API reference

Apps

Apps (connections): a host and port behind a connector, published to people.

GETList applications
POSTCreate an application
GETGet an application
PATCHUpdate an application
DELETEDelete an application

List applications

GET/v0/tenants/{tenant_id}/connections

read-only token

Returns every application (connection) published in the workspace, with its target, hosting connectors and session controls. The list is not paginated (it is bounded by the plan's application limit).

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Responses

200 All applications.

application/json

itemsarray of Connectionrequired
items fields
- idstringrequired
  Application id.
- namestringrequired
  Technical name (lower-case slug of the name you gave, at most 40 characters). Never changes.
- display_namestringrequired
  The name people see. Change it with PATCH display_name.
- typestringrequired
  Application type. See Create an application for what each type needs.
  One of: rdp, ssh, vnc, http, https, tcp, db, smb, egress.
- hoststringrequired
  Target the connector reaches: host name or IP (for egress, the first host name).
- portintegerrequired
  Target port (445 for smb; for egress, the first port).
- connector_idstringrequired
  Primary hosting connector (= connector_ids[0]).
- connector_idsarray of stringrequired
  Every connector that hosts this application (1-5). Traffic fails over between them automatically.
- hostnamesarray of string
  egress only: the public host names devices send through the connector.
- portsarray of integer
  egress only: the ports.
- egressboolean
  egress only: always true.
- sharesarray of ConnectionSmbShare
  smb only.
  shares fields
  - sharestringrequired
    Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
  - pathstring | null
    Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
  - drive_letterstring | null
    Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
    Pattern ^[D-Z]$.
  - accessstring
    Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
    One of: rw, ro.
  - labelstring | null
    Optional display label, at most 60 characters.
  - uncstring
    Read only: the full \\server\share[\path] path.
- protection_profile_idstring | null
  smb only: the file protection profile applied in gateway mode.
- smb_modestring
  smb only: direct = Cloudraw Connect reaches the server and its own permissions decide; gateway = protected: every file goes through the Cloudraw file gateway (scanned, profile enforced) and devices get no direct path.
  One of: direct, gateway.
- share_policy_enforcedboolean
  smb only: true in gateway mode.
- service_accountobject
  smb only: the account the file gateway signs in with (set in the console).
  service_account fields
  - configuredbooleanrequired
  - usernamestring
  - domainstring | null
  - set_atstring (date-time)
- protectionobject | null
  smb in gateway mode: {ready, opens_in, missing[]} — what is still missing (service_account, gateway_path).
- share_checkobject | null
  smb in gateway mode: the latest share check {code, ok, at, stale}.
- files_securityobject | null
  smb only: open quarantine and blocked files in the last 24 hours.
- rdp_securitystring
  rdp only: security mode for browser sessions (any = negotiate).
  One of: any, nla, tls, rdp.
- rdp_domainstring | null
  rdp only: sign-in domain pre-filled in the browser portal (e.g. CONTOSO).
- access_groupsarray of string
  Legacy; access is granted by access rules (policy rules), not here.
- clientlessboolean | null
  Browser access is on (true). Same switch as delivery.portal.
- interceptstring
  The name devices use to reach the app: <name>.<id>.cloudraw for most types, the real server name for smb, the first host name for egress.
- statusobject
  status fields
  - phasestring
  - observed_atstring (date-time)
  - messagestring | null
- versionintegerrequired
  Increases on every change; send as If-Match on PATCH.
- created_by_integratorobject | null
  Set when an integrator (MSP) created the app on your behalf.
- deliveryobject
  How people open the app.
  delivery fields
  - clientboolean
    Cloudraw Connect.
  - portalboolean
    Browser portal (= clientless).
  - rbiboolean
  - onetime_rdpboolean
  - nativeboolean
    rdp only: "Open in Remote Desktop app" from the portal. Such sessions are not recorded.
- recordingobject
  recording fields
  - onboolean
  - requiredboolean
    People may not open the app without recording.
  - modestring | null
  - groupsarray of string
    Record only these groups; null = everyone.
  - browser_onlyboolean
    With recording on: every session goes through the recording gateway (rdp, ssh, vnc only); devices get no direct path.
  - noticeobject
    notice fields
    onboolean
    mandatoryboolean
    Always true: recorded sessions always show the notice.
    textstring
    customboolean
    default_textstring
- redirectionobject
  Clipboard / drive / device redirection switches for remote sessions.
  redirection fields
  - clipboard_inboolean
  - clipboard_outboolean
  - drivesboolean
  - printersboolean
  - audio_outboolean
  - micboolean
  - cameraboolean
  - usbboolean
- reauthobject
  Ask people to sign in again every N minutes (null = off).
  reauth fields
  - every_minutesinteger | null
    Range: 5–1440.
- posturearray of string
  Device posture requirements (ids, at most 20). Stored; see controls_enforcement.
- appfwobject
  Legacy per-app firewall field (stored only). Use allowed_apps.
  appfw fields
  - modestring
    One of: off, monitor, enforce.
  - allowarray of string
- redirection_rulesarray of ConnectionRedirectionRule
  redirection_rules fields
  - namestringrequired
    Rule name, 1-80 characters.
  - whenobjectrequired
    At least one condition. All given conditions must match.
    when fields
    groups_anyarray of string
    Group ids of this workspace.
    groups_nonearray of string
    Group ids of this workspace.
    people_anyarray of string
    Person ids of this workspace.
    countries_anyarray of string
    ISO country codes, e.g. IL.
    countries_nonearray of string
  - setobjectrequired
    At least one redirection switch to override when the rule matches.
    set fields
    clipboard_inboolean
    clipboard_outboolean
    drivesboolean
    printersboolean
    audio_outboolean
    micboolean
    cameraboolean
    usbboolean
- allowed_appsone of
- remote_appone of
  rdp only (absent for other types).
- gateway_onlyobject
  The app is reachable only through a Cloudraw gateway.
  gateway_only fields
  - onboolean
  - reasonstring | null
    One of: protected_file_server, recorded_browser_only, .
- guidesobject
  guides fields
  - appone of
  - allowed_appsone of
  - alertsone of
- iconobject | null
  The app's custom icon, if set in the console.
  icon fields
  - urlstring
    Relative to the workspace URL.
- browserobject | null
  With browser access on: whether the app can open in the browser now.
  browser fields
