Access API examples

{
  "name": "allow cloudflare employees",
  "decision": "allow",
  "include": [
    {
      "email_domain": {
        "domain": "cloudflare.com"
      }
    }
  ],
  "exclude": [
    {
      "email": {
        "email": "notthisperson@cloudflare.com"
      }
    }
  ],
  "require": []
}

​​ Example rule configurations

These are commonly used rule configurations.

• Access group

  Use a pre-existing Access group.

• Any valid service token

  The request will need to present the headers for any service token created for this account.

• Authentication method

  Allow access based on the "amr" identifier.

• Azure® Group

  Allow members of an Azure Group. The ID is the group UUID (`id`) in Azure.

• Common name

  The request will need to present a valid certificate with an expected common name.

• Country Code

  Allow a specific country.

• Email

  Allow a specific email address.

• Email domain

  Allow an entire email domain.

• Everyone

  Allow anyone to log in.

• G Suite® Group

  Allow members of a specific G Suite group.

• GitHub™ Organization

  Allow members of a specific GitHub organization.

• IP range

  Allow an IP range.

• mTLS certificate

  The request will need to present a valid certificate.

• Okta® Group

  Allow members of an Okta Group.

• SAML Attribute

  Allow users with specific SAML attributes.

• Service token

  The request will need to present the correct service token headers.