API MonitoringUpdated July 2026

Cloudflare API Monitoring Guide 2026

How to monitor the Cloudflare API in production — status tracking, rate limit handling, error decoding, and automated alerts for Workers, R2, DNS, and Workers AI / AI Gateway.

TL;DR

→Cloudflare has an official status page at cloudflarestatus.com — it covers the CDN, DNS, Workers, R2, and Workers AI separately
→The core management API is capped at 1,200 requests / 5 minutes per token — bulk DNS scripts hit this fast
→429 errors mean you hit the global limit or a Workers AI per-model limit; 403/9109 means a token permission is missing, not an outage
→AI Gateway can front Workers AI and external providers (OpenAI, Anthropic) through one OpenAI-compatible endpoint with built-in caching and logging

Why Cloudflare API Monitoring Matters

Cloudflare sits in front of a large share of the internet — DNS, CDN, WAF, and increasingly compute (Workers) and AI inference (Workers AI, AI Gateway). Because so much infrastructure depends on Cloudflare, teams often assume "if Cloudflare is down, everyone will know" and skip independent monitoring. In practice, most Cloudflare-related incidents that hit your app are narrower than a full platform outage:

✗A DNS propagation delay or a bad zone change breaks resolution for your domain specifically
✗Your CI/CD pipeline's Terraform apply starts throwing 429s because it fired 1,500 API calls in one run
✗Workers AI model availability changes or degrades while cloudflarestatus.com stays green
✗An expired or misconfigured API token silently breaks your automation with 403s that look like an outage

Independent monitoring catches these zone- and account-specific failures that Cloudflare's own status page — which reports platform-wide health, not your configuration — will never show.

📡

Recommended

Monitor your services before your users notice

Try Better Stack Free →

Where to Check Cloudflare API Status

Cloudflare maintains a single consolidated status page with per-component breakdowns:

Cloudflare Status Page

cloudflarestatus.com

Covers: CDN/proxy, DNS, Workers, R2, D1, Workers AI, AI Gateway, dashboard, and the management API — tracked as separate components

✓ Official — Cloudflare posts incidents and maintenance windows with per-region breakdowns✗ Only reflects Cloudflare-side issues, not your zone config or origin server

Cloudflare Dashboard

dash.cloudflare.com

Covers: Your account-specific health — Security Events, Workers logs, API token usage

✓ Shows issues specific to your zones and tokens before they show up as a platform incident✗ Requires login; not a public real-time incident feed

API Status Check

apistatuscheck.com/api/cloudflare

Covers: Cloudflare API real-time uptime + incident history + instant alerts

✓ Third-party monitoring with 60-second polling + email/Slack/webhook alerts✗ Third-party — synthesized from multiple signals

API Status Check — Cloudflare Monitoring

API Status Check tracks the Cloudflare API in real time with 60-second polling. See current status, uptime over the last 30/60/90 days, and subscribe to instant alerts when Cloudflare has an incident.

Check Cloudflare API status now →

Cloudflare API Rate Limits by Surface

Cloudflare enforces different rate limits depending on which API you're calling. The core management API and Workers AI are governed separately — hitting one limit doesn't affect the other.

Surface	Limit	Scope	Cost
Core REST API (api.cloudflare.com)	1,200 requests / 5 minutes	Per API token or user, across all zones	Included with every plan
Workers AI (free allocation)	~50-300 req/min (model-dependent)	Per account, per model	10,000 neurons/day free
Workers AI (paid)	Higher, model-dependent	Per account, per model	$0.011 per 1,000 neurons
AI Gateway	Passthrough to upstream provider	Per gateway, per provider	Free — adds caching + logging only

Production tip: The 1,200-requests-per-5-minutes limit is per token, not per zone. If you manage many zones with one automation token (Terraform, bulk DNS scripts), you can exhaust the limit fast. Split high-volume automation across multiple scoped tokens or batch record changes instead of looping one call per record.

Check current usage: Cloudflare doesn't expose a dashboard view of remaining API quota — track your own request count client-side or parse the X-RateLimit headers where present on the response.

Cloudflare API Error Codes: What They Mean

Cloudflare returns standard HTTP status codes plus a Cloudflare-specific numeric error code in the response body: { success: false, errors: [{ code, message }] }. Always read the numeric code — it disambiguates causes that share the same HTTP status.

400 Bad Request

Malformed request body, invalid zone identifier, or unsupported parameter combination

Check the errors array in the JSON response body — Cloudflare returns a specific error code and message (e.g., 1004, 9109) that maps to a documented cause.

401 Unauthorized / 10000

Missing, expired, or malformed API token/key

Verify CF_API_TOKEN is set and has not been revoked. Confirm the Authorization header uses "Bearer" for tokens or the legacy X-Auth-Email/X-Auth-Key pair for the older Global API Key.

403 Forbidden / 9109

Token lacks the required permission scope for this operation

Cloudflare API tokens are scoped per-permission (Zone.DNS, Zone.Zone, Workers Scripts, etc.). Check the token's permission groups in the dashboard and add the missing scope — do not default to the Global API Key as a workaround.

