How to list - and delete - all Cloudflare IP access rules via curl

2026 May 22

Let's say you have nearly ten thousand IP access rules in your Cloudflare account. How can you clear these out?

There's not really a great way to do this in the Cloudflare dash. You could delete them one by one, Homer Simpson drinking bird style.

Or you can use the Cloudflare API via curl and do it programatically.

First, you'll need to create a Cloudflare API key.

Get the list

First we need a list of all the existing IP access rules. I hit rate limits trying to get my whole list, but 1000 at a time worked fine. You can use the page parameter with per_page=1000 to get them in batches.

curl "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/firewall/access_rules/rules?page=1&per_page=1000" \
-X GET \
--header "Content-Type: application/json" \
--header "Authorization: Bearer YOUR_API_KEY" > out1.txt

This will save the output to a file named out1.txt. Do the same for out2.txt, out3.txt and so on. You can then stitch all of them together:

cat out*.txt >> out.txt

Open the resulting out.txt in your text editor. You'll need to pick out the rule id for each IP address:

{
  "result": [
    {
      "id": "63d75299fd354ae88e6eaf774329c51a", 👈👈
      "paused": false,
      "modified_on": "2026-05-21T03:10:43.994772Z",
      "allowed_modes": [
        "whitelist",
        "block",
        "challenge",
        "js_challenge",
        "managed_challenge"
      ],
      "mode": "block",
      "notes": "my comment about this rule",
      "configuration": {
        "target": "ip",
        "value": "123.45.67.89"
      },
      "scope": {
        "id": "MY_ZONE_ID",
        "name": "mysite.com",
        "type": "zone"
      },
      "created_on": "2026-05-21T03:10:43.996731401Z"
    },
[...]

It's a little tricky, because the rule id is labeled the same as the zone ("scope") id, but you can do it like this:

Find:

[
    {
      "id":

Then multi-select all of the values in your editor. Gotta say, Sublime Text is very fast at dealing with large files.

Move your cursor(s) to the id value, select it using ⇧ Shift + ⌥ Option + → , copy that selection, and paste it into a new file:

f6d664c6a8b242e3892f352bc654dd8e
486dd5a170104f7d82cabf90cc7c0272
58d9463b21c44089996ca2ab88d5bea6
2019912a83d6457e82efffc03a85d3a0
ec41abccf45e4457a71e050b3e47130e
bb9b716014f2443bb14eda14ec2d8f97
520d3822a5fd417faf054d8ee0981c76
e9be66b5434b47d692609ccb62cc0424
be941877a69c453e88fe401ea71c0151
69a96926516a4020b2ffc61502f4dbbe
a9817728977045adb7da0e0b3c9944c9
f42c32389e6a44a3ac71620493ca2e3f
[...]

Name it ids.txt and save it.

Delete all

Create a new file named delete-all-ips.sh and paste the following:

# loop through a text file and insert as $fn
# run: bash ./delete-all-ips.sh
while read -r fn; do
    curl "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/firewall/access_rules/rules/$fn" \
    -X DELETE \
    --header "Authorization: Bearer YOUR_API_KEY"
done < ids.txt

Then you can run the script:

bash ./delete-all-ips.sh

If that doesn't work, you may need to make it executable:

chmod +x delete-all-ips.sh

The script will begin looping through the list, and for each request you should get a response from the Cloudflare API:

{
  "result": {
    "id": "f6d664c6a8b242e3892f352bc654dd8e"
  },
  "success": true,
  "errors": [],
  "messages": []
}

What else?

I think that's it! Happy mass IP access rule deletion.