What Cloudflare configuration is captured: surface reference
This is the reference list of every Cloudflare configuration surface the cf-config source captures. It is for an auditor or a self-hoster who needs the exact inventory rather than the narrative: which surfaces are in scope, whether each is zone-scoped or account-scoped, how each one restores, and which handful re-apply in-band today. For the credential model, the backup behaviour and the full restore workflow, read backing up and restoring your Cloudflare configuration.
The table below is generated from the surface registry in the engine source by docs/scripts/gen-cf-surfaces.mjs, so it lists the same surfaces the backup adapter and the restore sink consume. Adding a surface is a one-line append to that registry; re-running the generator refreshes this page from it.
The registry holds one set of 313 Cloudflare config surfaces. Of those, 60 auto-restore in-band, and the remaining 253 are backup-and-preview only. The restore tiers cut a different axis: idempotent 176, ordered 76 and re-provision 61. A surface auto-restores in-band only when it is one of the idempotent surfaces that also carries an in-band write path, so the 60 in-band surfaces are a subset of the 176 idempotent ones. Reading the idempotent count as a restore promise is the mistake this page exists to prevent: it is the number of surfaces that replay cleanly when applied, not the number downpipes applies.
How to read the table
Three columns carry the meaning, so here is what each one tells you.
| Column | What it means |
|---|---|
| Scope | Whether the surface reads at zone level (it needs a zone id, and an account-only downpipe skips it) or at account level (it always applies). |
| Restore tier | How the surface restores. Idempotent replays cleanly item by item; ordered needs dependency-ordered re-creation and id remapping; re-provision carries write-only values, so a restore can only emit a checklist. |
| In-band | Yes when the engine re-applies the surface straight back into your live account through the console as part of a restore apply, with a live diff preview first. The other surfaces are captured and verified recoverable, but you re-apply them out of band, guided by the restore tier rather than a diff preview. |
Restore tier is a property of the surface, not of a run
Every surface carries its tier in the registry, and the tier is surfaced in the restore plan. It tells you, before you confirm anything, whether an apply re-applies that surface for you or hands you a checklist. An idempotent tier never means a secret is recoverable: see the re-provision note at the foot of the table.
The full surface list
These are the 313 surfaces, grouped by the same categories the console uses for its per-surface selection screen. The In-band column marks the 60 surfaces that re-apply in-band on a restore apply; the other 253 are backup-and-preview only.
DNS & core
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
DNS records (dns) |
zone | idempotent | Yes |
DNS settings (dns-settings) |
zone | idempotent | Yes |
Zone settings (zone-settings) |
zone | idempotent | Yes |
Managed transform headers (managed-headers) |
zone | idempotent | Yes |
URL normalization (url-normalization) |
zone | idempotent | Yes |
Zone details (zone-entity) |
zone | reprovision | No |
Zone hold (zone-hold) |
zone | idempotent | No |
Zone environments (zone-environments) |
zone | idempotent | No |
Secondary DNS ACLs (secondary-dns-acls) |
account | idempotent | Yes |
Secondary DNS TSIG keys (secondary-dns-tsigs) |
account | reprovision | No |
Secondary DNS peers (secondary-dns-peers) |
account | ordered | No |
Secondary (incoming) zone transfer config (secondary-dns-incoming) |
zone | ordered | No |
Primary (outgoing) zone transfer config (secondary-dns-outgoing) |
zone | ordered | No |
Account DNS settings (account-dns-settings) |
account | idempotent | Yes |
DNSSEC configuration (dnssec) |
zone | ordered | No |
Workers custom domains (workers-custom-domains) |
account | ordered | No |
Web3 gateway hostnames (web3-hostnames) |
zone | idempotent | No |
Regional hostnames (regional-hostnames) |
zone | idempotent | No |
Account custom nameservers (account-custom-nameservers) |
account | idempotent | No |
Zone custom nameserver usage (custom-nameserver-usage) |
zone | idempotent | No |
