<!-- BusyBot node reference — https://busybot.net/tools/cloudflare/ -->

> Node: Cloudflare (`cloudflare`) · Action · v1
> Category: Development · Credentials: Cloudflare API (`cloudflareApi`)
> Updated: 2026-08-16

# Cloudflare

> Manage Cloudflare zone TLS certificates.

## Overview

Cloudflare is a CDN, DNS, and security platform. This tool manages zone-level authenticated origin pull TLS client certificates, supporting upload, get, list, and delete operations on certificates for Cloudflare zones.

**Category:** Development  
**Tool Name:** `cloudflare`  
**Version:** 1

**Appearance:** Icon: `si-cloudflare` | Color: `#F38020`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Cloudflare API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/cloudflare-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Zone Certificate | `zoneCertificate` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Delete | `delete` | Delete a certificate |
| Get | `get` | Get a certificate |
| Get Many | `getMany` | Get many certificates |
| Upload | `upload` | Upload a certificate |

### Parameters

#### Zone Certificate: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Zone ID | `string` | Yes | — | Cloudflare Zone ID. Find it in your Cloudflare dashboard under Overview > Zone ID (right sidebar). Supports expressions. |
| Certificate ID | `string` | Yes | — | The ID of the certificate to retrieve or delete. Supports expressions like {{ $json.certificateId }}. |

#### Zone Certificate: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Zone ID | `string` | Yes | — | Cloudflare Zone ID. Find it in your Cloudflare dashboard under Overview > Zone ID (right sidebar). Supports expressions. |
| Certificate ID | `string` | Yes | — | The ID of the certificate to retrieve or delete. Supports expressions like {{ $json.certificateId }}. |

#### Zone Certificate: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Zone ID | `string` | Yes | — | Cloudflare Zone ID. Find it in your Cloudflare dashboard under Overview > Zone ID (right sidebar). Supports expressions. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `25` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Optional filters for listing certificates. |
| — Status | `options` | No | — | Filter by the zone certificate's status. |
| | | | | Options: `active`, `expired`, `deleted`, `pending` |

#### Zone Certificate: Upload

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Zone ID | `string` | Yes | — | Cloudflare Zone ID. Find it in your Cloudflare dashboard under Overview > Zone ID (right sidebar). Supports expressions. |
| Certificate Content | `string` | Yes | — | The zone's leaf certificate in PEM format. Supports expressions like {{ $json.certificate }}. |
| Private Key | `string` | Yes | — | The private key for the certificate in PEM format. Supports expressions. |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

The certificate object returned by the Cloudflare API is **merged onto the input item's JSON**, so incoming fields pass through and stay addressable downstream. Binary data is forwarded unchanged.

| Operation | Output |
|-----------|--------|
| `upload` | One item carrying the newly created certificate object. |
| `get` | One item carrying the requested certificate object. |
| `delete` | One item carrying the API's delete result for that certificate. |
| `getMany` | **Fans out** — one output item per certificate, each merged onto the input item's JSON. A zone with no matching certificates produces no output items at all. |

Certificate fields come straight from the Cloudflare API v4 `result` payload — reference them downstream by expression, e.g. `{{ $json.id }}` or `{{ $json.status }}`.

## Usage Examples

- Upload a TLS certificate for authenticated origin pulls
- List all active certificates for a Cloudflare zone
- Get details of a specific origin pull certificate
- Delete an expired TLS certificate from a zone

## Example Configuration

Upload a certificate and its private key to a zone:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "upload",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificate": "{{ $json.certificatePem }}",
    "privateKey": "{{ $json.privateKeyPem }}"
  }
}
```

Get one certificate by ID:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "get",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificateId": "2458ce5a-0c35-4c7f-82c7-8e9487d3ff60"
  }
}
```

List every certificate on a zone:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "getMany",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "returnAll": true
  }
}
```

List at most 50 certificates:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "getMany",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "returnAll": false,
    "limit": 50
  }
}
```

List only the active certificates:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "getMany",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "returnAll": true,
    "filters": {
      "status": "active"
    }
  }
}
```

Delete a certificate:

```json
{
  "type": "cloudflare",
  "parameters": {
    "resource": "zoneCertificate",
    "operation": "delete",
    "zoneId": "023e105f4ecef8ad9ca31a8372d0c353",
    "certificateId": "{{ $json.certificateId }}"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manages zone-level TLS client certificates on Cloudflare for authenticated origin pulls.

### Behavior notes

- **This node covers authenticated origin pull certificates only.** It does not manage DNS records, edge certificates, firewall rules or any other Cloudflare resource.
- **Zone ID is required for every operation.** You will find it in the Cloudflare dashboard on the zone's Overview page, in the right sidebar.
- **Upload takes PEM text, not a file.** Both Certificate Content and Private Key expect the full PEM block including its BEGIN and END lines; pull them from an upstream node with an expression rather than pasting secrets into the node.
- **`Return All` pages through every certificate**; the Limit field is only consulted when Return All is off, and Cloudflare caps the page size at 50.
- **A certificate list can be empty.** When a zone has no certificates matching the filter, the input item produces no output items, so downstream nodes may see nothing at all.