Lists

import { Render } from "~/components";

With Cloudflare One, you can create lists of URLs, hostnames, or other entries to reference when creating Gateway policies or Access policies. This allows you to quickly create rules that match and take actions against several items at once.

Before creating a list, make note of the limitations.

:::note The lists described in this page are not the same as custom lists defined at the account level. The two types of lists support different data types and have different validation rules. :::

List types

Lists can contain a single type of data each. Supported data types include:

• URLs
• Hostnames or domains
• Serial numbers
• User email addresses
• IP addresses
• Device ID numbers
• AAGUIDs (used by Access independent MFA to restrict the WebAuthn authenticators users can enroll)

Edit a list

1. In the Lists page, locate the list you want to edit.

2. Select Edit. This will allow you to:

   • Edit list name and description by selecting on the three-dots menu to the right of your list's name.
   • Delete the list by selecting the three-dots menu to the right of your list's name.
   • Delete individual entries.
   • Manually add entries to your list.

3. Once you have edited your list, select Save.

Limitations

List size

Your lists can include up to 1,000 entries for Standard plans and 5,000 for Enterprise plans. An uploaded CSV file must be smaller than 2 MB.

Wildcard entries

Hostname lists do not support wildcard entries (*.example.com). You will need to add domains as exact matches. Adding a wildcard to lists comprised of hostnames will return an error when you save.

Non-Latin characters

Gateway supports non-Latin characters by converting all domains and hostnames to Punycode. Once you save a list with non-Latin characters, Gateway will display the entry as Punycode.

Duplicate entries

Lists cannot have duplicate entries. Because domains and hostnames are converted to Punycode, multiple list entries that convert to the same string will count as duplicates. For example, éxàmple.com converts to xn—xmple-rqa5d.com, so including both éxàmple.com and xn—xmple-rqa5d.com in a list will result in a duplicate error.

URL slashes

Extended email addresses

API rate limit

You can send 600 requests to the Gateway Lists endpoint per minute. If you exceed the rate limit, Cloudflare will block subsequent requests for 120 seconds.