Internal DNS Views (dns-internal-views) |
account | ordered | No |
Google Tag Gateway config (google-tag-gateway) |
zone | idempotent | No |
Registrar domains (registrar-domains) |
account | reprovision | No |
Registrar registrations (registrar-registrations) |
account | reprovision | No |
Zone setting: aegis (zone-setting-aegis) |
zone | idempotent | No |
Zone setting: auto origin tls kex (zone-setting-auto-origin-tls-kex) |
zone | idempotent | Yes |
Zone setting: csam scanner (zone-setting-csam-scanner) |
zone | idempotent | No |
Zone setting: fonts (zone-setting-fonts) |
zone | idempotent | Yes |
Zone setting: origin h2 max streams (zone-setting-origin-h2-max-streams) |
zone | idempotent | No |
Zone setting: origin max http version (zone-setting-origin-max-http-version) |
zone | idempotent | Yes |
Zone setting: origin tls compliance (zone-setting-origin-tls-compliance) |
zone | idempotent | Yes |
Zone setting: speed brain (zone-setting-speed-brain) |
zone | idempotent | Yes |
Zone setting: ssl automatic mode (zone-setting-ssl-automatic-mode) |
zone | idempotent | Yes |
Zone setting: zaraz default (zone-setting-zaraz-default) |
zone | idempotent | No |
Security & WAF
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
WAF & rulesets (zone) (rulesets) |
zone | idempotent | Yes |
Page rules (page-rules) |
zone | idempotent | Yes |
Firewall access rules (firewall-access-rules) |
zone | idempotent | Yes |
Filters (legacy) (filters) |
zone | idempotent | No |
Firewall rules (legacy) (firewall-rules) |
zone | idempotent | No |
Page Shield policies (page-shield-policies) |
zone | idempotent | No |
API Shield user schemas (api-shield-user-schemas) |
zone | ordered | No |
API Shield endpoint operations (api-shield-operations) |
zone | ordered | No |
API Shield schema validation settings (api-shield-schema-validation-settings) |
zone | idempotent | No |
API Shield settings (api-shield-settings) |
zone | idempotent | No |
API Shield token validation config (api-shield-token-validation-config) |
zone | reprovision | No |
API Shield token validation rules (api-shield-token-validation-rules) |
zone | ordered | No |
Email Security allow policies (email-security-allow-policies) |
account | idempotent | No |
Email Security blocked senders (email-security-block-senders) |
account | idempotent | No |
Email Security protected domains (email-security-domains) |
account | ordered | No |
Email Security impersonation registry (email-security-impersonation-registry) |
account | idempotent | No |
Email Security sending domain restrictions (email-security-sending-domain-restrictions) |
account | idempotent | No |
Email Security trusted domains (email-security-trusted-domains) |
account | idempotent | No |
Email Security URL ignore patterns (email-security-url-ignore-patterns) |
account | idempotent | No |
Advanced DNS Protection rules (advanced-dns-protection-rules) |
account | idempotent | No |
Advanced TCP Protection allowlist (advanced-tcp-protection-allowlist) |
account | idempotent | No |
Advanced TCP Protection prefixes (advanced-tcp-protection-prefixes) |
account | idempotent | No |
SYN Protection filters (advanced-tcp-protection-syn-filters) |
account | idempotent | No |
SYN Protection rules (advanced-tcp-protection-syn-rules) |
account | ordered | No |
TCP Flow Protection filters (advanced-tcp-protection-tcp-flow-filters) |
account | idempotent | No |
TCP Flow Protection rules (advanced-tcp-protection-tcp-flow-rules) |
account | ordered | No |
Advanced TCP Protection status (advanced-tcp-protection-status) |
account | idempotent | No |
Vulnerability scanner target environments (vuln-scanner-target-environments) |
account | idempotent | No |
Intel sinkholes (intel-sinkholes) |
account | ordered | No |
Botnet Threat Feed ASN subscriptions (botnet-feed-asn-configs) |
account | idempotent | No |
Fraud Detection settings (fraud-detection-settings) |
zone | idempotent | No |
Rate limits (legacy) (rate-limits) |
zone | idempotent | No |
Zone Lockdown rules (zone-lockdowns) |
zone | idempotent | Yes |
User Agent Blocking rules (ua-rules) |
zone | idempotent | Yes |
Page Shield settings (page-shield-settings) |
zone | idempotent | Yes |
Pay Per Crawl config (pay-per-crawl-config) |
zone | idempotent | No |
Content Scanning settings (content-scanning-settings) |
zone | idempotent | No |
