Cloudflare.Devices reference

DeviceCustomProfile

Source: src/Cloudflare/Devices/CustomProfile.ts

A Cloudflare WARP custom device profile — a settings profile applied to the subset of devices matched by a wirefilter match expression at a given precedence.

All properties are mutable in place: the profile itself is patched, and the per-profile split-tunnel include/exclude and fallback-domain lists are replaced via their dedicated endpoints. Deleting the resource deletes the profile; matched devices fall back to the account’s default profile.

DeviceCustomProfile: Creating a profile

const profile = yield* Cloudflare.Devices.DeviceCustomProfile("Contractors", {
  match: 'identity.groups.name == "contractors"',
  precedence: 100,
  description: "Locked-down profile for contractors",
  switchLocked: true,
});

DeviceCustomProfile: Split tunneling

yield* Cloudflare.Devices.DeviceCustomProfile("Engineering", {
  match: 'identity.groups.name == "engineering"',
  precedence: 50,
  exclude: [
    { address: "10.0.0.0/8", description: "RFC1918" },
  ],
});

DeviceCustomProfile: Fallback domains

yield* Cloudflare.Devices.DeviceCustomProfile("CorpDns", {
  match: 'identity.email matches ".*@corp.example.com"',
  precedence: 10,
  fallbackDomains: [
    { suffix: "corp.example.com", dnsServer: ["10.0.0.53"] },
  ],
});

DeviceDefaultProfile

Source: src/Cloudflare/Devices/DefaultProfile.ts

Manages the singleton Cloudflare WARP default device profile for an account. The default profile applies to every WARP device not matched by a custom profile.

DeviceDefaultProfile: Configuring split tunneling

Exclude-mode (default): tunnel everything except listed routes

yield* Cloudflare.Devices.DeviceDefaultProfile("Default", {
  mode: "exclude",
  splitTunnelExclude: [
    { address: "10.0.0.0/8", description: "RFC1918" },
    { address: "192.168.0.0/16", description: "RFC1918" },
  ],
  excludeOfficeIps: true,
});

Include-mode: only listed routes go through WARP

yield* Cloudflare.Devices.DeviceDefaultProfile("Default", {
  mode: "include",
  splitTunnelInclude: [
    { address: "10.42.0.0/16", description: "Prod VPC" },
  ],
});

DeviceDefaultProfile: Configuring fallback domains

yield* Cloudflare.Devices.DeviceDefaultProfile("Default", {
  fallbackDomains: [
    {
      suffix: "corp.example.com",
      dnsServer: ["10.0.0.53"],
      description: "Corp AD",
    },
  ],
  disableAutoFallback: true,
});

DeviceDexTest

Source: src/Cloudflare/Devices/DexTest.ts

A Cloudflare Zero Trust DEX synthetic test — an HTTP or traceroute probe that enrolled WARP devices run on a schedule so the Digital Experience Monitoring dashboard can chart reachability and latency to your critical applications.

Requires the DEX entitlement on the account (the API rejects writes with Forbidden / dex.api.entitlements.missing otherwise).

DeviceDexTest: Creating a DEX test

HTTP probe every 30 minutes

const test = yield* Cloudflare.Devices.DeviceDexTest("AppHealth", {
  data: { host: "https://app.example.com/health", kind: "http", method: "GET" },
  interval: "0h30m0s",
  description: "Internal app reachability",
});

Traceroute probe targeting specific device profiles

const trace = yield* Cloudflare.Devices.DeviceDexTest("OriginTrace", {
  data: { host: "203.0.113.10", kind: "traceroute" },
  interval: "0h30m0s",
  targeted: true,
  targetPolicies: [{ id: profile.policyId }],
});

DeviceManagedNetwork

Source: src/Cloudflare/Devices/ManagedNetwork.ts

A Cloudflare Zero Trust device managed network — a TLS endpoint the WARP client probes to detect whether the device is on a known network. Device profiles can then match on network to apply different WARP settings on trusted networks.

Name and config are mutable in place (PUT). tls is the only network type Cloudflare supports.

