ST-2026-144 · API endpoints & versions
Cloudflare retires CIDR route endpoints and removes Tunnel connections from list and get responses
On 5 October 2026, Cloudflare removes CIDR-encoded Zero Trust route endpoints and the connections array from Cloudflare Tunnel and Mesh list and get responses.
Previous state
Route create, update and delete calls could encode the CIDR in the URL, and tunnel or mesh list/get responses included a connections array.
Current state
Routes use standard route_id endpoints and connection detail must be fetched from dedicated per-tunnel connections endpoints.
Affected users
Who needs to care
API clients, dashboards and automation managing private routes or parsing Cloudflare Tunnel and Mesh connection details.
Required response
What to do
Migrate route operations to route_id endpoints and query the dedicated connections endpoint before 5 October 2026.
Evidence boundary
What the source does not prove
The API shape changes do not remove existing routes or tunnels, and Cloudflare says cloudflared and its Terraform provider do not read the removed connections field.
Lifecycle history
Dated event sequence
- Breaking changes announced
Cloudflare published the endpoint and response-field retirement plan.
- Old contracts removed
CIDR route endpoints and embedded connections arrays stop being available.
Evidence ledger
First-party sources
- 01Cloudflare Developers — Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring
Official API lifecycle changelog · 2026-07-09
Open official source ↗ - 02Cloudflare Developers — API deprecations
Official deprecation register · 2026-07-09
Open official source ↗