Content Scanning custom expressions (content-scanning-expressions) |
zone | idempotent | No |
Leaked Credential Checks status (leaked-credential-checks) |
zone | idempotent | Yes |
Leaked Credential custom detections (leaked-credential-detections) |
zone | idempotent | No |
Security.txt (security-txt) |
zone | idempotent | No |
Bot Management (bot-management) |
zone | idempotent | Yes |
AI Security for Apps (settings + custom topics) (ai-security) |
zone | idempotent | No |
Data security posture webhooks (data-security-posture-webhooks) |
account | reprovision | No |
Schema validation schemas (schema-validation-schemas) |
zone | ordered | No |
Schema validation hosts (schema-validation-hosts) |
zone | idempotent | No |
Schema validation settings (schema-validation-settings) |
zone | idempotent | No |
Schema validation operations (schema-validation-operations) |
zone | idempotent | No |
Intel indicator feeds (intel-indicator-feeds) |
account | ordered | No |
Intel ip lists (intel-ip-lists) |
account | idempotent | No |
Vulnerability scanner credential sets (vuln-scanner-credential-sets) |
account | reprovision | No |
API gateway labels (api-gateway-labels) |
zone | idempotent | No |
API gateway schemas (api-gateway-schemas) |
zone | ordered | No |
API gateway user schema hosts (api-gateway-user-schema-hosts) |
zone | idempotent | No |
API gateway discovery settings (api-gateway-discovery-settings) |
zone | idempotent | No |
Legacy WAF packages (waf-legacy-packages) |
zone | idempotent | No |
Smart shield healthchecks (smart-shield-healthchecks) |
zone | idempotent | No |
Traffic & delivery
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Workers routes (workers-routes) |
zone | ordered | No |
Load balancers (zone) (load-balancers) |
zone | ordered | No |
Waiting rooms (waiting-rooms) |
zone | idempotent | No |
Spectrum apps (spectrum-apps) |
zone | idempotent | No |
Custom hostnames (SaaS) (custom-hostnames) |
zone | ordered | No |
Custom error pages (custom-pages) |
zone | idempotent | No |
LB monitor groups (lb-monitor-groups) |
account | ordered | No |
Waiting Room zone settings (waiting-room-settings) |
zone | idempotent | No |
Zone RUM (Web Analytics) toggle (zone-rum) |
zone | idempotent | Yes |
Health checks (healthchecks) |
zone | idempotent | No |
Endpoint health checks (account-endpoint-healthchecks) |
account | idempotent | No |
Tiered Caching (tiered-caching) |
zone | idempotent | No |
Cache Reserve (cache-reserve) |
zone | idempotent | No |
Regional Tiered Cache (regional-tiered-cache) |
zone | idempotent | No |
Smart Tiered Cache (smart-tiered-cache) |
zone | idempotent | Yes |
Cache Variants (cache-variants) |
zone | idempotent | No |
Origin cloud region mappings (origin-cloud-regions) |
zone | idempotent | No |
Smart Shield settings (smart-shield) |
zone | idempotent | Yes |
Zaraz configuration (zaraz-config) |
zone | idempotent | Yes |
Zaraz workflow (zaraz-workflow) |
zone | idempotent | No |
Argo Smart Routing (argo-smart-routing) |
zone | idempotent | No |
Cloud Connector rules (cloud-connector-rules) |
zone | idempotent | No |
Waiting Room bypass rules (waiting-room-rules) |
zone | ordered | No |
Waiting Room scheduled events (waiting-room-events) |
zone | ordered | No |
Account load balancers (account-load-balancers) |
account | ordered | No |
Account waiting rooms (account-waiting-rooms) |
account | ordered | No |
Speed monitored pages (speed-monitored-pages) |
zone | idempotent | No |
TLS & certificates
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Certificate packs (certificate-packs) |
zone | reprovision | No |
Custom certificates (custom-certificates) |
zone | reprovision | No |
Authenticated origin pulls (origin-tls-client-auth) |
zone | reprovision | No |
API Shield client certificates (mTLS) (api-shield-client-certificates) |
zone | reprovision | No |
API Shield mTLS hostname associations (api-shield-cert-hostname-associations) |
zone | ordered | No |
Keyless SSL configurations (keyless-certificates) |
zone | reprovision | No |
Custom origin trust store (ACM) (custom-trust-store) |
zone | idempotent | No |
Universal SSL settings (universal-ssl-settings) |
zone | idempotent | Yes |
Custom CSRs (zone) (custom-csrs) |
zone | reprovision | No |
Custom CSRs (account) (custom-csrs-account) |
account | reprovision | No |
