# Connect Cloudflare > Connect Cloudflare to Vigilbase OS with one-click sign-in or an API token, choose access and set up HTTP request logs. Source: https://docs.vigilbase.com/os/integrations/cloudflare The Cloudflare connector reads your accounts, zones, DNS records, WAF custom rules, Workers, Access applications, audit logs and security events. With setup and response access it can also propose WAF rule changes and set up Logpush so Cloudflare sends HTTP request logs to Vigilbase. Every change still needs an approved plan. > [!NOTE] > The Cloudflare connector is **Beta**: tested live with real accounts, and it may still change. ## Before you start - You need the `integration.manage` and `credential.manage` permissions in Vigilbase OS. - You need a Cloudflare user who can authorise access to the accounts you want to connect. ## Connect with one click :::steps 1. **Open Integrations, choose Add connection and select Cloudflare.** 2. **Choose Access.** **Read and write** (recommended) lets Vigilbase propose response actions; nothing changes in Cloudflare until someone approves a plan. **Read only** means Vigilbase only reads. 3. **Choose Continue with Cloudflare.** Cloudflare shows one screen with two kinds of access: **Read** (accounts, zones, DNS, firewall rules, audit logs and security events) and **Setup and response** (set up Logpush and change WAF rules). 4. **Choose your accounts and permissions on Cloudflare's screen.** You can turn off any setup or response permission, or choose Read Only. Cloudflare grants permissions for every zone in the accounts you pick. 5. **Pick the account if asked.** If you authorised more than one account, choose which one this connection covers. Vigilbase then discovers its zones. ::: Vigilbase records exactly the permissions Cloudflare returned. Granting access changes nothing by itself. ## Connect with an API token If you prefer, choose **Use an API token instead** and create a scoped token in Cloudflare. | Field | What to enter | |---|---| | Token type | **user** or **account**: user API tokens and account-owned API tokens are verified differently. | | Account ID | The account to check for audit access. Required for account-owned tokens. | | Zone ID | A zone to check for DNS and WAF access. Discovery then lists every zone the token can reach. | | API token | A scoped read token. | Give the read token these permissions: Zone > Zone > Read, Zone > DNS > Read, Zone > Zone WAF > Read, Account > Account Settings > Read, Account > Account Analytics > Read and Zone > Analytics > Read. To read Workers and Access applications, also add Workers Scripts Read and Access: Apps and Policies Read. Write permissions, such as Zone WAF Edit, are granted separately. ## Change access later On the connection page, open **Setup & access**. - **Change access** re-runs the Cloudflare sign-in so you can add or remove setup and response permissions. You confirm it's you first. - The **Setup and response access** table shows each capability and whether Cloudflare granted it. ## Set up HTTP request logs Security events show only requests that matched a rule. For complete HTTP request logs, Cloudflare must push them to Vigilbase with a Logpush job. Vigilbase can create the job for you once a person approves the plan. :::steps 1. **Open the connection's Setup & access tab.** Find **Cloudflare HTTP request logs**. 2. **Choose Set up zones.** The button shows how many zones can be set up. If it is missing, your connection lacks Logpush permission; choose **Allow Logpush setup** to grant it. 3. **Select the zones and review.** The dialog explains what Cloudflare bills and which fields Vigilbase asks for. 4. **Choose Create plan.** One plan covers all the Logpush zones you selected, and opens under [Approvals](https://docs.vigilbase.com/os/approvals). 5. **Get the plan approved.** With separation of duties on, someone other than you must approve it, unless your policy allows owners and admins to approve their own Logpush setup. ::: After approval, the zones table shows each zone's method, progress, last delivery and events in the last 24 hours. Progress goes from plan approved, to job created and validated, to first delivery. ### What Vigilbase asks for Each Logpush job asks for exactly 12 fields per request: RayID, EdgeStartTimestamp, ClientIP, ClientCountry, ClientASN, ClientRequestHost, ClientRequestMethod, ClientRequestPath, EdgeResponseStatus, CacheCacheStatus, SecurityAction and SecurityRuleID. It never asks for query strings, cookies or headers. Requests dropped by DDoS mitigation are excluded. > [!WARNING] > Cloudflare bills Logpush per account beyond the included volume. The plan shows an estimated Logpush volume from the zone's recent traffic; it is approximate. Cloudflare allows at most 4 Logpush jobs per zone. The token in each Logpush job is part of the job's destination in Cloudflare, so Cloudflare account admins and anyone who can edit Logpush can see it. Vigilbase stores only a digest of it. ### Set up Logpush yourself Choose **Set up Logpush manually instead** to create the job in Cloudflare yourself: :::steps 1. **Choose a zone.** 2. **Generate its token.** The token is for that one zone. 3. **Create the job in Cloudflare.** Copy the endpoint straight away; it is shown only once. Use the dataset, output type, timestamp format and `max_upload_bytes` shown on the page. 4. **Wait for the first delivery.** The zone shows **Receiving logs** once Vigilbase receives it. ::: Use **Regenerate token** or **Revoke** on a zone to replace or remove its manual token. ### Stop Logpush Choose **Stop Logpush** on a zone to create a removal plan. After approval, Vigilbase deletes the job in Cloudflare and revokes the zone's token. Disabling the connection does not delete Logpush jobs in Cloudflare. The disable dialog warns you and offers **Create removal plan** first. ## Response actions With setup and response access, Vigilbase can propose these WAF changes: - enable or disable a WAF custom rule - block an IP address with a new WAF custom rule Disabling a rule weakens protection, so those plans carry a warning. After execution, Vigilbase verifies the rule state, the rule's matches in security events and the edge error rate. See [Verification](https://docs.vigilbase.com/os/concepts/verification). ## What is not collected - Zone settings, Gateway configuration, DNSSEC state and DNS analytics. - Managed rulesets, rate limiting rules and account-level custom rulesets. - Access policies: an Access application links to the hostnames it protects, not to people. - Allowed requests that matched no rule, unless you set up HTTP request logs.