404 Not Found

Zone, record, or resource ID does not exist or is not accessible to this token

Verify the zone_id/account_id in the URL path. IDs are case-sensitive 32-character hex strings — a typo returns 404, not a 400.

429 Too Many Requests

Exceeded the 1,200 requests/5-minutes global limit or a Workers AI per-model limit

Implement exponential backoff and honor the Retry-After header. For bulk operations (mass DNS updates), batch changes into fewer API calls or use the batch DNS record endpoint instead of one call per record.

500 Internal Server Error

Cloudflare-side error, not caused by your request

Retry with backoff. If 500s persist across multiple unrelated endpoints, check cloudflarestatus.com — a platform-wide API issue is more likely than an isolated bug.

503 Service Unavailable

Cloudflare edge or API infrastructure temporarily overloaded or in maintenance

Retry with exponential backoff. This is also the response your origin sees if your own server is down and Cloudflare has no cached fallback configured.

1015 (edge rate limiting)

Cloudflare's own edge-level rate limiting blocked the request as a suspected bot/abuse pattern

This applies to requests hitting a Cloudflare-protected zone, not the management API. Whitelist your monitoring service's IP or user agent in the zone's WAF/rate-limiting rules if you see this on legitimate synthetic checks.

Implementing Retries for Cloudflare API Calls

Here's a production-ready pattern that distinguishes retryable errors (429, 500, 503) from configuration errors (401, 403) that retrying will never fix:

TypeScript (fetch)Production-ready

async function cfApiWithRetry(
  path: string,
  init: RequestInit = {},
  maxRetries = 4
): Promise<Response> {
  const url = `https://api.cloudflare.com/client/v4${path}`;

  for (let attempt = 0; attempt < maxRetries; attempt++) {
    const res = await fetch(url, {
      ...init,
      headers: {
        Authorization: `Bearer ${process.env.CF_API_TOKEN}`,
        'Content-Type': 'application/json',
        ...init.headers,
      },
    });

    const isRetryable = [429, 500, 502, 503].includes(res.status);
    if (res.ok || !isRetryable || attempt === maxRetries - 1) return res;

    const retryAfter = res.headers.get('retry-after');
    const delay = retryAfter
      ? parseInt(retryAfter, 10) * 1000
      : Math.pow(2, attempt) * 1000 + Math.random() * 500;

    await new Promise((r) => setTimeout(r, delay));
  }
  throw new Error('Max retries exceeded');
}

Python (requests)

import requests, time, random

def cf_api_with_retry(path, method="GET", json=None, max_retries=4):
    url = f"https://api.cloudflare.com/client/v4{path}"
    headers = {"Authorization": f"Bearer {CF_API_TOKEN}"}

    for attempt in range(max_retries):
        resp = requests.request(method, url, headers=headers, json=json)
        if resp.ok or resp.status_code not in (429, 500, 502, 503):
            return resp
        if attempt == max_retries - 1:
            resp.raise_for_status()
        delay = (2 ** attempt) + random.uniform(0, 1)
        time.sleep(delay)
    raise RuntimeError("Max retries exceeded")

Monitoring Workers AI and AI Gateway

Cloudflare's AI Gateway sits between your app and any AI provider (Workers AI, OpenAI, Anthropic, and others), adding caching, request logging, rate-limit smoothing, and automatic fallback routing — which changes what you need to monitor.

AI Gateway with fallback provider

// AI Gateway can front Workers AI + OpenAI-compatible providers
// through one endpoint, with automatic failover configured in the dashboard
const response = await fetch(
  'https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/workers-ai/@cf/meta/llama-3.3-70b-instruct',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.CF_API_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ messages: [{ role: 'user', content: 'hi' }] }),
  }
);

// AI Gateway logs every request (cached or not) in the dashboard —
// use this to distinguish a cache hit from a real upstream failure
const cacheStatus = response.headers.get('cf-aig-cache-status');

→Enable AI Gateway logging so a Workers AI model outage shows up as a distinct failure reason, not a generic 500
→Configure a fallback provider (e.g., OpenAI) in AI Gateway so Workers AI degradation doesn't take your app down
→Track cache hit rate — a sudden drop can mean your prompts changed, not that Cloudflare is degraded

Setting Up Cloudflare API Monitoring

A complete Cloudflare monitoring stack has three layers:

External uptime monitoring

Ping both your Cloudflare-proxied domain and the management API from outside your infrastructure — a proxy-layer issue and an API-layer issue require different responses.