Custom hostname fallback origin (custom-hostname-fallback-origin) |
zone | idempotent | No |
Origin TLS client auth hostnames (origin-tls-client-auth-hostnames) |
zone | ordered | No |
Origin TLS client auth certificates (origin-tls-client-auth-certificates) |
zone | reprovision | No |
Origin TLS client auth settings (origin-tls-client-auth-settings) |
zone | idempotent | Yes |
ACM total TLS (acm-total-tls) |
zone | idempotent | No |
DCV delegation (dcv-delegation) |
zone | idempotent | No |
DNSSEC zsk (dnssec-zsk) |
zone | reprovision | No |
Cache origin post-quantum encryption (cache-origin-pq-encryption) |
zone | idempotent | Yes |
Email & logs
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Email routing (email-routing) |
zone | idempotent | Yes |
Logpush jobs (zone) (logpush) |
zone | ordered | No |
Logpush jobs (account) (account-logpush) |
account | ordered | No |
Email Routing destination addresses (email-routing-addresses) |
account | reprovision | No |
Email Sending subdomains (email-sending-subdomains) |
zone | reprovision | No |
Email DMARC report configuration (email-dmarc-reports) |
zone | idempotent | Yes |
Email Routing catch-all rule (email-routing-catch-all) |
zone | idempotent | Yes |
Log Explorer datasets (zone) (logs-explorer-datasets) |
zone | idempotent | No |
Log Explorer datasets (account) (account-logs-explorer-datasets) |
account | idempotent | No |
Workers Observability saved queries (observability-saved-queries) |
account | idempotent | Yes |
Log Control CMB (Customer Metadata Boundary) config (logcontrol-cmb-config) |
account | idempotent | No |
Zone log-retention flag (log-retention-flag) |
zone | idempotent | No |
Account email routing rules (account-email-routing-rules) |
account | ordered | No |
Account email sending suppressions (account-email-sending-suppressions) |
account | idempotent | No |
Workers observability destinations (workers-observability-destinations) |
account | reprovision | No |
Workers observability metricsexport (workers-observability-metricsexport) |
account | idempotent | No |
Zone logpush edge jobs (zone-logpush-edge-jobs) |
zone | ordered | No |
Account settings & rules
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Account settings (account-settings) |
account | idempotent | No |
WAF & rulesets (account) (account-rulesets) |
account | idempotent | Yes |
Rule lists (account-rule-lists) |
account | idempotent | Yes |
Custom pages (account) (account-custom-pages) |
account | idempotent | No |
Firewall access rules (account) (account-firewall-access-rules) |
account | idempotent | Yes |
Workers account settings (workers-account-settings) |
account | idempotent | Yes |
Workers subdomain (workers-subdomain) |
account | idempotent | No |
Realtime SFU (Calls) apps (calls-apps) |
account | reprovision | No |
Calls TURN keys (wiring) (calls-turn-keys) |
account | reprovision | No |
MoQ relays (moq-relays) |
account | reprovision | No |
RealtimeKit apps (realtimekit-apps) |
account | reprovision | No |
Container image registries (image-registries) |
account | idempotent | No |
Queue event subscriptions (queue-event-subscriptions) |
account | ordered | No |
Cloudforce One custom rules (cloudforce-one-rules) |
account | idempotent | No |
Pages projects (pages-projects) |
account | reprovision | No |
R2 Data Catalogs (r2-catalog) |
account | ordered | No |
R2 Catalog Syncs (r2-catalog-syncs) |
account | reprovision | No |
Workflows (workflows) |
account | ordered | No |
Pay Per Crawl crawler Stripe wiring (pay-per-crawl-crawler-stripe) |
account | reprovision | No |
Pay Per Crawl publisher Stripe wiring (pay-per-crawl-publisher-stripe) |
account | reprovision | No |
Snippet rules (snippet-rules) |
zone | ordered | No |
Container applications (container-applications) |
account | reprovision | No |
Queues (definitions + consumers) (queues) |
account | ordered | No |
Workers for Platforms (dispatch namespaces + script settings) (workers-for-platforms) |
account | reprovision | No |
Web Analytics sites & rules (web-analytics-sites) |
account | ordered | No |
Rules list items (account-rule-list-items) |
account | idempotent | No |
Snippets (snippets) |
zone | idempotent | No |
Flagship apps (flagship-apps) |
account | ordered | No |
Account tag keys (account-tag-keys) |
account | idempotent | No |