  - supportedboolean
  - readyboolean
  - errorstring | null
  - opensstring | null
    One of: remote_app, desktop, terminal, screen, .
- controls_enforcementobject
  Where each control is applied today: enforced, stored (saved, not applied yet) or partial:<where>.
  controls_enforcement fields
  - deliverystring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - recordingstring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - redirectionstring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - reauthstring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - posturestring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - appfwstring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
  - allowed_appsstring
    One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
next_pagenull
Always null: the list is not paginated.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "items": [
    {
      "id": "cx9m2v7d1pa",
      "name": "finance-terminal",
      "display_name": "Finance terminal",
      "type": "rdp",
      "host": "10.20.0.15",
      "port": 3389,
      "connector_id": "cn0r4w8t2kq",
      "connector_ids": [
        "cn0r4w8t2kq"
      ],
      "rdp_security": "any",
      "rdp_domain": null,
      "access_groups": [],
      "clientless": true,
      "intercept": "finance-terminal.q7x2m.cloudraw",
      "status": {
        "phase": "ready",
        "observed_at": "2026-10-13T09:24:11.000Z",
        "message": null
      },
      "version": 1,
      "created_by_integrator": null,
      "delivery": {
        "client": true,
        "portal": true,
        "rbi": false,
        "onetime_rdp": false,
        "native": false
      },
      "recording": {
        "on": false,
        "required": false,
        "mode": null,
        "notice": {
          "on": false,
          "mandatory": true,
          "text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later.",
          "custom": false,
          "default_text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later."
        }
      },
      "redirection": {
        "clipboard_in": true,
        "clipboard_out": false,
        "drives": false,
        "printers": false,
        "audio_out": true,
        "mic": false,
        "camera": false,
        "usb": false
      },
      "reauth": {
        "every_minutes": null
      },
      "posture": [],
      "appfw": {
        "mode": "off",
        "allow": []
      },
      "redirection_rules": [],
      "allowed_apps": null,
      "remote_app": null,
      "gateway_only": {
        "on": false,
        "reason": null
      },
      "guides": {
        "app": {
          "id": "app-remote-app",
          "section": null,
          "title": "Publish a remote desktop",
          "url": "https://cdapi.cloudraw.com/guides/app-remote-app",
          "pdf_url": null
        },
        "allowed_apps": {
          "id": "app-allowed-apps",
          "section": null,
          "title": "Allowed applications",
          "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
          "pdf_url": null
        },
        "alerts": {
          "id": "app-allowed-apps",
          "section": null,
          "title": "Allowed applications",
          "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
          "pdf_url": null
        }
      },
      "icon": null,
      "browser": {
        "supported": true,
        "ready": true,
        "error": null,
        "opens": "desktop"
      },
      "controls_enforcement": {
        "delivery": "stored",
        "recording": "partial:browser_sessions_only",
        "redirection": "partial:browser_sessions_only",
        "reauth": "stored",
        "posture": "stored",
        "appfw": "stored",
        "allowed_apps": "partial:client_min_version"
      }
    },
    {
      "id": "cx4k8d2m0sq",
      "name": "file-server",
      "display_name": "File server",
      "type": "smb",
      "host": "fs01.corp.example.local",
      "port": 445,
      "connector_id": "cn0r4w8t2kq",
      "connector_ids": [
        "cn0r4w8t2kq"
      ],
      "access_groups": [],
      "clientless": null,
      "intercept": "fs01.corp.example.local",
      "status": {
        "phase": "ready",
        "observed_at": "2026-10-13T09:24:11.000Z",
        "message": null
      },
      "version": 1,
      "created_by_integrator": null,
      "delivery": {
        "client": true,
        "portal": false,
        "rbi": false,
        "onetime_rdp": false,
        "native": false
      },
      "recording": {
        "on": false,
        "required": false,
        "mode": null,
        "notice": {
          "on": false,
          "mandatory": true,
          "text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later.",
          "custom": false,
          "default_text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later."
        }
      },
      "redirection": {
        "clipboard_in": true,
        "clipboard_out": false,
        "drives": false,
        "printers": false,
        "audio_out": true,
        "mic": false,
        "camera": false,
        "usb": false
      },
      "reauth": {
        "every_minutes": null
      },
      "posture": [],
      "appfw": {
        "mode": "off",
        "allow": []
      },
      "redirection_rules": [],
      "allowed_apps": null,
      "gateway_only": {
        "on": false,
        "reason": null
      },
      "guides": {
        "app": {
          "id": "app-smb",
          "section": null,
          "title": "Publish a file server",
          "url": "https://cdapi.cloudraw.com/guides/app-smb",
          "pdf_url": null
        },
        "allowed_apps": {
          "id": "app-allowed-apps",
          "section": null,
          "title": "Allowed applications",
          "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
          "pdf_url": null
        },
        "alerts": {
          "id": "app-allowed-apps",
          "section": null,
          "title": "Allowed applications",
          "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
          "pdf_url": null
        }
      },
      "icon": null,
      "browser": null,
      "controls_enforcement": {
        "delivery": "stored",
        "recording": "partial:browser_sessions_only",
        "redirection": "partial:browser_sessions_only",
        "reauth": "stored",
        "posture": "stored",
        "appfw": "stored",
        "allowed_apps": "partial:client_min_version"
      },
      "shares": [
        {
          "share": "Finance",
          "path": null,
          "drive_letter": "F",
          "access": "rw",
          "label": "Finance",
          "unc": "\\\\fs01.corp.example.local\\Finance"
        }
      ],
      "protection_profile_id": null,
      "smb_mode": "direct",
      "share_policy_enforced": false,
      "service_account": {
        "configured": false
      },
      "protection": null,
      "share_check": null,
      "files_security": null
    }
  ],
  "next_page": null
}

