Healthcheck (Legacy) Read or Write, Notifications Read or Write, or Browser Rendering Write. Managed notification triggers request Notifications Write.
Every API token must include Account Settings Read so Automate.ax can identify the connected account. Add only the callable permissions and account or zone resources the automation uses. For Browser Run, the minimum is Account Settings Read plus Browser Run Edit on the target account.
The packaged surface covers Browser Run quick actions and crawls plus accounts, zones, DNS records, cache purge, health checks, and notifications. Browser Run actions require an account with the product available and Browser Rendering Write permission. Quick actions consume browser duration; crawls report accumulated browserSecondsUsed. Cloudflare’s plan, concurrency, request-rate, and browser-time limits still apply.
Workers Browser Rendering bindings and long-lived DevTools or WebSocket browser sessions are not packaged actions. Cloudflare Workers, Pages, storage, rule sets, Zero Trust, load balancing, certificates, log delivery, analytics, billing, media, AI, and enterprise networking remain separate product areas.
Use getCloudflareApi(account) inside a custom account-backed action for another Cloudflare REST endpoint. Paths are relative to https://api.cloudflare.com/client/v4/; public body and query keys use camel case and the helper converts Cloudflare wire keys recursively. For an uncovered Browser Run endpoint, set keyFormat: "browser-rendering"; use requestBlob for binary data and responseKeyFormat: "preserve" for provider-defined or extracted JSON keys. Every response requires a Zod schema. Failures throw CloudflareApiError with the HTTP status, provider errors, retry delay, and rate-limit headers.
Managed triggers create one generic webhook destination and notification policy per account, alert type, and filter set. Cloudflare sends the destination secret in cf-webhook-auth; Automate.ax verifies it before parsing or ingesting the body. Provider retries are deduplicated by exact-body SHA-256 hash.
Cloudflare generic webhooks, Health Checks, and some alert types require particular products or paid plans. Use cloudflare.listAvailableAlertTypes to inspect what an account supports.
See Cloudflare’s Browser Run documentation, Browser Run pricing and limits, API documentation, API-token permissions, notification webhooks, and API rate limits.