logo on your login page.
    TextColor string
    The text color on your login page.
    backgroundColor String
    The background color on your login page.
    footerText String
    The text at the bottom of your login page.
    headerText String
    The text at the top of your login page.
    logoPath String
    The URL of the logo on your login page.
    textColor String
    The text color on your login page.
    backgroundColor string
    The background color on your login page.
    footerText string
    The text at the bottom of your login page.
    headerText string
    The text at the top of your login page.
    logoPath string
    The URL of the logo on your login page.
    textColor string
    The text color on your login page.
    background_color str
    The background color on your login page.
    footer_text str
    The text at the bottom of your login page.
    header_text str
    The text at the top of your login page.
    logo_path str
    The URL of the logo on your login page.
    text_color str
    The text color on your login page.
    backgroundColor String
    The background color on your login page.
    footerText String
    The text at the bottom of your login page.
    headerText String
    The text at the top of your login page.
    logoPath String
    The URL of the logo on your login page.
    textColor String
    The text color on your login page.

    GetZeroTrustOrganizationMfaConfig

    AllowedAuthenticators List<string>
    Lists the MFA methods that users can authenticate with.
    AmrMatchingSessionDuration string
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    RequiredAaguids string
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    SessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    AllowedAuthenticators []string
    Lists the MFA methods that users can authenticate with.
    AmrMatchingSessionDuration string
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    RequiredAaguids string
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    SessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators List<String>
    Lists the MFA methods that users can authenticate with.
    amrMatchingSessionDuration String
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    requiredAaguids String
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    sessionDuration String
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators string[]
    Lists the MFA methods that users can authenticate with.
    amrMatchingSessionDuration string
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    requiredAaguids string
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    sessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowed_authenticators Sequence[str]
    Lists the MFA methods that users can authenticate with.
    amr_matching_session_duration str
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    required_aaguids str
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    session_duration str
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators List<String>
    Lists the MFA methods that users can authenticate with.
    amrMatchingSessionDuration String
    Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
    requiredAaguids String
    Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
    sessionDuration String
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.

    GetZeroTrustOrganizationMfaSshPivKeyRequirements

    PinPolicy string
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    RequireFipsDevice bool
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    SshKeySizes List<int>
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    SshKeyTypes List<string>
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    TouchPolicy string
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".
    PinPolicy string
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    RequireFipsDevice bool
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    SshKeySizes []int
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    SshKeyTypes []string
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    TouchPolicy string
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".
    pinPolicy String
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    requireFipsDevice Boolean
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    sshKeySizes List<Integer>
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    sshKeyTypes List<String>
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    touchPolicy String
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".
    pinPolicy string
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    requireFipsDevice boolean
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    sshKeySizes number[]
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    sshKeyTypes string[]
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    touchPolicy string
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".
    pin_policy str
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    require_fips_device bool
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    ssh_key_sizes Sequence[int]
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    ssh_key_types Sequence[str]
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    touch_policy str
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".
    pinPolicy String
    Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). Available values: "never", "once", "always".
    requireFipsDevice Boolean
    Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
    sshKeySizes List<Number>
    Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
    sshKeyTypes List<String>
    Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
    touchPolicy String
    Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). Available values: "never", "always", "cached".

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo
    Viewing docs for Cloudflare v6.15.0
    published on Saturday, May 2, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudflare
      Try Pulumi Cloud free. Your team will thank you.