Create an application

POST/v0/tenants/{tenant_id}/connections

full-access tokenidempotent

Publishes an application through one or more of your connectors. Zero trust: a new application is reachable by no one until an access rule grants it. Recording, redirection and re-authentication start from the workspace session policy. Audited.

What each type needs: - **rdp, ssh, vnc, http, https, tcp, db** (and any other type label): name, host, port, connector_id. Devices reach it at intercept (<name>.<id>.cloudraw). Only rdp, ssh and vnc can also open in the browser (clientless: true). - RemoteApp: type: "rdp" plus remote_app: {program} — the session opens one program instead of the desktop. A plain program path needs a one-time setup command on the server (see remote_app.setup in the answer). - **smb** (Windows file server): name, host (server name), shares (1-20), connector_id; the port is always 445. One application per file server; devices keep using the real server name. smb_mode: "gateway" makes it a protected file server reached only through the Cloudraw file gateway. - **egress** (public website / SaaS that allow-lists your connector's public IP): name, hostnames (1-20), optional ports (default 443 and 80), connector_id; no host/port. The host names must resolve to public addresses.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key to retry safely — the same key and body within 24 h returns the first answer.

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Headers

Idempotency-Keystring
A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.
Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

namestringrequired
Display name, 1-80 characters, without < > " ' & \ or quote marks. Must not equal pn-<name>` of a private network.
typestringrequired
Application type. smb = Windows file server; egress = public website / SaaS reached from the connector's public IP; rdp, ssh, vnc can also open in the browser. Any other type is a plain TCP application on host:port.
One of: rdp, ssh, vnc, http, https, tcp, db, smb, egress.
hoststring
Required except for egress. Host name or IP the connector reaches. For smb: the file server name only (not a \\server\share path); devices keep using that real name.
portinteger
Required except for smb (always 445) and egress.
Range: 1–65535.
connector_idstringrequired
Required. Primary hosting connector.
connector_idsarray of string
Optional extra hosting connectors for failover (at most 5 in total, including connector_id).
hostnamesarray of string
egress only, required: 1-20 public host names (*.example.com wildcards allowed, scoped to a domain). They must resolve to public addresses; Cloudraw names are refused.
portsarray of integer
egress only: 1-10 ports, default [443, 80].
sharesarray of ConnectionSmbShare
smb only, required: 1-20 shares.
shares fields
- sharestringrequired
  Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
- pathstring | null
  Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
- drive_letterstring | null
  Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
  Pattern ^[D-Z]$.
- accessstring
  Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
  One of: rw, ro.
- labelstring | null
  Optional display label, at most 60 characters.
- uncstring
  Read only: the full \\server\share[\path] path.
smb_modestring
smb only. Default direct.
One of: direct, gateway.
protection_profile_idstring
smb only: an existing file protection profile id.
remote_appConnectionRemoteApp
RemoteApp: the remote desktop opens only this program instead of the full desktop (RDP apps only).
remote_app fields
- programstringrequired
  A RemoteApp alias already published on the server (||notepad) or a program path (max 260 characters, no line breaks or ").
- dirstring | null
  Working directory, at most 260 characters.
- argsstring | null
  Command-line arguments, at most 500 characters. With arguments, the server only allows exactly these.
- aliasstring
  Read only: the RemoteApp alias Cloudraw registers on the server for a plain program path.
- launches_asstring
  Read only: what the remote desktop session starts.
- icon_sourcestring
  Read only: which icon Cloudraw Connect shows.
  One of: custom, program.
- program_iconboolean
  Read only.
- feed_iconboolean
  Read only.
- setup_done_atstring | null (date-time)
  Read only: when the one-time server setup reported back (or was marked done).
- setupone of
clientlessboolean
Turn on browser access right away.