→Monitor api.cloudflare.com/client/v4/user/tokens/verify (lightweight, confirms API + auth are both healthy)
→Separately monitor your own domain end-to-end to catch zone-specific breakage that the API check won't
→API Status Check does this automatically — subscribe to get alerts

Application-layer metrics

Track these metrics in your observability stack (Better Stack Logs, Datadog, Grafana):

• 429 rate on the management API — rising trend means your automation needs to batch calls or spread tokens
• Workers AI error rate by model — model-specific degradation won't show on cloudflarestatus.com until it's widespread
• AI Gateway cache hit rate — drops indicate prompt drift or upstream provider issues
• DNS propagation lag — time between an API record update and the change resolving publicly

Token-scoped automation health

Because Cloudflare tokens are permission-scoped, a token that used to work can start failing after a permission change elsewhere in the account. Verify token health separately from platform status:

// Cheapest possible health + auth check — verifies token validity
// without touching zones, DNS, or Workers AI quota
curl -s -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  https://api.cloudflare.com/client/v4/user/tokens/verify

# 200 = token valid + API healthy, 401 = token issue, 403 = scope issue

Alert Pro

14-day free trial

Stop checking — get alerted instantly

Next time Cloudflare goes down, you'll know in under 60 seconds — not when your users start complaining.

Email alerts for Cloudflare + 9 more APIs
$0 due today for trial
Cancel anytime — $9/mo after trial

Start Free Trial →Compare all plans →

Also recommended:

Better Stack — all-in-one monitoring 1Password — secure your API keys

Cloudflare API Production Best Practices

Use scoped tokens, not the Global API Key

Create narrowly-scoped API tokens per automation (e.g., Zone.DNS only for a DNS sync script). This limits blast radius and makes 403 errors immediately diagnostic instead of ambiguous.

Batch DNS record changes

Looping one API call per DNS record burns through the 1,200-per-5-minutes limit fast on large zones. Use the batch DNS endpoint or the Terraform provider, which batches automatically.

Separate zone-health checks from API-health checks

Your domain being reachable and the management API being reachable are independent signals. Monitor both — a zone-specific WAF misconfiguration can take your site down while the API stays fully healthy.

Configure AI Gateway fallback providers

If you rely on Workers AI for production inference, configure a fallback provider (OpenAI, Anthropic) in AI Gateway so a Workers AI-specific degradation doesn't take down AI features entirely.

Cache read-heavy API calls

Zone settings and DNS records change infrequently. Cache GET responses client-side for a few minutes instead of re-fetching on every request — this keeps you well under the rate limit.

Alert on 403 spikes separately from 429/5xx

A sudden wave of 403s after a quiet period usually means a token permission was changed or revoked, not an outage. Route these to a different alert than availability incidents so on-call doesn't waste time checking cloudflarestatus.com.

Related Guides

Cloudflare Status Guide

Where to check Cloudflare status + what indicators mean

Is Cloudflare Down?

Real-time Cloudflare status + incident history

Is Cloudflare AI Down?

Workers AI and AI Gateway status troubleshooting

Is Cloudflare Workers Down?

Workers-specific outage troubleshooting

Groq API Monitoring Guide 2026

Rate limits, errors & GroqCloud status

LLM API Monitoring Guide 2026

Monitor OpenAI, Anthropic, Gemini & all AI APIs

Frequently Asked Questions

How do I check if the Cloudflare API is down?

Check the official Cloudflare status page at cloudflarestatus.com for real-time incident updates across the CDN, DNS, Workers, R2, and Workers AI. You can also use API Status Check at apistatuscheck.com/api/cloudflare to see current uptime, recent incidents, and subscribe to instant alerts when Cloudflare goes down.

What are the Cloudflare API rate limits?

The core Cloudflare REST API (api.cloudflare.com/client/v4) enforces a global limit of 1,200 requests per 5 minutes per user or API token. Workers AI has separate per-model rate limits (typically 50-300 requests per minute depending on the model, higher on paid Workers AI plans). AI Gateway itself does not add its own rate limit — it passes through to the underlying provider — but it does cache and log every request, which is useful for debugging 429s.

What does a Cloudflare API 429 error mean?

A 429 error from the Cloudflare API means you have exceeded the 1,200-requests-per-5-minutes global limit (or a Workers AI per-model limit). Check the Retry-After header and back off accordingly. High-volume automation (bulk DNS record updates, Terraform applies across many zones) is the most common trigger — batch changes or spread them out to avoid it.

Is Cloudflare Workers AI OpenAI-compatible?

Cloudflare AI Gateway supports an OpenAI-compatible endpoint that can proxy requests to Workers AI models as well as external providers like OpenAI and Anthropic through a single unified interface. This lets you route, cache, log, and set fallbacks across multiple AI providers using AI Gateway without changing your client SDK.

Why did my Cloudflare-proxied site go down but cloudflarestatus.com shows all green?

cloudflarestatus.com reports Cloudflare's own infrastructure health, not your origin server or your zone-specific configuration. A misconfigured WAF rule, an expired SSL certificate, a bad Page Rule, or your own origin server being down will all take your site offline while Cloudflare's platform status remains fully operational. Check your zone's Overview tab and Security Events log before assuming a platform-wide outage.

Staff Pick

📡 Monitor your APIs — know when they go down before your users do

Better Stack checks uptime every 30 seconds with instant Slack, email & SMS alerts. Free tier available.

Start Free →

Affiliate link — we may earn a commission at no extra cost to you