release: 5.4.0

[stainless-app]

Automated Release PR

5.4.0 (2026-06-16)

Full Changelog: v5.3.0...v5.4.0

Features

• ai_gateway: add custom_providers sub-resource (b982ff3)
• ct_alerter: add CT alerting subscription endpoints (client.zones.ct.alerting) (5bb529c)
• d1: add fields parameter to client.d1.database.get (2b0e738)
• flagship: add flagship resource with apps, flags, changelog, and evaluate endpoints (2b0e738)
• magic_transit: add cf1_sites sub-resource with ramps, and ipsec_tunnels.psk_set method (5d8e422)
• origin_tls_compliance_modes: add origin_tls_compliance_modes resource (2b0e738)
• ssl: add auto_origin_tls_kex sub-resource (2b0e738)
• tenants: add tenants top-level resource and user.tenants sub-resource (7677b4c)
• zero_trust: add DLP sensitivity_groups, data_tag_categories, and data_classes sub-resources (2b0e738)
• zero_trust: add tunnels.warp_connector.configurations sub-resource (2b0e738)

Bug Fixes

• iam: OAuthScopeListResponse type import path moved from cloudflare.types.iam.oauth_scopes to cloudflare.types.iam (2b0e738)

Chores

• api: update composite API spec (2b0e738)

New Resources

Tenants (client.tenants)

• get(tenant_id) -> Tenant
• tenants.account_types.list(tenant_id) -> SyncSinglePage[AccountTypeListResponse]
• tenants.accounts.list(tenant_id) -> SyncSinglePage[TenantAccount]
• tenants.entitlements.get(tenant_id) -> TenantEntitlements
• tenants.memberships.list(tenant_id) -> SyncSinglePage[TenantMembership]

New types:

from cloudflare.types.tenants import (
    Tenant,
    AccountTypeListResponse,
    TenantAccount,
    TenantEntitlements,
    TenantMembership,
)

Flagship (client.flagship)

• flagship.apps.create(*, account_id, **params) -> AppCreateResponse
• flagship.apps.update(app_id, *, account_id, **params) -> AppUpdateResponse
• flagship.apps.list(*, account_id) -> SyncSinglePage[AppListResponse]
• flagship.apps.delete(app_id, *, account_id) -> AppDeleteResponse
• flagship.apps.get(app_id, *, account_id) -> AppGetResponse
• flagship.apps.flags.create(app_id, *, account_id, **params) -> FlagCreateResponse
• flagship.apps.flags.update(flag_key, *, account_id, app_id, **params) -> FlagUpdateResponse
• flagship.apps.flags.list(app_id, *, account_id, **params) -> SyncCursorPaginationAfter[FlagListResponse]
• flagship.apps.flags.delete(flag_key, *, account_id, app_id) -> FlagDeleteResponse
• flagship.apps.flags.get(flag_key, *, account_id, app_id) -> FlagGetResponse
• flagship.apps.flags.changelog.list(flag_key, *, account_id, app_id, **params) -> SyncCursorPaginationAfter[ChangelogListResponse]
• flagship.apps.evaluate.get(app_id, *, account_id, **params) -> EvaluateGetResponse

New types:

from cloudflare.types.flagship import (
    AppCreateResponse,
    AppUpdateResponse,
    AppListResponse,
    AppDeleteResponse,
    AppGetResponse,
)
from cloudflare.types.flagship.apps import (
    FlagCreateResponse,
    FlagUpdateResponse,
    FlagListResponse,
    FlagDeleteResponse,
    FlagGetResponse,
    EvaluateGetResponse,
)
from cloudflare.types.flagship.apps.flags import ChangelogListResponse

Origin TLS Compliance Modes (client.origin_tls_compliance_modes)

• update(*, zone_id, **params) -> Optional[OriginTLSComplianceModeUpdateResponse]
• delete(*, zone_id) -> Optional[OriginTLSComplianceModeDeleteResponse]
• edit(*, zone_id, **params) -> Optional[OriginTLSComplianceModeEditResponse]
• get(*, zone_id) -> Optional[OriginTLSComplianceModeGetResponse]

New types:

from cloudflare.types.origin_tls_compliance_modes import (
    OriginTLSComplianceModeUpdateResponse,
    OriginTLSComplianceModeDeleteResponse,
    OriginTLSComplianceModeEditResponse,
    OriginTLSComplianceModeGetResponse,
)

New Sub-Resources on Existing Resources

AI Gateway - Custom Providers (client.ai_gateway.custom_providers)

• create(*, account_id, **params) -> CustomProviderCreateResponse
• list(*, account_id, **params) -> SyncV4PagePaginationArray[CustomProviderListResponse]
• delete(id, *, account_id) -> CustomProviderDeleteResponse
• get(id, *, account_id) -> CustomProviderGetResponse

New types:

from cloudflare.types.ai_gateway import (
    CustomProviderCreateResponse,
    CustomProviderListResponse,
    CustomProviderDeleteResponse,
    CustomProviderGetResponse,
)

