Cloudflare Developers•2w ago

DNS Update records with CURL

Hey... Can anyone help me achieve the goal to update the an existent DNS record using a curl command? I have tried so many things already without success.

curl -s \
    -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
    -H "Content-Type: application/json" \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    --data "{
                "type": "A",
                "name": "$DNS_RECORD_NAME",
                "content": "$CURRENT_IP",
                "ttl": 1,
                "proxied": false"
                }"

curl -s \
    -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
    -H "Content-Type: application/json" \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    --data "{
                "type": "A",
                "name": "$DNS_RECORD_NAME",
                "content": "$CURRENT_IP",
                "ttl": 1,
                "proxied": false"
                }"

ZONE_ID = information shown inside my zone domain, overview, under API DNS_RECORD_ID = record ID that I want to change EMAIL = email API_KEY = created a aoi token with DNS:edit permitions DNS_RECORD_NAME = subdomain.domain.tld CURRENT_IP = IP to put in the record Error i'm getting:

{"success":false,"errors":[{"code":10001,"message":"Unable to authenticate request"}]}

{"success":false,"errors":[{"code":10001,"message":"Unable to authenticate request"}]}

Any hints?

28 Replies

Cyb3r-Jak3•2w ago

As you are using an API token, that auth header should be --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" where $CLOUDFLARE_API_TOKEN has the same value as $CLOUDFLARE_API_KEY. You don't need the other X-Auth headers

abacaoOP•2w ago

Hey @Cyb3r-Jak3 , thanks for the help but using either PATCH or PUT methods, I'm getting the same error

curl  \
      -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
      -d "{
        type: A,
        name: $DNS_RECORD_NAME,
        content: 1.1.1.1,
        ttl: 10,
        proxied: false
      }"

curl  \
      -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
      -d "{
        type: A,
        name: $DNS_RECORD_NAME,
        content: 1.1.1.1,
        ttl: 10,
        proxied: false
      }"

{"success":false,"errors":[{"code":10000,"message":"PUT method not allowed for the api_token authentication scheme"}]} anyone has any hint what can be the issue?

abacaoOP•2w ago

The token in use has the following permissions

abacaoOP•2w ago

@Cyb3r-Jok3 documentation states the need of auth-email and auth-key https://developers.cloudflare.com/api/resources/dns/subresources/records/methods/edit/

Cloudflare API | DNS › Records › Update DNS Record

Interact with Cloudflare's products and services via the Cloudflare API

Cyb3r-Jak3•2w ago

The docs don’t correctly show that you can use either. Token docs: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ Global Auth: https://developers.cloudflare.com/fundamentals/api/get-started/keys/

Cloudflare Docs

Create API token · Cloudflare Fundamentals docs

Learn how to create a token to perform actions using the Cloudflare API.

Cloudflare Docs

Get Global API key (legacy) · Cloudflare Fundamentals docs

Global API key is the previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API key.

abacaoOP•2w ago

I'm sorry but I've tested exactly that. There must be something wrong with my account. I have tried the API Token and the Global API key. Both deliver errors. I have recreated the tokens without any changes on the output of the commands

curl  \
-X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
-d "{
    "type:" "A",
    "name:" "$DNS_RECORD_NAME",
    "content:" "1.1.1.1",
    "ttl:" "10",
    "proxied:" "false"
    }"

curl  \
-X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
-d "{
    "type:" "A",
    "name:" "$DNS_RECORD_NAME",
    "content:" "1.1.1.1",
    "ttl:" "10",
    "proxied:" "false"
    }"

{"success":false,"errors":[{"code":10000,"message":"PATCH method not allowed for the api_token authentication scheme"}]}

curl  \
-X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
-H "Content-Type: application/json" \
-H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
-H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
-d "{
    "type:" "A",
    "name:" "$DNS_RECORD_NAME",
    "content:" "1.1.1.1",
    "ttl:" "10",
    "proxied:" "false"
   }"

curl  \
-X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
-H "Content-Type: application/json" \
-H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
-H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
-d "{
    "type:" "A",
    "name:" "$DNS_RECORD_NAME",
    "content:" "1.1.1.1",
    "ttl:" "10",
    "proxied:" "false"
   }"

{"success":false,"errors":[{"code":10001,"message":"Unable to authenticate request"}]}

Chaika•2w ago

Double check all your IDs

{"success":false,"errors":[{"code":10001,"message":"Unable to authenticate request"}]}

is possible to get if your zone id isn't actually a zone id

{"success":false,"errors":[{"code":10000,"message":"PATCH method not allowed for the api_token authentication scheme"}]}

in general w/ api keys indictates something's messed with your path (I know, very confusingly)

abacaoOP•2w ago

I did... I can use the same information to other CURLS such as

Chaika•2w ago

Your Zone ID is on the right side of the zone overview page (not in your url path) good idea to throw on -vvv and see the path being requested

abacaoOP•2w ago

I'm getting my zone in the overview page and by running this

curl -s \
    -X GET "https://api.cloudflare.com/client/v4/zones?name=$ZONE_NAME&status=active" \
    -H "Content-Type: application/json" \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
    | jq -r '{"result"}[] | .[0] | .id'

curl -s \
    -X GET "https://api.cloudflare.com/client/v4/zones?name=$ZONE_NAME&status=active" \
    -H "Content-Type: application/json" \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
    | jq -r '{"result"}[] | .[0] | .id'

the dns record i want to update with this

curl -s \
        -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?type=A&name=$DNS_RECORD_NAME"  \
        -H "Content-Type: application/json" \
        -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
        -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
   | jq .

