> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect Rootly AI to Cloudflare — DNS, Workers, Zero Trust, audit logs, Radar, CASB, Logpush, and more — via a single one-click authorization.

## Overview

Cloudflare is a one-click connector that gives Rootly AI read access to your Cloudflare account across **fourteen surfaces** — from core Cloudflare (DNS, Workers, Zero Trust) through Cloudflare's observability and security products. Sign in once through Cloudflare's authorization screen and every enabled surface is available to Rootly AI during investigations.

Because it's one-click, there are no configuration forms to fill in — Rootly AI queries whatever the authorizing Cloudflare user has permission to see.

<Note>
  You do not need to enable every surface. Cloudflare gates each product behind its own permissions — Rootly AI will only be able to read from surfaces the connecting user (and your Cloudflare plan) actually has access to.
</Note>

***

## Before You Start

* **A Cloudflare account** with permission to authorize third-party OAuth apps.
* **Roles on the surfaces you want available.** The connecting Cloudflare user's account roles determine what Rootly AI can see — e.g., without CASB permissions the Cloudflare CASB surface won't return data even though the connector is technically enabled.

***

## Setup

Open **Configuration → AI → Connectors** and click **Connect** on the Cloudflare card. Sign in to Cloudflare and authorize Rootly AI. When the flow completes, the card flips to **Connected** and Rootly AI can query every surface your Cloudflare account exposes.

***

## Surfaces Rootly AI Can Read

Cloudflare exposes fourteen distinct surfaces through this connector. Each one gives Rootly AI a different kind of context during an investigation.

### Infrastructure

| Surface               | What Rootly AI reads                             |
| --------------------- | ------------------------------------------------ |
| **Cloudflare** (core) | DNS records, Workers, Zero Trust posture         |
| **Workers Bindings**  | Storage bindings, AI bindings, compute resources |
| **Workers Builds**    | Build history, insights, deploy management       |
| **Containers**        | Sandboxes, dev environments, isolation posture   |
| **Browser**           | Rendering, screenshots, browser automation state |

### Observability & security

| Surface                           | What Rootly AI reads                                   |
| --------------------------------- | ------------------------------------------------------ |
| **Cloudflare Observability**      | Logs, analytics, debugging traces                      |
| **DNS Analytics**                 | DNS query volume, performance, troubleshooting signals |
| **Audit Logs**                    | Change tracking, admin activity, compliance reports    |
| **Radar**                         | Traffic insights, trends, URL scans                    |
| **CASB**                          | SaaS security posture, misconfigurations, compliance   |
| **Logpush**                       | Log pipeline job health and summaries                  |
| **AI Gateway**                    | AI ops analytics, gateway metrics                      |
| **Digital Experience Monitoring** | DEX scores, user experience monitoring                 |
| **GraphQL Analytics**             | GraphQL queries and analytics                          |

<Tip>
  You don't need to memorize the list — Rootly AI picks the right surface based on the question. Asking *"why is our DNS slow?"* pulls from DNS Analytics + Radar automatically.
</Tip>

***

## Best Practices

* **Authorize with an account that already has broad Cloudflare permissions.** Rootly AI can only see what the connecting user can see. A restricted user makes the connector superficially "Connected" but starves the underlying queries.
* **Use it alongside a code and observability connector.** Cloudflare tells you what's happening at the edge; pairing it with GitHub (for recent deploys) and Datadog / Sentry (for the origin) makes for much stronger investigations.
* **Prefer Radar for organization-wide traffic questions.** For customer-specific traffic, Cloudflare Observability and DNS Analytics give better fidelity.
* **Rotate the connection if a Cloudflare admin's permissions change.** Disconnect and reconnect with the new user's account so Rootly AI sees the updated scope.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Some Cloudflare surfaces return no data even though the card shows Connected" icon="key">
    Cloudflare gates each surface behind its own product permission (CASB, Zero Trust, Radar Business, etc.). If the connecting user's Cloudflare account doesn't have access to a surface — either by role or by plan tier — Rootly AI can't read from it either. Grant the user access on the Cloudflare side, then disconnect and reconnect so the OAuth grant refreshes.
  </Accordion>

  <Accordion title="Rootly AI cites the wrong Cloudflare zone" icon="triangle-exclamation">
    Confirm the connecting user has access to the zone in question. Multi-zone Cloudflare accounts route by permission, so a user restricted to one zone will only surface data from that zone.
  </Accordion>

  <Accordion title="Disconnected on the Cloudflare side" icon="plug-circle-xmark">
    If a Cloudflare admin revokes the OAuth grant from Cloudflare's side, Rootly AI's card still shows Connected but every query fails. Reconnect from Rootly to re-authorize.
  </Accordion>
</AccordionGroup>

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Do I have to connect each Cloudflare surface individually?" icon="link">
    No. A single Cloudflare OAuth authorization covers all fourteen surfaces. Which surfaces actually return data depends on the connecting user's Cloudflare permissions and your plan.
  </Accordion>

  <Accordion title="Does Rootly AI store Cloudflare data?" icon="floppy-disk">
    Rootly does not maintain a persistent copy of Cloudflare data — queries run at investigation time and the response is used in reasoning only. Query results *do* appear in the LLM traces Rootly logs for quality monitoring, as with every tool call Rootly AI makes. See [Data Privacy for Rootly AI](/ai/data-privacy-for-rootly-ai) for the retention boundary.
  </Accordion>

  <Accordion title="Can I limit which Cloudflare surfaces Rootly AI can read from?" icon="lock">
    Yes — indirectly, through the connecting user's Cloudflare roles. Rootly AI cannot read a surface that the authorizing user doesn't have access to in Cloudflare.
  </Accordion>

  <Accordion title="Does the Cloudflare connector cover Cloudflare Pages?" icon="file-code">
    Not directly today. The current fourteen surfaces cover DNS, Workers, Zero Trust, and Cloudflare's observability + security products. Ask support if Pages coverage is on your roadmap.
  </Accordion>
</AccordionGroup>

***

## Related Pages

<CardGroup cols={3}>
  <Card title="Connectors Overview" icon="sparkles" href="/ai/connectors/overview">
    All connectors and how they fit together.
  </Card>

  <Card title="AWS" icon="server" href="/ai/connectors/aws">
    The other infrastructure connector.
  </Card>

  <Card title="Data Privacy for Rootly AI" icon="shield" href="/ai/data-privacy-for-rootly-ai">
    What Rootly AI sees, retention, and model training controls.
  </Card>
</CardGroup>