Responses

201 The new application.

application/json

idstringrequired
Application id.
namestringrequired
Technical name (lower-case slug of the name you gave, at most 40 characters). Never changes.
display_namestringrequired
The name people see. Change it with PATCH display_name.
typestringrequired
Application type. See Create an application for what each type needs.
One of: rdp, ssh, vnc, http, https, tcp, db, smb, egress.
hoststringrequired
Target the connector reaches: host name or IP (for egress, the first host name).
portintegerrequired
Target port (445 for smb; for egress, the first port).
connector_idstringrequired
Primary hosting connector (= connector_ids[0]).
connector_idsarray of stringrequired
Every connector that hosts this application (1-5). Traffic fails over between them automatically.
hostnamesarray of string
egress only: the public host names devices send through the connector.
portsarray of integer
egress only: the ports.
egressboolean
egress only: always true.
sharesarray of ConnectionSmbShare
smb only.
shares fields
- sharestringrequired
  Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
- pathstring | null
  Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
- drive_letterstring | null
  Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
  Pattern ^[D-Z]$.
- accessstring
  Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
  One of: rw, ro.
- labelstring | null
  Optional display label, at most 60 characters.
- uncstring
  Read only: the full \\server\share[\path] path.
protection_profile_idstring | null
smb only: the file protection profile applied in gateway mode.
smb_modestring
smb only: direct = Cloudraw Connect reaches the server and its own permissions decide; gateway = protected: every file goes through the Cloudraw file gateway (scanned, profile enforced) and devices get no direct path.
One of: direct, gateway.
share_policy_enforcedboolean
smb only: true in gateway mode.
service_accountobject
smb only: the account the file gateway signs in with (set in the console).
service_account fields
- configuredbooleanrequired
- usernamestring
- domainstring | null
- set_atstring (date-time)
protectionobject | null
smb in gateway mode: {ready, opens_in, missing[]} — what is still missing (service_account, gateway_path).
share_checkobject | null
smb in gateway mode: the latest share check {code, ok, at, stale}.
files_securityobject | null
smb only: open quarantine and blocked files in the last 24 hours.
rdp_securitystring
rdp only: security mode for browser sessions (any = negotiate).
One of: any, nla, tls, rdp.
rdp_domainstring | null
rdp only: sign-in domain pre-filled in the browser portal (e.g. CONTOSO).
access_groupsarray of string
Legacy; access is granted by access rules (policy rules), not here.
clientlessboolean | null
Browser access is on (true). Same switch as delivery.portal.
interceptstring
The name devices use to reach the app: <name>.<id>.cloudraw for most types, the real server name for smb, the first host name for egress.
statusobject
status fields
- phasestring
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_by_integratorobject | null
Set when an integrator (MSP) created the app on your behalf.
deliveryobject
How people open the app.
delivery fields
- clientboolean
  Cloudraw Connect.
- portalboolean
  Browser portal (= clientless).
- rbiboolean
- onetime_rdpboolean
- nativeboolean
  rdp only: "Open in Remote Desktop app" from the portal. Such sessions are not recorded.
recordingobject
recording fields
- onboolean
- requiredboolean
  People may not open the app without recording.
- modestring | null
- groupsarray of string
  Record only these groups; null = everyone.
- browser_onlyboolean
  With recording on: every session goes through the recording gateway (rdp, ssh, vnc only); devices get no direct path.
- noticeobject
  notice fields
  - onboolean
  - mandatoryboolean
    Always true: recorded sessions always show the notice.
  - textstring
  - customboolean
  - default_textstring
redirectionobject
Clipboard / drive / device redirection switches for remote sessions.
redirection fields
- clipboard_inboolean
- clipboard_outboolean
- drivesboolean
- printersboolean
- audio_outboolean
- micboolean
- cameraboolean
- usbboolean
reauthobject
Ask people to sign in again every N minutes (null = off).
reauth fields
- every_minutesinteger | null
  Range: 5–1440.
posturearray of string
Device posture requirements (ids, at most 20). Stored; see controls_enforcement.
appfwobject
Legacy per-app firewall field (stored only). Use allowed_apps.
appfw fields
- modestring
  One of: off, monitor, enforce.
- allowarray of string
redirection_rulesarray of ConnectionRedirectionRule
redirection_rules fields
- namestringrequired
  Rule name, 1-80 characters.
- whenobjectrequired
  At least one condition. All given conditions must match.
  when fields
  - groups_anyarray of string
    Group ids of this workspace.
  - groups_nonearray of string
    Group ids of this workspace.
  - people_anyarray of string
    Person ids of this workspace.
  - countries_anyarray of string
    ISO country codes, e.g. IL.
  - countries_nonearray of string
- setobjectrequired
  At least one redirection switch to override when the rule matches.
  set fields
  - clipboard_inboolean
  - clipboard_outboolean
  - drivesboolean
  - printersboolean
  - audio_outboolean
  - micboolean
  - cameraboolean
  - usbboolean
allowed_appsone of
remote_appone of
rdp only (absent for other types).
gateway_onlyobject
The app is reachable only through a Cloudraw gateway.
gateway_only fields
- onboolean
- reasonstring | null
  One of: protected_file_server, recorded_browser_only, .
guidesobject
guides fields
- appone of
- allowed_appsone of
- alertsone of
iconobject | null
The app's custom icon, if set in the console.
icon fields
- urlstring
  Relative to the workspace URL.
browserobject | null
With browser access on: whether the app can open in the browser now.
browser fields
- supportedboolean
- readyboolean
- errorstring | null
- opensstring | null
  One of: remote_app, desktop, terminal, screen, .
controls_enforcementobject
Where each control is applied today: enforced, stored (saved, not applied yet) or partial:<where>.
controls_enforcement fields
- deliverystring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- recordingstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- redirectionstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- reauthstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- posturestring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- appfwstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- allowed_appsstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.

400 invalid-name name-type-host-port-connector-id-required name-host-connector-id-required name-connector-id-required invalid-egress invalid-share invalid-smb-mode unknown-protection-profile-id unknown-connector-id too-many-connectors invalid-remote-app invalid-clientless

invalid-name: name is not 1-80 characters, without < > " ' & \` or quote marks.

name-type-host-port-connector-id-required: A field required for this type is missing (name, type, host, port, connector_id).

name-host-connector-id-required: smb: name, host or connector_id is missing.

name-connector-id-required: egress: name or connector_id is missing.

invalid-egress: egress: hostnames is empty, has more than 20 entries, an invalid or too broad wildcard, a Cloudraw name, a name that does not resolve or resolves to a private address; or ports is not 1-10 ports in 1-65535.

invalid-share: smb: host is not a server name / IPv4 address, or shares is invalid (count, name, sub-folder, drive letter D-Z, duplicate, access).

invalid-smb-mode: smb_mode is not direct or gateway.

unknown-protection-profile-id: protection_profile_id does not exist.

unknown-connector-id: connector_id or one of connector_ids does not exist or is being removed.

too-many-connectors: More than 5 hosting connectors.

invalid-remote-app: remote_app on a non-rdp type, or remote_app.program is empty, longer than 260 characters or has a line break / ".

invalid-clientless: clientless is not a boolean.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 connection-quota-reached insufficient-scope insufficient-role tenant-assertion-mismatch

connection-quota-reached: The workspace has reached its plan's application limit.