curl -s \
        -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?type=A&name=$DNS_RECORD_NAME"  \
        -H "Content-Type: application/json" \
        -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
        -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
   | jq .

when I run the update record:

curl -s \
            -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
          -H "Content-Type: application/json" \
          -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
          -H "Authorization: Bearer $CLOUDFLARE_API_KEY" 
            -d "{
           "type:" "A",
           "name:" "$DNS_RECORD_NAME",
           "content:" "1.1.1.1",
           "ttl:" "10",
           "proxied:" "false"
         }"

curl -s \
            -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
          -H "Content-Type: application/json" \
          -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
          -H "Authorization: Bearer $CLOUDFLARE_API_KEY" 
            -d "{
           "type:" "A",
           "name:" "$DNS_RECORD_NAME",
           "content:" "1.1.1.1",
           "ttl:" "10",
           "proxied:" "false"
         }"

{"success":false,"errors":[{"code":10000,"message":"PATCH method not allowed for the api_token authentication scheme"}]}

Chaika•2w ago

You need either X-Auth-Email and X-Auth-Key when using the Global API Key OR Authorization: Bearer .... when using API Tokens I'd add more logging there to see the $Zone_ID and $DNS_Record_ID as well could also just hardcode the zone id just to test/skip one part that could be causing issues

abacaoOP•2w ago

curl -s \
            -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
          -H "Content-Type: application/json" \
          -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
            -d "{
           "type:" "A",
           "name:" "$DNS_RECORD_NAME",
           "content:" "1.1.1.1",
           "ttl:" "10",
           "proxied:" "false"
         }"

curl -s \
            -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID" \
          -H "Content-Type: application/json" \
          -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \
            -d "{
           "type:" "A",
           "name:" "$DNS_RECORD_NAME",
           "content:" "1.1.1.1",
           "ttl:" "10",
           "proxied:" "false"
         }"

like this? error: {"success":false,"errors":[{"code":10000,"message":"PATCH method not allowed for the api_token authentication scheme"}]}

Chaika•2w ago

yea that's better but looks like your path is still messed up, would echo zone id/record id

abacaoOP•2w ago

I already did that without success

abacaoOP•2w ago

I'm going crazy in the terminal, both values are CURLed from the API with the following headers

        -H "Content-Type: application/json" \
        -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
        -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \

        -H "Content-Type: application/json" \
        -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
        -H "Authorization: Bearer $CLOUDFLARE_API_KEY" \

is I use the same headers rather than the ones in the image

{"result":null,"success":false,"errors":[{"code":9207,"message":"Request body is invalid."}],"messages":[]}%

{"result":null,"success":false,"errors":[{"code":9207,"message":"Request body is invalid."}],"messages":[]}%

abacaoOP•2w ago

Chaika•2w ago

Still doing the thing where X-auth-Email is unnecessary there

abacaoOP•2w ago

{"result":null,"success":false,"errors":[{"code":9207,"message":"Request body is invalid."}],"messages":[]}%

Chaika•2w ago

you have the semicolons inside of the quotes lol

abacaoOP•2w ago

the documentation in here: https://developers.cloudflare.com/api/resources/dns/subresources/records/methods/edit/ says

curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID \
    -X PATCH \
    -H 'Content-Type: application/json' \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    -d '{
      "comment": "Domain verification record",
      "content": "198.51.100.4",
      "name": "example.com",
      "proxied": true,
      "ttl": 3600,
      "type": "A"
    }'

curl https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/$DNS_RECORD_ID \
    -X PATCH \
    -H 'Content-Type: application/json' \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    -d '{
      "comment": "Domain verification record",
      "content": "198.51.100.4",
      "name": "example.com",
      "proxied": true,
      "ttl": 3600,
      "type": "A"
    }'

Cloudflare API | DNS › Records › Update DNS Record

Interact with Cloudflare's products and services via the Cloudflare API

Chaika•2w ago

if you're getting invalid body you're getting closer, but need to fix your body: - Remove the semicolons from inside of the quotes - Make ttl/proxied into a int and bool, not a string - TTL needs to be 60s or higher for free something like

{
  "type": "A",
  "name": "$DNS_RECORD_NAME",
  "content": "1.1.1.1",
  "ttl": 60,
  "proxied": false
}

{
  "type": "A",
  "name": "$DNS_RECORD_NAME",
  "content": "1.1.1.1",
  "ttl": 60,
  "proxied": false
}

abacaoOP•2w ago

ufff.. thank you for the help... This worked

abacaoOP•2w ago

the only thing that didnt was the name

abacaoOP•2w ago

Shouldn't the documentation in here (https://developers.cloudflare.com/api/resources/dns/subresources/records/methods/edit/) be updated just to have the Authorizaton bearer header?

Cloudflare API | DNS › Records › Update DNS Record

Interact with Cloudflare's products and services via the Cloudflare API

Chaika•2w ago

it's more of a preference thing, both the global api key and api tokens will work, but yea api tokens are preferred

Chaika•2w ago

some of the docs are slowly being updated to prefer it, but each team maintains their own schema, so a fair bit of a mess

abacaoOP•2w ago

thanks for both your help @Chaika @Cyb3r-Jok3 I have found the documentation on Cloudflare assets a bit behind or confusing

Gaming

Programming

DNS Update records with CURL

Did you find this page helpful?