---
title: "GET /api/v2/secret-rotations/cloudflare-r2-access-key"
method: GET
path: "/api/v2/secret-rotations/cloudflare-r2-access-key"
tags: ["Secret Rotations"]
---

# GET /api/v2/secret-rotations/cloudflare-r2-access-key

`GET /api/v2/secret-rotations/cloudflare-r2-access-key`

List the Cloudflare R2 Access Key Rotations for the specified project.

## Query parameters

- `projectId` string, required

## Response `200`

Default Response

- object
  - `secretRotations` object[], required
    - `id` string, uuid, required
    - `name` string, required
    - `description` string, nullable
    - `isAutoRotationEnabled` boolean
    - `activeIndex` number
    - `folderId` string, uuid, required
    - `connectionId` string, uuid, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `rotationInterval` number, required
    - `rotationStatus` string, required
    - `lastRotationAttemptedAt` string, date-time, required
    - `lastRotatedAt` string, date-time, required
    - `lastRotationJobId` string, nullable
    - `nextRotationAt` string, date-time, nullable
    - `isLastRotationManual` boolean
    - `connection` object, required
      - `app` 'cloudflare', required
      - `name` string, required
      - `id` string, uuid, required
    - `environment` object, required
      - `slug` string, required
      - `name` string, required
      - `id` string, uuid, required
    - `projectId` string, required
    - `folder` object, required
      - `id` string, required
      - `path` string, required
    - `rotateAtUtc` object, required
      - `hours` number, required
      - `minutes` number, required
    - `lastRotationMessage` string, nullable
    - `type` 'cloudflare-r2-access-key', required
    - `parameters` object, required
      - `name` string, required — The name for the generated Cloudflare API token that backs the R2 access key.
      - `buckets` object[], required — The R2 buckets the generated access key is scoped to. Each entry is a bucket name plus its jurisdiction (default, eu, or fedramp).
        - `name` string, required
        - `jurisdiction` 'default' | 'eu' | 'fedramp'
      - `accessLevel` 'object-read' | 'object-read-write' — The level of access the generated key has over the selected buckets (object-read for read and list, object-read-write to also write).
      - `allowedIps` string[] — The IP addresses or CIDR blocks the generated R2 access key is restricted to.
      - `disallowedIps` string[] — The IP addresses or CIDR blocks the generated R2 access key is denied from.
    - `secretsMapping` object, required
      - `accessKeyId` string, required — The name of the secret that the rotated R2 access key ID will be mapped to.
      - `secretAccessKey` string, required — The name of the secret that the rotated R2 secret access key will be mapped to.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)