Account custom page assets (account-custom-page-assets) |
account | idempotent | Yes |
Browser extension configuration (browser-extension-config) |
account | idempotent | No |
Web Analytics sites (rum-site-info) |
account | idempotent | No |
Zone custom page assets (zone-custom-page-assets) |
zone | idempotent | Yes |
Account access
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Account members (account-members) |
account | reprovision | No |
Account roles (account-roles) |
account | reprovision | No |
Access reusable policies (access-reusable-policies) |
account | ordered | No |
Access mTLS certificates (access-mtls-certificates) |
account | reprovision | No |
Access key configuration (access-key-configuration) |
account | idempotent | Yes |
IAM user groups (iam-user-groups) |
account | ordered | No |
IAM resource groups (iam-resource-groups) |
account | ordered | No |
Resource shares (resource-shares) |
account | ordered | No |
Zero Trust organisation (access-organizations) |
account | idempotent | Yes |
Workers Builds tokens (build-tokens) |
account | reprovision | No |
Account API tokens (account-api-tokens) |
account | reprovision | No |
SSO connectors (sso-connectors) |
account | reprovision | No |
OAuth clients (oauth-clients) |
account | reprovision | No |
SCIM users (scim-users) |
account | ordered | No |
SCIM groups (scim-groups) |
account | ordered | No |
Access MCP servers (access-mcp-servers) |
account | ordered | No |
Access MCP portals (access-mcp-portals) |
account | ordered | No |
Account network
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
DNS Firewall (dns-firewall) |
account | idempotent | No |
Load balancer pools (lb-pools) |
account | ordered | No |
Load balancer monitors (lb-monitors) |
account | ordered | No |
Address maps (address-maps) |
account | ordered | No |
IP prefixes (ip-prefixes) |
account | ordered | No |
mTLS certificates (mtls-certificates) |
account | reprovision | No |
DLS regional-services prefix bindings (dls-prefix-bindings) |
account | ordered | No |
Network Interconnect CNIs (cni-cnis) |
account | idempotent | No |
Workers VPC connectivity services (connectivity-services) |
account | idempotent | No |
Magic Cloud on-ramps (magic-cloud-onramps) |
account | idempotent | No |
Cloud Integration providers (magic-cloud-providers) |
account | reprovision | No |
Magic Network Monitoring config (mnm-config) |
account | idempotent | No |
Magic Network Monitoring rules (mnm-rules) |
account | idempotent | Yes |
Magic GRE tunnels (magic-gre-tunnels) |
account | reprovision | No |
Magic IPsec tunnels (magic-ipsec-tunnels) |
account | reprovision | No |
Magic static routes (magic-static-routes) |
account | ordered | No |
Cloudflare interconnects (magic-cf-interconnects) |
account | ordered | No |
Magic Transit sites (magic-cf1-sites) |
account | ordered | No |
Magic BGP settings (magic-bgp-settings) |
account | idempotent | Yes |
Magic BGP filter profiles (magic-bgp-filter-profiles) |
account | idempotent | Yes |
Addressing leases (addressing-leases) |
account | ordered | No |
Addressing services (addressing-services) |
account | idempotent | No |
Alerting & Turnstile
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Notification policies (notification-policies) |
account | ordered | No |
Notification webhooks (notification-webhooks) |
account | reprovision | No |
Turnstile widgets (turnstile) |
account | idempotent | No |
Notification silences (notification-silences) |
account | idempotent | No |
Certificate Transparency alerting subscription (ct-alerting) |
zone | idempotent | Yes |
PagerDuty notification destinations (notification-pagerduty-destinations) |
account | reprovision | No |
Zero Trust
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Access apps (access-apps) |
account | ordered | No |
Access groups (access-groups) |
account | ordered | No |
Access identity providers (access-identity-providers) |
account | reprovision | No |
Access service tokens (access-service-tokens) |
account | reprovision | No |
Access custom pages (access-custom-pages) |
account | idempotent | No |
Access tags (access-tags) |
account | idempotent | Yes |
Gateway rules (gateway-rules) |
account | ordered | No |
Gateway lists (gateway-lists) |
account | idempotent | Yes |
Gateway configuration (gateway-configuration) |
account | idempotent | Yes |
