# Get a zone’s security settings

> The zone’s security defaults, read live from Cloudflare and graded by the Cloudflare Checkup’s checks; a setting Cloudflare could not answer comes from the l...

Source: https://docs.vigilbase.com/one/api/reference/cloudflare/cloudflare-zone-security-get

`GET https://api.vigilbase.com/one/v1/cloudflare/zones/{zoneId}/security`

The zone’s security defaults, read live from Cloudflare and graded by the Cloudflare Checkup’s checks; a setting Cloudflare could not answer comes from the latest checkup.

> Deprecated aliases: `GET https://one.vigilbase.com/api/services/cloudflare/zones/{zoneId}/security`. They answer with the same bodies, with a `Deprecation` header and a `successor-version` link to this URL.

## Authorizations

Send one of these:

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`. Scope: `one:api`.
- `Authorization` (string, header, required): Organisation API key (`vb_one_…`) from **Settings → API keys** in Vigilbase One, sent as `Authorization: Bearer vb_one_…`. Read-only keys work. See [organisation API keys](https://docs.vigilbase.com/one/api#organisation-api-keys).
- `Authorization` (string, header, required): Vigilbase Identity access token issued to an MCP client (mcp.vigilbase.com). Scope: `one:read`.
- Permissions checked: `read:services`

## Path parameters

- `zoneId` (string, required): A Cloudflare ID: 32 lower-case hexadecimal characters. Pattern ^[a-f0-9]{32}$.

## Query parameters

- `customerId` (string, required)

## Responses

Errors are problem details (`application/problem+json`). See [errors](https://docs.vigilbase.com/one/api#errors).

### 200 (application/json)

Success

- `zoneId` (string, required)
- `source` (any, required)
- `readAt` (any, required)
- `liveError` (string | null, required): Why Cloudflare could not be read live; settings then come from the latest checkup.
- `checkup` (any, required)
- `settings` (object, required)
  - `ssl` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `waf` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `browserCheck` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `challengeTtl` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `securityLevel` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `opportunisticEncryption` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `automaticHttpsRewrites` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
  - `alwaysUseHttps` (object, required)
    - `enabled` (boolean | null, required): Pass is true, warning or fail is false; null when not graded or not read.
    - `status` (any, required)
    - `details` (string, required)
    - `source` (any, required)
    - `value` (string | number | boolean | null, required): The Cloudflare setting value (live reads only).
    - `checkedAt` (any, required)
- `defaults` (object, required)
  - `applied` (boolean | null, required): Whether the zone has every recommended default (live values only).
  - `pending` (string[], required)

### 400 (application/problem+json)

Problem: `validation_failed`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 401 (application/problem+json)

Problem: `unauthorized`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 403 (application/problem+json)

Problem: `forbidden`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 404 (application/problem+json)

Problem: `not_found`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 429 (application/problem+json)

Problem: `rate_limit_exceeded`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 503 (application/problem+json)

Problem: `service_unavailable`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### default (application/problem+json)

Problem details (RFC 9457).

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

## Example request

```bash
# Token from `vigilbase login`, or an API key (vb_one_…)
curl --request GET \
  --url 'https://api.vigilbase.com/one/v1/cloudflare/zones/{zoneId}/security?customerId={customerId}' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN"
```

## Example response (200)

```json
{
  "zoneId": "<string>",
  "source": "<any>",
  "readAt": "<any>",
  "liveError": "<string>",
  "checkup": "<any>",
  "settings": {
    "ssl": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "waf": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "browserCheck": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "challengeTtl": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "securityLevel": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "opportunisticEncryption": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "automaticHttpsRewrites": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    },
    "alwaysUseHttps": {
      "enabled": true,
      "status": "<any>",
      "details": "<string>",
      "source": "<any>",
      "value": "<string>",
      "checkedAt": "<any>"
    }
  },
  "defaults": {
    "applied": true,
    "pending": [
      "ssl"
    ]
  }
}
```

See also the [guide](https://docs.vigilbase.com/one/api/cloudflare).