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

409 share-server-already-published name-conflicts-with-a-private-network idempotency-key-reuse

share-server-already-published: smb: this file server is already published; add the share to its shares instead.

name-conflicts-with-a-private-network: The name collides with a private network's internal name; choose another name.

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

502 provisioning-failed

provisioning-failed: The application could not be set up right now. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Finance terminal",
  "type": "rdp",
  "host": "10.20.0.15",
  "port": 3389,
  "connector_id": "cn0r4w8t2kq",
  "clientless": true
}'

PowerShell

$body = @'
{
  "name": "Finance terminal",
  "type": "rdp",
  "host": "10.20.0.15",
  "port": 3389,
  "connector_id": "cn0r4w8t2kq",
  "clientless": true
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
        "name": "Finance terminal",
        "type": "rdp",
        "host": "10.20.0.15",
        "port": 3389,
        "connector_id": "cn0r4w8t2kq",
        "clientless": True
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "Finance terminal",
    "type": "rdp",
    "host": "10.20.0.15",
    "port": 3389,
    "connector_id": "cn0r4w8t2kq",
    "clientless": true
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 201 · application/json

{
  "id": "cx9m2v7d1pa",
  "name": "finance-terminal",
  "display_name": "Finance terminal",
  "type": "rdp",
  "host": "10.20.0.15",
  "port": 3389,
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq"
  ],
  "rdp_security": "any",
  "rdp_domain": null,
  "access_groups": [],
  "clientless": true,
  "intercept": "finance-terminal.q7x2m.cloudraw",
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 1,
  "created_by_integrator": null,
  "delivery": {
    "client": true,
    "portal": true,
    "rbi": false,
    "onetime_rdp": false,
    "native": false
  },
  "recording": {
    "on": false,
    "required": false,
    "mode": null,
    "notice": {
      "on": false,
      "mandatory": true,
      "text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later.",
      "custom": false,
      "default_text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later."
    }
  },
  "redirection": {
    "clipboard_in": true,
    "clipboard_out": false,
    "drives": false,
    "printers": false,
    "audio_out": true,
    "mic": false,
    "camera": false,
    "usb": false
  },
  "reauth": {
    "every_minutes": null
  },
  "posture": [],
  "appfw": {
    "mode": "off",
    "allow": []
  },
  "redirection_rules": [],
  "allowed_apps": null,
  "remote_app": null,
  "gateway_only": {
    "on": false,
    "reason": null
  },
  "guides": {
    "app": {
      "id": "app-remote-app",
      "section": null,
      "title": "Publish a remote desktop",
      "url": "https://cdapi.cloudraw.com/guides/app-remote-app",
      "pdf_url": null
    },
    "allowed_apps": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    },
    "alerts": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    }
  },
  "icon": null,
  "browser": {
    "supported": true,
    "ready": true,
    "error": null,
    "opens": "desktop"
  },
  "controls_enforcement": {
    "delivery": "stored",
    "recording": "partial:browser_sessions_only",
    "redirection": "partial:browser_sessions_only",
    "reauth": "stored",
    "posture": "stored",
    "appfw": "stored",
    "allowed_apps": "partial:client_min_version"
  }
}

Get an application

GET/v0/tenants/{tenant_id}/connections/{connection_id}

read-only token

Returns one application (same shape as in the list). Handy for polling, for example until a RemoteApp's one-time server setup reports back (remote_app.setup.needed: false) or browser access is ready (browser.ready).

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connection_idstringrequired
Application (connection) id.
Example: cx9m2v7d1pa