Tunnels (cloudflared) (tunnels-cloudflared) |
account | reprovision | No |
Device posture rules (device-posture-rules) |
account | idempotent | No |
Device settings policies (device-settings-policies) |
account | idempotent | No |
Zone Access applications (zone-access-apps) |
zone | ordered | No |
Zone Access groups (zone-access-groups) |
zone | ordered | No |
Zone Access identity providers (zone-access-identity-providers) |
zone | reprovision | No |
Zone Access service tokens (zone-access-service-tokens) |
zone | reprovision | No |
Zone Zero Trust organisation (zone-zero-trust-organization) |
zone | idempotent | Yes |
Zero Trust device settings (zt-device-settings) |
account | idempotent | Yes |
Zero Trust connectivity settings (zt-connectivity-settings) |
account | idempotent | Yes |
Gateway logging settings (gateway-logging) |
account | idempotent | Yes |
Device posture integrations (device-posture-integrations) |
account | reprovision | No |
Device managed networks (device-managed-networks) |
account | idempotent | Yes |
Global WARP override (resilience) (device-resilience-disconnect) |
account | idempotent | Yes |
Zone device cert provisioning (zone-device-policy-certificates) |
zone | idempotent | No |
Device IP profiles (device-ip-profiles) |
account | idempotent | Yes |
Gateway locations (gateway-locations) |
account | idempotent | No |
Gateway proxy endpoints (gateway-proxy-endpoints) |
account | idempotent | No |
Gateway PAC files (gateway-pac-files) |
account | idempotent | No |
Gateway SSH certificate authorities (gateway-ssh-ca) |
account | reprovision | No |
Device deployment groups (deployment-groups) |
account | idempotent | No |
DEX rules (dex-rules) |
account | idempotent | No |
Device DEX tests (dex-tests) |
account | idempotent | No |
Infrastructure access targets (infrastructure-targets) |
account | ordered | No |
DLP profiles (dlp-profiles) |
account | idempotent | No |
DLP custom profiles (dlp-profiles-custom) |
account | idempotent | No |
DLP entries (dlp-entries) |
account | idempotent | No |
DLP data classes (dlp-data-classes) |
account | idempotent | No |
DLP datasets (dlp-datasets) |
account | ordered | No |
DLP data tag categories (dlp-data-tag-categories) |
account | idempotent | No |
DLP sensitivity groups (dlp-sensitivity-groups) |
account | idempotent | No |
DLP document fingerprints (dlp-document-fingerprints) |
account | reprovision | No |
DLP custom prompt topics (dlp-custom-prompt-topics) |
account | idempotent | No |
DLP email rules (dlp-email-rules) |
account | idempotent | Yes |
DLP settings (dlp-settings) |
account | idempotent | No |
Zero Trust risk behaviours (zt-risk-scoring-behaviors) |
account | idempotent | No |
Zero Trust risk integrations (zt-risk-scoring-integrations) |
account | ordered | No |
Tunnel routes (teamnet-routes) |
account | ordered | No |
Tunnel virtual networks (teamnet-virtual-networks) |
account | idempotent | Yes |
WARP connectors (warp-connector) |
account | reprovision | No |
Cloudflare one applications (cloudflare-one-applications) |
account | ordered | No |
Cloudflare one integrations (cloudflare-one-integrations) |
account | ordered | No |
WARP device policy (device-policy-default) |
account | idempotent | Yes |
Split tunnel exclude list (device-policy-split-tunnel-exclude) |
account | ordered | No |
Split tunnel include list (device-policy-split-tunnel-include) |
account | ordered | No |
WARP fallback domains (device-policy-fallback-domains) |
account | ordered | No |
Gateway audit ssh settings (gateway-audit-ssh-settings) |
account | reprovision | No |
Gateway certificates (gateway-certificates) |
account | reprovision | No |
Gateway custom certificate (gateway-custom-certificate) |
account | reprovision | No |
Gateway egress cidr pairs (gateway-egress-cidr-pairs) |
account | idempotent | No |
Zerotrust subnets (zerotrust-subnets) |
account | idempotent | No |
Zerotrust hostname routes (zerotrust-hostname-routes) |
account | ordered | No |
Data pipelines
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Pipelines ingest streams (pipelines-streams) |
account | idempotent | No |
Pipelines sinks (pipelines-sinks) |
account | reprovision | No |
Pipelines (pipelines) |
account | ordered | No |
AI gateway gateways (ai-gateway-gateways) |
account | idempotent | Yes |
AI gateway custom providers (ai-gateway-custom-providers) |