Magic Transit - CF1 Sites (client.magic_transit.cf1_sites)

• create(*, account_id, **params) -> SyncSinglePage[Cf1Site]
• update(cf1_site_id, *, account_id, **params) -> Cf1Site
• list(*, account_id) -> SyncSinglePage[Cf1Site]
• delete(cf1_site_id, *, account_id) -> Cf1Site
• get(cf1_site_id, *, account_id) -> Cf1Site
• cf1_sites.ramps.create(cf1_site_id, *, account_id, **params) -> SyncSinglePage[Ramp]
• cf1_sites.ramps.list(cf1_site_id, *, account_id) -> SyncSinglePage[Ramp]
• cf1_sites.ramps.delete(ramp_id, *, account_id, cf1_site_id) -> Ramp
• cf1_sites.ramps.get(ramp_id, *, account_id, cf1_site_id) -> Ramp

New types:

from cloudflare.types.magic_transit import Cf1Site
from cloudflare.types.magic_transit.cf1_sites import Ramp

Magic Transit - IPsec Tunnels PSK Set (client.magic_transit.ipsec_tunnels)

• psk_set(*, account_id, **params) -> IPSECTunnelPSKSetResponse

New types:

from cloudflare.types.magic_transit import IPSECTunnelPSKSetResponse

SSL - Auto Origin TLS Kex (client.ssl.auto_origin_tls_kex)

• edit(*, zone_id, **params) -> AutoOriginTLSKexEditResponse
• get(*, zone_id) -> AutoOriginTLSKexGetResponse

New types:

from cloudflare.types.ssl import AutoOriginTLSKexEditResponse, AutoOriginTLSKexGetResponse

Zones - CT Alerting (client.zones.ct.alerting)

• edit(*, zone_id, **params) -> Optional[AlertingEditResponse]
• get(*, zone_id) -> Optional[AlertingGetResponse]

New types:

from cloudflare.types.zones.ct import AlertingEditResponse, AlertingGetResponse

User - Tenants (client.user.tenants)

• list() -> SyncSinglePage[Organization]

Zero Trust - DLP Sensitivity Groups (client.zero_trust.dlp.sensitivity_groups)

• create(*, account_id, **params) -> Optional[SensitivityGroupCreateResponse]
• update(sensitivity_group_id, *, account_id, **params) -> Optional[SensitivityGroupUpdateResponse]
• list(*, account_id) -> SyncSinglePage[SensitivityGroupListResponse]
• delete(sensitivity_group_id, *, account_id) -> object
• get(sensitivity_group_id, *, account_id) -> Optional[SensitivityGroupGetResponse]
• sensitivity_groups.levels.create(...) / update(...) / list(...) / delete(...) / get(...)
• sensitivity_groups.levels.order.update(...) / get(...)

Zero Trust - DLP Data Tag Categories (client.zero_trust.dlp.data_tag_categories)

• create(*, account_id, **params) -> Optional[DataTagCategoryCreateResponse]
• update(category_id, *, account_id, **params) -> Optional[DataTagCategoryUpdateResponse]
• list(*, account_id) -> SyncSinglePage[DataTagCategoryListResponse]
• delete(category_id, *, account_id) -> object
• get(category_id, *, account_id) -> Optional[DataTagCategoryGetResponse]
• data_tag_categories.data_tags.create(...) / update(...) / list(...) / delete(...) / get(...)

Zero Trust - DLP Data Classes (client.zero_trust.dlp.data_classes)

• create(*, account_id, **params) -> Optional[DataClassCreateResponse]
• update(data_class_id, *, account_id, **params) -> Optional[DataClassUpdateResponse]
• list(*, account_id) -> SyncSinglePage[DataClassListResponse]
• delete(data_class_id, *, account_id) -> object
• get(data_class_id, *, account_id) -> Optional[DataClassGetResponse]

Zero Trust - WARP Connector Configurations (client.zero_trust.tunnels.warp_connector.configurations)

• update(tunnel_id, *, account_id, **params) -> Optional[ConfigurationUpdateResponse]
• get(tunnel_id, *, account_id) -> Optional[ConfigurationGetResponse]

New types:

from cloudflare.types.zero_trust.tunnels.warp_connector import (
    ConfigurationUpdateResponse,
    ConfigurationGetResponse,
)

Updated Methods

D1 - Database Get

client.d1.database.get now accepts an optional fields parameter to select which fields to include in the response.

# Before (still works)
db = client.d1.database.get(database_id, account_id="...")

# New: select specific fields
db = client.d1.database.get(database_id, account_id="...", fields=["name", "uuid", "file_size"])

IAM - OAuth Scopes

client.iam.oauth_scopes module was flattened from a sub-package to a single module. The OAuthScopeListResponse type import path changed:

# Before
from cloudflare.types.iam.oauth_scopes import OAuthScopeListResponse

# After
from cloudflare.types.iam import OAuthScopeListResponse

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

[stainless-app]

🤖 Release is at https://github.com/cloudflare/cloudflare-python/releases/tag/v5.4.0 🌻