Cloudflare

Ace reads Cloudflare traffic and errors per hostname, security events, Workers and load balancers to investigate incidents at the edge. Cloudflare notifications open incidents, and DNS, rule, SSL and Worker changes join your workloads' change timeline so you see them next to your deploys.

What Ace readsCopy Anchor Link

Ace reads every zone the token can see, or only the zones you list.

• HTTP analytics per hostname. Ace compares requests and the 5xx share with an equal window before the incident, and splits origin errors (your origin answered 5xx) from edge errors (Cloudflare couldn't reach or talk to the origin) so you know which side failed.
• Firewall events from WAF, managed and custom rules, rate limiting and bots. Ace groups them by action, rule, host and path, country, network and user agent, and compares them with the window before.
• Workers analytics per script: requests, errors, status codes and CPU time. Ace adds exception messages where it can read Workers Observability.
• Audit logs of account changes around the incident, with who made them. These cover DNS, zone and SSL settings, WAF and rate-limit rules, load balancers, pools, monitors, Tunnels, Workers and routes.
• Load balancer health: pool and origin health, which pools served traffic over the window, and failovers.
• SSL mode and edge certificates, for 525 and 526 errors.
• Platform incidents on Cloudflare's status page during the window.

Load balancer health and SSL status need the optional read permissions below. Ace checks them when you connect and uses only the reads your token allows.

To verify a fix, Ace reads the edge error rate for the affected host. For the System Map, it discovers zones, DNS records, Workers, Worker routes, Tunnels and load balancers.

What Ace can changeCopy Anchor Link

Ace proposes these actions once an admin turns on Allow Ace to run approved actions for the connection. Each one needs approval by default, and earned autonomy can let some of them run under an Automatic policy for a workload and environment you confirm. Others always need a person. See Actions and approvals.

Cloudflare can't report a token's edit permissions, so Settings lists each action as Shows when it runs: needs <permission>, and a missing permission shows up when Cloudflare refuses the change.

What opens an incidentCopy Anchor Link

Notifications reach Ace through a webhook destination as they fire, and one opens an incident only when a workload routes Cloudflare. To route it, open the workload's settings, turn on Integration alerts under Investigation triggers, and check Cloudflare under Alert sources.

These notification types open an incident, or join the one already open on the workload:

The notification's end event, or a healthy status in it, resolves the incident. Load balancer pools and origins resolve separately.

These join an open incident as evidence and never open one:

• Cloudflare platform incidents (incident_alert).
• Custom certificate expiration for hostnames and zones.
• A load balancing pool being enabled or disabled.
• Maintenance notifications.

Universal, dedicated and custom SSL certificate events go to the change timeline. Ace drops every other notification type.

Ace also polls Cloudflare, so new failures still open incidents if a notification goes missing. Account changes from the audit log and Worker deployments go to the change timeline.

If you list zones by name, Ace drops notifications from other zones. A list of zone IDs can't filter them, because health check notifications name their zone, not its ID.

Before you startCopy Anchor Link

• The admin role in Ace. See Roles and permissions.
• Permission to create API tokens for the Cloudflare account.
• The right Cloudflare plan and products for the notifications you want. Error-rate alerts need an Enterprise zone, and health check alerts need Pro or above. Others need Passive Origin Monitoring, Load Balancing, Advanced Certificate Manager or Cloudflare Tunnel. Ace subscribes only to notifications your account has.

Credentials and permissionsCopy Anchor Link

Ace uses one custom API token, limited to this account and its zones.

Set upCopy Anchor Link

1. Create the API tokenCopy Anchor Link

1. In Ace, open Settings > Data sources and choose Cloudflare. Enter your Account ID, then select Create key next to API token. Cloudflare's token page opens with a custom token named Ace and the six required read permissions added.
2. Add the optional read rows you want. Add Account: Notifications Edit if Ace should wire alerts.
3. Add edit rows only for the actions Ace may take after approval.
4. Under Account Resources, include only this account. Under Zone Resources, include the zones you'll list in Ace, or all zones of the account.
5. Optionally set a TTL. Select Continue to summary, then Create Token, and copy the token.

2. Connect Cloudflare in AceCopy Anchor Link

1. Fill in the form:
   • Account ID: the 32-character ID. On Account home, open Search (Cmd/Ctrl+K) and choose Copy account ID. You can also copy Account ID under Account Details on the Workers & Pages page.
   • API token: the token you copied.
   • Zones (optional): zone names or IDs, comma-separated. Use names if Ace wires alerts.
2. Select Connect Cloudflare. Ace saves only if the token passes validation.

3. Wire alertsCopy Anchor Link

If the token has Notifications Edit, Ace creates a webhook destination, attaches the health check, load balancing, Tunnel, SSL, error-rate and Cloudflare incident notifications your account has, and reports what it set up in the Alerts section. Ace never changes your own notifications, and it rechecks its setup hourly and removes it when you disconnect.

To wire alerts yourself, select Show manual setup in the Alerts section:

1. Copy the webhook URL.
2. Select Generate token and copy the token. Ace shows it once.
3. In Cloudflare, open Notifications > Destinations, add a webhook with the URL, and paste the token as its Secret. Cloudflare sends it in the cf-webhook-auth header of every notification.
4. Create the notifications that should open incidents, such as Health Checks, Load Balancing Health, Tunnel Health, SSL and Origin Error Rate, and send them to this webhook.

4. Optional: allow actionsCopy Anchor Link

1. On the connected Cloudflare page, turn on Allow Ace to run approved actions.
2. For automatic actions, select a workload, enter its environment (default production), and select Confirm.

Confirm it's workingCopy Anchor Link

• The connection shows Connected once Ace verifies that the token can read your zones, analytics, DNS, audit logs and Workers.
• The Alerts section shows Waiting for first event until Ace accepts a notification, then Verified.

DisconnectCopy Anchor Link

1. In Ace, open Settings > Data sources > Cloudflare and select Disconnect. Ace removes its notifications and webhook destination, and if it can't, it tells you so you can remove ace-<id> in Cloudflare yourself.
2. In Cloudflare, delete the API token.

Next stepsCopy Anchor Link

• Actions and approvals
• Operating rules
• All integrations