account | reprovision | No |
AI search instances (ai-search-instances) |
account | ordered | No |
AI search namespaces (ai-search-namespaces) |
account | idempotent | Yes |
AI search tokens (ai-search-tokens) |
account | reprovision | No |
Storage & data
| Surface | Scope | Restore tier | In-band |
|---|---|---|---|
Hyperdrive configs (hyperdrive-configs) |
account | reprovision | No |
Durable Objects namespaces (durable-objects-namespaces) |
account | reprovision | No |
Vectorize indexes (config) (vectorize) |
account | reprovision | No |
R2 bucket settings (lifecycle / lock / CORS) (r2-bucket-config) |
account | idempotent | No |
KV namespace configuration (kv-namespaces-config) |
account | idempotent | Yes |
D1 database configuration (d1-databases-config) |
account | ordered | No |
Secrets Store stores (secrets-store-stores) |
account | ordered | No |
Stream live inputs (stream-live-inputs) |
account | ordered | No |
Stream watermarks (stream-watermarks) |
account | idempotent | No |
Stream signing keys (stream-signing-keys) |
account | reprovision | No |
Stream webhook (stream-webhook) |
account | idempotent | No |
Images variants (images-variants) |
account | idempotent | No |
Vectorize indexes config (vectorize-indexes-config) |
account | ordered | No |
Re-provision never means a secret is recoverable
Certificate private keys, Access service-token secrets, identity-provider client secrets and tunnel secrets are write-only values the Cloudflare API never returns on read, so the backup never holds them. The re-provision tier captures the configuration around those secrets and their names, then emits a checklist of what to re-provision. Do not read a re-provision surface as a way to recover the secret itself.
The surfaces that auto-restore in-band
In-band re-apply means the engine writes the surface straight back into your live account through the console during a restore apply. Today that is 60 of the 313 surfaces. Each is an idempotent surface with a diff-driven write path that has been PROVEN against a real Cloudflare account: created, captured, damaged, restored, and re-run to confirm the restore converges rather than duplicating.
| Surface | Scope | How it re-applies in-band |
|---|---|---|
DNS records (dns) |
zone | Reads the live records, matches by a natural key, creates or updates only the differences. |
Zone settings (zone-settings) |
zone | Patches each changed setting individually, so one un-settable setting skips itself. |
Page rules (page-rules) |
zone | Matches by the rule’s target pattern and replaces a changed rule by its own id. |
Firewall access rules, zone (firewall-access-rules) |
zone | Matches by the rule’s configuration and updates a changed rule by its id. |
Firewall access rules, account (account-firewall-access-rules) |
account | Same diff-driven apply as the zone surface, at account level. |
WAF and rulesets, zone (rulesets) |
zone | Updates each existing ruleset’s rule list in place by the ruleset id. |
WAF and rulesets, account (account-rulesets) |
account | Same in-place ruleset-rules update, at account level. |
Account rule lists (account-rule-lists) |
account | Matches a list by its name, which Cloudflare enforces as unique per account, and updates it in place. |
KV namespace configuration (kv-namespaces-config) |
account | Recreates a missing namespace and updates a changed title. The namespace CONTENTS are a separate source, not this surface. |
Four single zone settings (zone-setting-fonts, zone-setting-origin-max-http-version, zone-setting-speed-brain, zone-setting-ssl-automatic-mode) |
zone | Each writes its own setting through the same single-setting writer. A setting your plan does not include is reported as not editable, not silently skipped. |
The in-band write is additive by design. It creates or updates only the items that differ, one at a time, and it never replaces a whole collection. It also never deletes a live item the snapshot happens to omit, so a live-only record is reported as left in place rather than removed. The remaining 253 surfaces are captured in full and verified recoverable, but restoring them is out of band and does not carry a diff preview: ordered surfaces re-created in dependency order, and re-provision surfaces rebuilt from their checklist, both from the verified snapshot.