Responses

200 The application.

application/json

idstringrequired
Application id.
namestringrequired
Technical name (lower-case slug of the name you gave, at most 40 characters). Never changes.
display_namestringrequired
The name people see. Change it with PATCH display_name.
typestringrequired
Application type. See Create an application for what each type needs.
One of: rdp, ssh, vnc, http, https, tcp, db, smb, egress.
hoststringrequired
Target the connector reaches: host name or IP (for egress, the first host name).
portintegerrequired
Target port (445 for smb; for egress, the first port).
connector_idstringrequired
Primary hosting connector (= connector_ids[0]).
connector_idsarray of stringrequired
Every connector that hosts this application (1-5). Traffic fails over between them automatically.
hostnamesarray of string
egress only: the public host names devices send through the connector.
portsarray of integer
egress only: the ports.
egressboolean
egress only: always true.
sharesarray of ConnectionSmbShare
smb only.
shares fields
- sharestringrequired
  Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
- pathstring | null
  Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
- drive_letterstring | null
  Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
  Pattern ^[D-Z]$.
- accessstring
  Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
  One of: rw, ro.
- labelstring | null
  Optional display label, at most 60 characters.
- uncstring
  Read only: the full \\server\share[\path] path.
protection_profile_idstring | null
smb only: the file protection profile applied in gateway mode.
smb_modestring
smb only: direct = Cloudraw Connect reaches the server and its own permissions decide; gateway = protected: every file goes through the Cloudraw file gateway (scanned, profile enforced) and devices get no direct path.
One of: direct, gateway.
share_policy_enforcedboolean
smb only: true in gateway mode.
service_accountobject
smb only: the account the file gateway signs in with (set in the console).
service_account fields
- configuredbooleanrequired
- usernamestring
- domainstring | null
- set_atstring (date-time)
protectionobject | null
smb in gateway mode: {ready, opens_in, missing[]} — what is still missing (service_account, gateway_path).
share_checkobject | null
smb in gateway mode: the latest share check {code, ok, at, stale}.
files_securityobject | null
smb only: open quarantine and blocked files in the last 24 hours.
rdp_securitystring
rdp only: security mode for browser sessions (any = negotiate).
One of: any, nla, tls, rdp.
rdp_domainstring | null
rdp only: sign-in domain pre-filled in the browser portal (e.g. CONTOSO).
access_groupsarray of string
Legacy; access is granted by access rules (policy rules), not here.
clientlessboolean | null
Browser access is on (true). Same switch as delivery.portal.
interceptstring
The name devices use to reach the app: <name>.<id>.cloudraw for most types, the real server name for smb, the first host name for egress.
statusobject
status fields
- phasestring
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_by_integratorobject | null
Set when an integrator (MSP) created the app on your behalf.
deliveryobject
How people open the app.
delivery fields
- clientboolean
  Cloudraw Connect.
- portalboolean
  Browser portal (= clientless).
- rbiboolean
- onetime_rdpboolean
- nativeboolean
  rdp only: "Open in Remote Desktop app" from the portal. Such sessions are not recorded.
recordingobject
recording fields
- onboolean
- requiredboolean
  People may not open the app without recording.
- modestring | null
- groupsarray of string
  Record only these groups; null = everyone.
- browser_onlyboolean
  With recording on: every session goes through the recording gateway (rdp, ssh, vnc only); devices get no direct path.
- noticeobject
  notice fields
  - onboolean
  - mandatoryboolean
    Always true: recorded sessions always show the notice.
  - textstring
  - customboolean
  - default_textstring
redirectionobject
Clipboard / drive / device redirection switches for remote sessions.
redirection fields
- clipboard_inboolean
- clipboard_outboolean
- drivesboolean
- printersboolean
- audio_outboolean
- micboolean
- cameraboolean
- usbboolean
reauthobject
Ask people to sign in again every N minutes (null = off).
reauth fields
- every_minutesinteger | null
  Range: 5–1440.
posturearray of string
Device posture requirements (ids, at most 20). Stored; see controls_enforcement.
appfwobject
Legacy per-app firewall field (stored only). Use allowed_apps.
appfw fields
- modestring
  One of: off, monitor, enforce.
- allowarray of string
redirection_rulesarray of ConnectionRedirectionRule
redirection_rules fields
- namestringrequired
  Rule name, 1-80 characters.
- whenobjectrequired
  At least one condition. All given conditions must match.
  when fields
  - groups_anyarray of string
    Group ids of this workspace.
  - groups_nonearray of string
    Group ids of this workspace.
  - people_anyarray of string
    Person ids of this workspace.
  - countries_anyarray of string
    ISO country codes, e.g. IL.
  - countries_nonearray of string
- setobjectrequired
  At least one redirection switch to override when the rule matches.
  set fields
  - clipboard_inboolean
  - clipboard_outboolean
  - drivesboolean
  - printersboolean
  - audio_outboolean
  - micboolean
  - cameraboolean
  - usbboolean
allowed_appsone of
remote_appone of
rdp only (absent for other types).
gateway_onlyobject
The app is reachable only through a Cloudraw gateway.
gateway_only fields
- onboolean
- reasonstring | null
  One of: protected_file_server, recorded_browser_only, .
guidesobject
guides fields
- appone of
- allowed_appsone of
- alertsone of
iconobject | null
The app's custom icon, if set in the console.
icon fields
- urlstring
  Relative to the workspace URL.
browserobject | null
With browser access on: whether the app can open in the browser now.
browser fields
- supportedboolean
- readyboolean
- errorstring | null
- opensstring | null
  One of: remote_app, desktop, terminal, screen, .
controls_enforcementobject
Where each control is applied today: enforced, stored (saved, not applied yet) or partial:<where>.
controls_enforcement fields
- deliverystring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- recordingstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- redirectionstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- reauthstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- posturestring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- appfwstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- allowed_appsstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connection-not-found tenant-not-found

connection-not-found: No application with this id in the workspace.

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "cx9m2v7d1pa",
  "name": "finance-terminal",
  "display_name": "Finance terminal",
  "type": "rdp",
  "host": "10.20.0.15",
  "port": 3389,
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq"
  ],
  "rdp_security": "any",
  "rdp_domain": null,
  "access_groups": [],
  "clientless": true,
  "intercept": "finance-terminal.q7x2m.cloudraw",
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 1,
  "created_by_integrator": null,
  "delivery": {
    "client": true,
    "portal": true,
    "rbi": false,
    "onetime_rdp": false,
    "native": false
  },
  "recording": {
    "on": false,
    "required": false,
    "mode": null,
    "notice": {
      "on": false,
      "mandatory": true,
      "text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later.",
      "custom": false,
      "default_text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later."
    }
  },
  "redirection": {
    "clipboard_in": true,
    "clipboard_out": false,
    "drives": false,
    "printers": false,
    "audio_out": true,
    "mic": false,
    "camera": false,
    "usb": false
  },
  "reauth": {
    "every_minutes": null
  },
  "posture": [],
  "appfw": {
    "mode": "off",
    "allow": []
  },
  "redirection_rules": [],
  "allowed_apps": null,
  "remote_app": null,
  "gateway_only": {
    "on": false,
    "reason": null
  },
  "guides": {
    "app": {
      "id": "app-remote-app",
      "section": null,
      "title": "Publish a remote desktop",
      "url": "https://cdapi.cloudraw.com/guides/app-remote-app",
      "pdf_url": null
    },
    "allowed_apps": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    },
    "alerts": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    }
  },
  "icon": null,
  "browser": {
    "supported": true,
    "ready": true,
    "error": null,
    "opens": "desktop"
  },
  "controls_enforcement": {
    "delivery": "stored",
    "recording": "partial:browser_sessions_only",
    "redirection": "partial:browser_sessions_only",
    "reauth": "stored",
    "posture": "stored",
    "appfw": "stored",
    "allowed_apps": "partial:client_min_version"
  }
}

