Cloudflare.Account reference

Account

Source: src/Cloudflare/Account/Account.ts

A Cloudflare account (subaccount), for tenant / partner platforms that provision an account per customer.

Creating accounts (POST /accounts) is restricted to credentials with the tenant entitlement — a standard user receives the typed AccountCreationForbidden error (Cloudflare error code 1002). The name and account settings are mutable in place; type and the tenant unit are create-only and trigger a replacement. Deleting the resource queues the account for deletion (also tenant-gated).

The account’s physical identity is the Cloudflare-assigned accountId. Account names are not unique, so there is no find-by-name fallback: if state is lost, the account is treated as missing rather than guessed at.

Account: Creating an account

Standard subaccount with a generated name

const account = yield* Cloudflare.Account.Account("CustomerAccount", {});

Subaccount on a specific tenant unit

const account = yield* Cloudflare.Account.Account("CustomerAccount", {
  name: "Customer: ACME Inc",
  unit: { id: tenantUnitId },
});

Account: Account settings

const account = yield* Cloudflare.Account.Account("CustomerAccount", {
  name: "Customer: ACME Inc",
  enforceTwofactor: true,
  abuseContactEmail: "abuse@acme.example",
});

Member

Source: src/Cloudflare/Account/Member.ts

A member of a Cloudflare account — an invitation for a user (by email) to join the account with a set of roles or scoped policies.

The membership’s identity is its email: there is no API to change the address, so updating email triggers a replacement (a fresh invite). The assigned roles/policies are mutable in place. New invites stay pending until the invitee accepts; deleting the resource cancels a pending invite or removes an accepted member.

Safety: memberships carry no ownership markers. When there is no prior state, read scans the account for an existing membership with the same email and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

Member: Inviting a member

const role = yield* Cloudflare.Account.findAccountRoleByName(
  accountId,
  "Administrator Read Only",
);

yield* Cloudflare.Account.Member("Auditor", {
  email: "auditor@example.com",
  roles: [role!.id],
});

Member: Changing roles

// Same email — the membership is updated, not replaced.
yield* Cloudflare.Account.Member("Auditor", {
  email: "auditor@example.com",
  roles: [adminRole.id],
});

Member: Scoped policies (Enterprise)

yield* Cloudflare.Account.Member("ScopedOperator", {
  email: "operator@example.com",
  policies: [{
    access: "allow",
    permissionGroups: [{ id: permissionGroupId }],
    resourceGroups: [{ id: resourceGroupId }],
  }],
});