A further 25 surfaces carry a write path that is not in that 60. Those writers were generated from Cloudflare’s published API schema, which fixes the endpoint and the method but says nothing about which field identifies an item or which fields an update refuses, and both of those decide whether a restore writes to the right object. They are off by default: a restore that does not name a scope will not touch them. An operator who wants one names it explicitly, and the named set is bound into the approval hash so an approver sees exactly which unproven surface they are authorising. They are counted separately here and never folded into the in-band number, because an available writer is not a restore promise.
What is not captured
The scope is configuration, the settings of an account and its zones, not data and not runtime or analytics. The following are deliberately out of scope for the cf-config source.
| Not captured | Why, and where it lives instead |
|---|---|
| KV, R2, D1 and Secrets Store data | These are their own data source types, each captured by its own source rather than by cf-config. See the sources overview. |
| Worker code, bindings and version inventory | Captured by the separate Workers source, whose restore is re-deploy from the verified snapshot. See secrets and Workers. |
| Logs, analytics and Radar | Runtime and content, not configuration. The logpush job configuration is captured here; the log and analytics data are not. Stream and Images content is captured by the separate Stream and Images source types, not by cf-config. |
| Billing | Out of scope by design. The engine never reads or writes billing. |
| Registrar | Excluded because it would need the Global API Key, a credential the engine deliberately never holds. |
Secret values are never in a cf-config record
A cf-config record holds a surface’s configuration as canonical JSON. It does not hold secret values such as certificate private keys or service-token secrets, because the Cloudflare API does not return them on read. The re-provision tier exists precisely so a restore can name what to re-provision without ever pretending to hold the secret.
How surface selection works
A downpipe stores the surface ids it captures in the source selector. Selection matches by exact surface id, not by a prefix, so the per-surface tick-boxes in the console capture exactly what was ticked. Two rules govern the rest.
An empty include list means all surfaces, so a downpipe that selects nothing is selecting everything in scope. And an account-only downpipe, one configured with no zone id, skips every zone-scoped surface and reads only the account-scoped ones; the zone-scoped rows above simply do not apply to it.
The backup is fail-open per surface. A surface the discovery token cannot read, because of a missing scope, a product not on the plan or a deprecated endpoint, becomes an explicit unavailable marker rather than failing the run. The archive stays complete, with one record per attempted surface, and a marker is distinguished from a genuinely empty surface. Only if every attempted surface fails does the run fail loudly, because that means a broken token or the wrong account rather than a per-surface gap.
Why this table is generated from the registry
The surface registry is plain data behind engine/src/sources/cf-config-surfaces.ts, which re-exports the registry files that hold the entries. Each entry names the surface id, its scope, its restore tier and, for the in-band surfaces, the diff-driven write function. The backup adapter and the restore sink both read that one registry, so there is no second list to keep in step. Adding a surface is an append, and the table, the count and the tiers on this page are generated from those entries by docs/scripts/gen-cf-surfaces.mjs. If the registry changes, re-running that generator refreshes this page from it.
The console builds its per-surface selection UI from the same registry, grouping the surfaces into the categories above with a human label for each. The read and write functions never cross the wire; only the metadata (id, label, category, scope and tier) is serialised for the selection screen.
Where this fits
- Backing up and restoring your Cloudflare configuration is the narrative home for the cf-config source: the credential model, the backup behaviour and the dual-control restore.
- What restore can and cannot write back covers the same tiered and out-of-band split across every source type.
- Cloudflare token scopes is the credential model: the read-only discovery token the backup reads with, and the separate edit-scoped token you supply per restore. The per-surface edit permissions themselves are enumerated on which permissions the edit token needs.
- The sources overview places cf-config alongside the KV, R2, D1, Secrets Store and Workers sources.
- Selectors and scope explains how include and exclude selectors work across all source types.
Last updated .