id: cloudflare
name: Cloudflare
version: 1.0.0
description: "Cloudflare (client API v4) — network containment at the edge: list zones, block/unblock IPs (firewall access rules), list access rules, and manage DNS records (list/create/delete). API-token (Bearer) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get zones, block IP, list/delete access rules, list/create/delete DNS records."
category: network

# Per-instance configuration. The API token is sent as 'Authorization: Bearer <api_token>'.
config_schema:
  properties:
    api_token:
      type: string
      description: "Cloudflare API token (scoped to the needed zones/permissions)"
      x-soar-sensitive: true
  required:
    - api_token

commands:
  - id: list_zones
    name: cloudflare-list-zones
    description: "List zones (domains) in the account."
    risk: read
    inputs_schema:
      properties:
        name: { type: string, description: "Optional zone name filter" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_zone
    name: cloudflare-get-zone
    description: "Get a single zone by ID."
    risk: read
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
      required: [zone_id]
    outputs_schema: { properties: {} }
  - id: block_ip
    name: cloudflare-block-ip
    description: "Create a firewall access rule to block (or challenge) an IP, range, ASN, or country."
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
        value: { type: string, description: "IP, CIDR, ASN (AS####), or 2-letter country code" }
        target: { type: string, description: "ip, ip_range, asn, or country (default ip)" }
        mode: { type: string, description: "block, challenge, js_challenge, or whitelist (default block)" }
        notes: { type: string, description: "Optional note" }
      required: [zone_id, value]
    outputs_schema: { properties: {} }
  - id: list_access_rules
    name: cloudflare-list-access-rules
    description: "List firewall access rules for a zone."
    risk: read
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
      required: [zone_id]
    outputs_schema: { properties: {} }
  - id: delete_access_rule
    name: cloudflare-delete-access-rule
    description: "Delete a firewall access rule (unblock)."
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
        rule_id: { type: string, description: "Access rule ID" }
      required: [zone_id, rule_id]
    outputs_schema: { properties: {} }
  - id: list_dns_records
    name: cloudflare-list-dns-records
    description: "List DNS records for a zone."
    risk: read
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
        record_type: { type: string, description: "Optional record type filter (A, AAAA, CNAME, TXT, ...)" }
        name: { type: string, description: "Optional record name filter" }
      required: [zone_id]
    outputs_schema: { properties: {} }
  - id: create_dns_record
    name: cloudflare-create-dns-record
    description: "Create a DNS record (e.g. sinkhole a malicious host)."
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
        record_type: { type: string, description: "Record type (A, AAAA, CNAME, TXT, ...)" }
        name: { type: string, description: "Record name" }
        content: { type: string, description: "Record content (IP or target)" }
        ttl: { type: number, description: "TTL seconds (1 = automatic, default 1)" }
        proxied: { type: boolean, description: "Proxy through Cloudflare (default false)" }
      required: [zone_id, record_type, name, content]
    outputs_schema: { properties: {} }
  - id: delete_dns_record
    name: cloudflare-delete-dns-record
    description: "Delete a DNS record."
    inputs_schema:
      properties:
        zone_id: { type: string, description: "Zone ID" }
        record_id: { type: string, description: "DNS record ID" }
      required: [zone_id, record_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: cloudflare-test-connection
    description: "Verify the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }