Cloudflare lab — API checks and log evidence

When John asks to check lab configuration, policy usage or logs, perform the checks directly through the API. Do not require screenshots for facts available through the API. Screenshots are supplementary evidence for dashboard layout or controls that the API cannot expose.

Connection and authentication

Account ID: 82a960d52c7dbc20c84c4cb5145879dd. Team: unparalleled-quarterback. Helpers on kelp: /home/john/cloudflare/verify/common.py expose ACCOUNT_ID, get_token(), api_get(path) and get_client(). Token file: ~/.lab_ai_token in netrc format, machine api.cloudflare.com. Use its password as a Bearer token; passing this file to curl --netrc-file sends Basic authentication and fails. Never print the token.

REST base: https://api.cloudflare.com/client/v4. If sandbox DNS/network access fails, request execution outside the sandbox rather than interpreting the failure as invalid credentials.

Read configuration

GET /user/tokens/verify — verify token status.
GET /accounts/{account_id}/gateway/rules — policy IDs, names, enabled status, action, filters, precedence, traffic expressions, rule_settings and update times.
GET /accounts/{account_id}/gateway/lists — reusable hostname lists; read list items if needed.
GET /accounts/{account_id}/gateway/configuration — TLS decryption, antivirus, certificate binding and other traffic settings.
GET /accounts/{account_id}/gateway/logging — logging settings; log_all=true means all traffic is logged even when log_blocks=false.

Query logs and policy usage

POST a read-only GraphQL query to https://api.cloudflare.com/client/v4/graphql. Scope viewer.accounts with filter accountTag=ACCOUNT_ID. Obtain current fields through GraphQL introspection when necessary; the account log dimension type is AccountGatewayL7RequestsAdaptiveGroupsDimensions.

query {
  viewer {
    accounts(filter: {accountTag: "82a960d52c7dbc20c84c4cb5145879dd"}) {
      gatewayL7RequestsAdaptiveGroups(
        limit: 100
        filter: {datetime_geq: "2026-09-28T00:00:00Z", datetime_leq: "2026-10-01T23:59:59Z"}
      ) {
        count
        dimensions { action ruleId }
      }
    }
  }
}

Replace the example dates with the relevant live window. Join ruleId to IDs from gateway/rules to report named policy counts. First query usage grouped by action and ruleId, without a hostname filter. Then inspect matching traffic by policy or test hostname, adding dimensions datetime, httpHost, email, dstIpCountry, isIsolated and untrustedCertificateAction as needed. Check GraphQL errors and result limits; subdivide the window or narrow the filter if limits are reached. Match the dashboard period when comparing counts and state the queried period.

For DNS logs use gatewayResolverQueriesAdaptiveGroups with dimensions datetime, queryName, resolverDecision, policyId and policyName. Filter queryName_in for exact test domains when useful. An empty result is absence of evidence within the queried window/filter, not proof that a test was never done.

Interpreting evidence

Separate saved configuration, observed enforcement, and completion of the guide's specific tests.
Check all relevant rule usage before asserting there is no enforcement. A test-domain-only query misses genuine matches from other traffic.
Compare event times against rule creation/update times. Allowed events before a correction do not show that the current rule fails.
Read the actual lab guide and current API state. The handover can be stale; John confirmed Lab 15 is next.
Do not claim a named dashboard option exists just because the guide names it. DNS Rebinding is absent from the shown category list and current checked documentation; its intended implementation remains a guide clarification.
Inspection requests authorize read-only checks. Make configuration changes only when requested.

Verified snapshot — 1 October 2026

API queried September 28–October 1: all four HTTP block policies enabled. Content Categories: 24 blocked requests; Countries: 11; Executable Downloads: 122; no matching block group returned for Security Categories. These counts matched John's dashboard. The earlier narrow query missed country and executable enforcement.

DNS-filtering is disabled for HTTP exercises and contains security/content categories, countries AF/IR/RU joined with OR, and DNS Tunneling. Russian Federation was saved as RU at 10:28:28 UTC. Internal DNS resolver policy remains enabled. Re-enable DNS filtering at 16.1.

Outstanding at this snapshot: Untrusted certificate HTTP policy (14.4; Action=Allow, Untrusted certificate action=Block), Domain Isolation hostname list containing dlptest.com, and All-HTTP-Domain-Isolate policy (14.6; copy/paste/printing/uploads blocked, downloads allowed). Test isolation in 14.7. Specific malware security-category block still unverified. No Lab 14 test-host HTTP records were returned after September 30 23:10 UTC in the checked window.