Update an application

PATCH/v0/tenants/{tenant_id}/connections/{connection_id}

full-access token

Changes an application's display name, target, hosting connectors, delivery, recording, redirection, allowed applications, RemoteApp or file-server shares. Send only what you change; nested objects (delivery, recording, redirection) merge key by key. Target and connector changes apply live without re-creating the application, so existing access rules keep working. The technical name and intercept never change (to rename them, delete and create again). Turning on "recording required" or "browser only" while delivery.native is on (or the reverse) is refused, because native Remote Desktop sessions are not recorded. All or nothing: every field is checked before anything changes, so a 4xx answer leaves the application exactly as it was; after a 502 only a target or hosting-connector change the overlay already took stays (GET the application to see it). Audited. Send If-Match: <version> to fail with 409 version-conflict instead of overwriting a change made in the meantime.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connection_idstringrequired
Application (connection) id.
Example: cx9m2v7d1pa

Request body application/json

display_namestring
New display name, 1-80 characters, without < > " ' & \ or quote marks. (name` never changes.)
hoststring
New target host (1-253 characters). For smb, the file server name (moves the intercept too).
portinteger
New target port. Not for smb or egress.
Range: 1–65535.
hostnamesarray of string
egress only: replaces the host names (1-20).
portsarray of integer
egress only: replaces the ports (1-10).
connector_idsarray of string
Replaces the hosting connectors (1-5). The first one becomes connector_id.
clientlessboolean | null
Browser access on / off.
deliveryobject
Only the keys you send change.
delivery fields
- clientboolean
- portalboolean
  Same as clientless.
- rbiboolean
- onetime_rdpboolean
- nativeboolean
  rdp only. Refused while recording is required or browser-only.
recordingobject
Only the keys you send change.
recording fields
- onboolean
- requiredboolean
  Ignored (set to false) while on is false.
- modestring | null
  Max length 40.
- groupsarray of string
  Record only these groups; null or [] = everyone.
- browser_onlyboolean
  rdp, ssh, vnc only. Turns browser access on if it was off.
- noticeobject | null
  Custom notice text (null or empty = the default). The notice itself cannot be switched off.
  notice fields
  - textstring | null
    Max length 300.
redirectionobject
Only the keys you send change. Unknown keys and non-boolean values are refused.
redirection fields
- clipboard_inboolean
- clipboard_outboolean
- drivesboolean
- printersboolean
- audio_outboolean
- micboolean
- cameraboolean
- usbboolean
redirection_rulesarray of ConnectionRedirectionRule
Replaces the list; null clears it.
redirection_rules fields
- namestringrequired
  Rule name, 1-80 characters.
- whenobjectrequired
  At least one condition. All given conditions must match.
  when fields
  - groups_anyarray of string
    Group ids of this workspace.
  - groups_nonearray of string
    Group ids of this workspace.
  - people_anyarray of string
    Person ids of this workspace.
  - countries_anyarray of string
    ISO country codes, e.g. IL.
  - countries_nonearray of string
- setobjectrequired
  At least one redirection switch to override when the rule matches.
  set fields
  - clipboard_inboolean
  - clipboard_outboolean
  - drivesboolean
  - printersboolean
  - audio_outboolean
  - micboolean
  - cameraboolean
  - usbboolean
reauthobject
reauth fields
- every_minutesinteger | null
  Clamped to 5-1440; null = off.
posturearray of string
Replaces the list (at most 20 kept).
appfwobject
Legacy. An unknown mode is ignored.
appfw fields
- modestring
  One of: off, monitor, enforce.
- allowarray of string
allowed_appsone of
Replaces the allowed-applications policy; null removes it.
remote_appone of
rdp only. null = full desktop. A new program mints a new setup command.
remote_app_setup_doneboolean
rdp only: mark the one-time server setup as done (you did it by hand) or not done.
rdp_securitystring
rdp only.
One of: any, nla, tls, rdp.
rdp_domainstring | null
rdp only: domain like CONTOSO (letters, digits, -, ., max 64), or null.
sharesarray of ConnectionSmbShare
smb only: replaces the shares (1-20).
shares fields
- sharestringrequired
  Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
- pathstring | null
  Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
- drive_letterstring | null
  Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
  Pattern ^[D-Z]$.
- accessstring
  Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
  One of: rw, ro.
- labelstring | null
  Optional display label, at most 60 characters.
- uncstring
  Read only: the full \\server\share[\path] path.
smb_modestring
smb only.
One of: direct, gateway.
protection_profile_idstring | null
smb only; null clears it.

