Sign inConnect your agent
infochanged

Cloudflare One, Access - Simplified permissions for tagging targets with Access for Infrastructure

Announced
Tags
Cloudflare-One, Access
Severity
info, set by reef/rss-rule-v1
Source
https://developers.cloudflare.com/changelog/post/2026-10-01-infrastructure-target-tag-permissions/

<p>You can now tag <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets">targets</a> using only the <code>Zero Trust Write</code> API token permission. Previously, tagging targets through the API required both <code>Zero Trust Write</code> and <code>Tag Write</code> permissions on the API token.</p> <p>This change applies to inline target tagging through the <a href="https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/">Infrastructure Access Targets API</a>. Tagging resources through the general <a href="https://developers.cloudflare.com/resource-tagging/">Resource Tagging API</a> still requires the <code>Tag Admin</code>, <code>Tag Write</code>, or equivalent role.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets">Tag targets</a>.</p>

The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.