DeviceManagedNetwork: Creating a managed network

Detect the office network by TLS fingerprint

const network = yield* Cloudflare.Devices.DeviceManagedNetwork("Office", {
  config: {
    tlsSockaddr: "192.0.2.1:443",
    sha256:
      "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c",
  },
});

Use the network in a custom device profile

yield* Cloudflare.Devices.DeviceCustomProfile("OnPrem", {
  match: `network == "${network.name}"`,
  precedence: 100,
  serviceModeV2: { mode: "proxy", port: 3000 },
});

DevicePostureIntegration

Source: src/Cloudflare/Devices/PostureIntegration.ts

A Cloudflare Zero Trust device posture integration — a service-to- service connection to a third-party endpoint security provider (CrowdStrike, Intune, Kolide, Workspace ONE, …) whose signals power *_s2s device posture rules.

Cloudflare validates the configured credentials against the live provider API at create/update time, so a reachable third-party tenant is required.

DevicePostureIntegration: Creating a posture integration

CrowdStrike Falcon

const falcon = yield* Cloudflare.Devices.DevicePostureIntegration("Falcon", {
  type: "crowdstrike_s2s",
  interval: "10m",
  config: {
    apiUrl: "https://api.crowdstrike.com",
    clientId: Alchemy.env("CROWDSTRIKE_CLIENT_ID"),
    clientSecret: Redacted.make(process.env.CROWDSTRIKE_SECRET!),
    customerId: "ccid-1234",
  },
});

Custom service-to-service provider behind Access

const custom = yield* Cloudflare.Devices.DevicePostureIntegration("Custom", {
  type: "custom_s2s",
  interval: "30m",
  config: {
    apiUrl: "https://posture.example.com/check",
    clientSecret: Redacted.make(process.env.POSTURE_SECRET!),
    accessClientId: serviceToken.clientId,
    accessClientSecret: serviceToken.clientSecret,
  },
});

Reference the integration from a posture rule

yield* Cloudflare.Devices.DevicePostureRule("FalconScore", {
  type: "crowdstrike_s2s",
  input: { connectionId: falcon.integrationId, os: "windows" },
});

DevicePostureRule

Source: src/Cloudflare/Devices/PostureRule.ts

A Cloudflare Zero Trust device posture rule — a periodic check the WARP client runs on enrolled devices (OS version, firewall status, disk encryption, file presence, or a third-party security provider’s verdict). Posture results can then gate Access policies and Gateway rules.

Everything except type is mutable in place (full PUT). Changing type replaces the rule.

DevicePostureRule: Infrastructure-free checks

Require a minimum Windows version

const rule = yield* Cloudflare.Devices.DevicePostureRule("WindowsOsVersion", {
  type: "os_version",
  description: "Require Windows 10.0.19045+",
  match: [{ platform: "windows" }],
  schedule: "5m",
  input: {
    operatingSystem: "windows",
    operator: ">=",
    version: "10.0.19045",
  },
});

Require the OS firewall to be enabled

yield* Cloudflare.Devices.DevicePostureRule("Firewall", {
  type: "firewall",
  match: [{ platform: "windows" }, { platform: "mac" }],
  input: { enabled: true, operatingSystem: "windows" },
});

Require disk encryption on all drives

yield* Cloudflare.Devices.DevicePostureRule("DiskEncryption", {
  type: "disk_encryption",
  match: [{ platform: "mac" }],
  input: { requireAll: true },
});

DeviceSettings

Source: src/Cloudflare/Devices/Settings.ts

Manages the singleton Cloudflare Zero Trust device settings for an account (/accounts/{accountId}/devices/settings) — account-wide WARP toggles like the Gateway TCP/UDP proxy, managed root certificate installation, and CGNAT virtual IP.

The singleton always exists, so reconcile patches only the declared fields in place. The pre-management snapshot is captured on first touch and restored on destroy (capture-and-restore), returning the account to the state Alchemy found it in.

DeviceSettings: Managing device settings

Enable the Gateway proxy

yield* Cloudflare.Devices.DeviceSettings("Devices", {
  gatewayProxyEnabled: true,
  gatewayUdpProxyEnabled: true,
});

Allow one-hour WARP override codes

yield* Cloudflare.Devices.DeviceSettings("Devices", {
  disableForTime: 3600,
});