Skip to main content

Cloudflare Analytics

Cloudflare Analytics exposes traffic, security, and performance metrics for your Cloudflare zones and account through the GraphQL Analytics API. This connector pulls HTTP traffic totals, firewall/WAF events, and Web Analytics (RUM) page-load metrics for a zone. It uses Cloudflare's GraphQL endpoint at api.cloudflare.com/client/v4/graphql; the legacy REST analytics endpoints are end-of-life and are not supported.

Cloudflare Analytics icon

Power end-to-end data operations for your Cloudflare Analytics API with Nexla. Our bi-directional Cloudflare Analytics connector is purpose-built for Cloudflare Analytics, making it simple to ingest data, sync it across systems, and deliver it anywhere — all with no coding required. Nexla turns API-sourced data into ready-to-use, reusable data products and makes it easy to send data to Cloudflare Analytics or any other destination. With comprehensive monitoring, lineage tracking, and access controls, Nexla keeps your Cloudflare Analytics workflows fast, secure, and fully governed.

Features

Type: API

SourceDestination

  • Seamless API Integration: Connect to any endpoint as source or destination without coding, with automatic data product creation
  • Visual Composition & Chaining: Build complex integrations using visual templates, chain API calls, and compose workflows with data validation and filtering
  • API Proxy: Expose curated slices of your data securely with a secure and customizable API proxy that validates and transforms data on the fly
  • Request optimization with intelligent batching, retry, and caching to minimize API calls and costs

Prerequisites​

Before creating a Cloudflare Analytics credential, you need a scoped Cloudflare API Token with read access to the Analytics API, along with the Zone ID and Account ID for the domain you want to report on. Cloudflare's GraphQL Analytics API authenticates with a Bearer token sent in the Authorization header on every request.

To create an API token with Analytics read access, follow these steps:

  1. Sign in to the Cloudflare dashboard with an account that has permission to manage API tokens.

  2. Navigate to My Profile > API Tokens for a user-owned token, or Manage Account > API Tokens for an account-owned token.

  3. Click Create Token, then select Get started under Create Custom Token (you can also start from a template and adjust it).

  4. Under Permissions, set the three dropdowns to grant read access to the Analytics API:

    • For account-scoped datasets such as Web Analytics (RUM), select Account, then Account Analytics, then Read.
    • For zone-scoped datasets such as HTTP requests and firewall events, add a permission row with Zone, then Analytics, then Read.

  5. Under Zone Resources, select the specific zone (or all zones in an account) that the token should be able to read.

  6. Optionally configure Client IP Address Filtering and a TTL (start/end validity dates) to further restrict the token, then click Continue to summary.

  7. Review the configuration on the API Token Summary page, then click Create Token.

  8. Copy the token value and store it securely. Cloudflare displays the token only once and it cannot be retrieved again after you leave the page.

To obtain the identifiers used by the connector:

  • Zone ID: Open the target domain in the Cloudflare dashboard and copy the 32-character Zone ID from the zone's Overview page (right-hand sidebar under API).

  • Account ID: On the same Overview page, copy the 32-character Account ID shown alongside the Zone ID. This is required for account-scoped datasets such as RUM page-load events.

If your API token is compromised, revoke it from the same API Tokens page in the Cloudflare dashboard and issue a new one. For complete details on token permissions and the Analytics API, see the Cloudflare Analytics API token documentation and the GraphQL Analytics API overview.

Authenticate​

Credentials required​

FieldRequiredSecretDescription
API TokenYesYesScoped API Token from Cloudflare dashboard > My Profile > API Tokens (needs Zone > Analytics > Read). Sent as Authorization: Bearer <token>.
Zone IDYesNoThe 32-character Zone Identifier (zoneTag) for the domain, found on the zone's Overview page. Used by zone-scoped datasets (HTTP requests, firewall events).
Account IDYesNoThe 32-character Account Identifier, from the account Overview page. Required for account-scoped datasets like RUM pageload events.

Create a credential in Nexla​

  1. After selecting the data source type, click the Add Credential tile to open the Add New Credential overlay.

  2. Enter a name for the credential in the Credential Name field and a short, meaningful description in the Credential Description field.

  3. Enter your Cloudflare API Token in the API Token field. Nexla sends this token as Authorization: Bearer <token> on every request and validates it against Cloudflare's token verification endpoint. This value is stored securely and should be kept confidential.

  4. Enter the 32-character Zone ID for your domain in the Zone ID field. This identifies the zone for zone-scoped datasets such as HTTP requests and firewall events.

  5. Enter the 32-character Account ID in the Account ID field. This is required for account-scoped datasets such as Web Analytics (RUM) page-load events.

  6. Click the Save button at the bottom of the overlay. The newly added credential will now appear in a tile on the Authenticate screen during data source creation.

Use as a data source​

To create a new data flow, navigate to the Integrate section, and click the New Data Flow button. Select the Cloudflare Analytics connector tile, then select the credential that will be used to connect to Cloudflare, and click Next; or, create a new Cloudflare Analytics credential for use in this flow.

Endpoint templates​

Nexla provides pre-built templates that can be used to rapidly configure data sources to ingest data from common Cloudflare GraphQL Analytics datasets. Select the endpoint from which this source will fetch data from the Endpoint pulldown menu. Available endpoint templates are listed in the expandable boxes below.

Each Cloudflare Analytics dataset requires a reporting-window filter. Provide the Since and Until values described in each template below; the GraphQL Analytics API rejects queries on these datasets without a date or datetime range.

HTTP Requests (Daily Totals)

This endpoint template retrieves daily aggregated HTTP request counts, bandwidth, threats, and page views for the zone via the httpRequests1dGroups GraphQL dataset. Use this template for zone-level traffic reporting and trend analysis.

  • Enter Since (date) as the start of the reporting window in ISO-8601 date format (for example, 2026-07-01). This maps to the API's date_geq filter and is required.
  • Enter Until (date) as the end of the reporting window in ISO-8601 date format (for example, 2026-07-15). This maps to the API's date_leq filter and is required.

Results are scoped to the zone identified by the Zone ID in your credential and are returned in daily buckets, most recent first. Each record includes summed metrics (requests, bytes, threats, page views) and unique visitor counts.

For details on this dataset and its available fields, see the Cloudflare end-customer analytics tutorial.

Firewall Events (Adaptive)

This endpoint template retrieves recent WAF/firewall events for the zone via the firewallEventsAdaptive GraphQL dataset, including the action taken, client IP, ASN, country, request path/query, and timestamp. Use this template for security monitoring and threat analysis.

  • Enter Since (datetime) as the start of the reporting window in ISO-8601 UTC datetime format (for example, 2026-07-14T00:00:00Z). This maps to the API's datetime_gt filter and is required.
  • Enter Until (datetime) as the end of the reporting window in ISO-8601 UTC datetime format (for example, 2026-07-15T00:00:00Z). This maps to the API's datetime_lt filter and is required.

Results are scoped to the zone identified by the Zone ID in your credential and are returned most recent first. Firewall event retention on the Adaptive dataset is limited, so keep reporting windows within Cloudflare's supported range for your plan.

For details on this dataset and its available fields, see the Cloudflare end-customer analytics tutorial.

Web Analytics Page Load Events (RUM)

This endpoint template retrieves Real User Monitoring (RUM) page-load events via the rumPageloadEventsAdaptiveGroups GraphQL dataset, grouped by minute, country, device type, and browser. This dataset is account-scoped and uses the Account ID from your credential.

  • Enter Since (datetime) as the start of the reporting window in ISO-8601 UTC datetime format (for example, 2026-07-14T00:00:00Z). This maps to the API's datetime_gt filter and is required.
  • Enter Until (datetime) as the end of the reporting window in ISO-8601 UTC datetime format (for example, 2026-07-15T00:00:00Z). This maps to the API's datetime_lt filter and is required.

Because this dataset is account-scoped, your credential must include a valid Account ID and the API token must carry Account Analytics > Read permission. Available RUM dimensions and metrics vary by plan and are best-effort.

For details on exploring available datasets and fields, see the Cloudflare GraphQL schema documentation.

Once the selected endpoint template has been configured, click the Test button to the right of the endpoint selection menu to retrieve a sample of the data that will be fetched. Sample data will be displayed in the Endpoint Test Result panel on the right, allowing you to verify that the source is configured correctly before saving.

Manual configuration​

Cloudflare Analytics data sources can also be manually configured to query any valid Cloudflare GraphQL Analytics dataset, including datasets not covered by the pre-built templates, custom field selections, or additional filters. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, endpoint URL, request body, date/time macros, path to data, and request headers.

Cloudflare's Analytics API is a single GraphQL endpoint at https://api.cloudflare.com/client/v4/graphql. Queries are sent as POST requests with a JSON body containing your GraphQL query, and every dataset requires a date or datetime filter.

Once all of the relevant settings have been configured, click the Create button in the upper right corner of the screen to save and create the new Cloudflare Analytics data source. Nexla will now begin ingesting data from the configured dataset and will organize any data that it finds into one or more Nexsets.