Responses

200 The updated application.

application/json

idstringrequired
Application id.
namestringrequired
Technical name (lower-case slug of the name you gave, at most 40 characters). Never changes.
display_namestringrequired
The name people see. Change it with PATCH display_name.
typestringrequired
Application type. See Create an application for what each type needs.
One of: rdp, ssh, vnc, http, https, tcp, db, smb, egress.
hoststringrequired
Target the connector reaches: host name or IP (for egress, the first host name).
portintegerrequired
Target port (445 for smb; for egress, the first port).
connector_idstringrequired
Primary hosting connector (= connector_ids[0]).
connector_idsarray of stringrequired
Every connector that hosts this application (1-5). Traffic fails over between them automatically.
hostnamesarray of string
egress only: the public host names devices send through the connector.
portsarray of integer
egress only: the ports.
egressboolean
egress only: always true.
sharesarray of ConnectionSmbShare
smb only.
shares fields
- sharestringrequired
  Share name on the file server, 1-80 characters, without \ / : * ? " < > |.
- pathstring | null
  Optional sub-folder inside the share (backslash separated, at most 200 characters, no . / ..).
- drive_letterstring | null
  Optional drive letter D-Z that Cloudraw Connect maps the share to. Unique per server.
  Pattern ^[D-Z]$.
- accessstring
  Read-write (default) or read-only (shown to people; the file server's own permissions decide in direct mode).
  One of: rw, ro.
- labelstring | null
  Optional display label, at most 60 characters.
- uncstring
  Read only: the full \\server\share[\path] path.
protection_profile_idstring | null
smb only: the file protection profile applied in gateway mode.
smb_modestring
smb only: direct = Cloudraw Connect reaches the server and its own permissions decide; gateway = protected: every file goes through the Cloudraw file gateway (scanned, profile enforced) and devices get no direct path.
One of: direct, gateway.
share_policy_enforcedboolean
smb only: true in gateway mode.
service_accountobject
smb only: the account the file gateway signs in with (set in the console).
service_account fields
- configuredbooleanrequired
- usernamestring
- domainstring | null
- set_atstring (date-time)
protectionobject | null
smb in gateway mode: {ready, opens_in, missing[]} — what is still missing (service_account, gateway_path).
share_checkobject | null
smb in gateway mode: the latest share check {code, ok, at, stale}.
files_securityobject | null
smb only: open quarantine and blocked files in the last 24 hours.
rdp_securitystring
rdp only: security mode for browser sessions (any = negotiate).
One of: any, nla, tls, rdp.
rdp_domainstring | null
rdp only: sign-in domain pre-filled in the browser portal (e.g. CONTOSO).
access_groupsarray of string
Legacy; access is granted by access rules (policy rules), not here.
clientlessboolean | null
Browser access is on (true). Same switch as delivery.portal.
interceptstring
The name devices use to reach the app: <name>.<id>.cloudraw for most types, the real server name for smb, the first host name for egress.
statusobject
status fields
- phasestring
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_by_integratorobject | null
Set when an integrator (MSP) created the app on your behalf.
deliveryobject
How people open the app.
delivery fields
- clientboolean
  Cloudraw Connect.
- portalboolean
  Browser portal (= clientless).
- rbiboolean
- onetime_rdpboolean
- nativeboolean
  rdp only: "Open in Remote Desktop app" from the portal. Such sessions are not recorded.
recordingobject
recording fields
- onboolean
- requiredboolean
  People may not open the app without recording.
- modestring | null
- groupsarray of string
  Record only these groups; null = everyone.
- browser_onlyboolean
  With recording on: every session goes through the recording gateway (rdp, ssh, vnc only); devices get no direct path.
- noticeobject
  notice fields
  - onboolean
  - mandatoryboolean
    Always true: recorded sessions always show the notice.
  - textstring
  - customboolean
  - default_textstring
redirectionobject
Clipboard / drive / device redirection switches for remote sessions.
redirection fields
- clipboard_inboolean
- clipboard_outboolean
- drivesboolean
- printersboolean
- audio_outboolean
- micboolean
- cameraboolean
- usbboolean
reauthobject
Ask people to sign in again every N minutes (null = off).
reauth fields
- every_minutesinteger | null
  Range: 5–1440.
posturearray of string
Device posture requirements (ids, at most 20). Stored; see controls_enforcement.
appfwobject
Legacy per-app firewall field (stored only). Use allowed_apps.
appfw fields
- modestring
  One of: off, monitor, enforce.
- allowarray of string
redirection_rulesarray of ConnectionRedirectionRule
redirection_rules fields
- namestringrequired
  Rule name, 1-80 characters.
- whenobjectrequired
  At least one condition. All given conditions must match.
  when fields
  - groups_anyarray of string
    Group ids of this workspace.
  - groups_nonearray of string
    Group ids of this workspace.
  - people_anyarray of string
    Person ids of this workspace.
  - countries_anyarray of string
    ISO country codes, e.g. IL.
  - countries_nonearray of string
- setobjectrequired
  At least one redirection switch to override when the rule matches.
  set fields
  - clipboard_inboolean
  - clipboard_outboolean
  - drivesboolean
  - printersboolean
  - audio_outboolean
  - micboolean
  - cameraboolean
  - usbboolean
allowed_appsone of
remote_appone of
rdp only (absent for other types).
gateway_onlyobject
The app is reachable only through a Cloudraw gateway.
gateway_only fields
- onboolean
- reasonstring | null
  One of: protected_file_server, recorded_browser_only, .
guidesobject
guides fields
- appone of
- allowed_appsone of
- alertsone of
iconobject | null
The app's custom icon, if set in the console.
icon fields
- urlstring
  Relative to the workspace URL.
browserobject | null
With browser access on: whether the app can open in the browser now.
browser fields
- supportedboolean
- readyboolean
- errorstring | null
- opensstring | null
  One of: remote_app, desktop, terminal, screen, .
controls_enforcementobject
Where each control is applied today: enforced, stored (saved, not applied yet) or partial:<where>.
controls_enforcement fields
- deliverystring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- recordingstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- redirectionstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- reauthstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- posturestring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- appfwstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.
- allowed_appsstring
  One of: enforced, stored, partial:browser_sessions_only, partial:client_min_version, partial:report_only.

400 invalid-display-name invalid-delivery invalid-recording invalid-redirection invalid-redirection-rules invalid-rdp-security invalid-rdp-domain invalid-remote-app invalid-remote-app-setup-done invalid-allowed-apps invalid-share invalid-smb-mode unknown-protection-profile-id invalid-egress invalid-target invalid-connector-ids unknown-connector-id

invalid-display-name: display_name is not 1-80 characters, without < > " ' & \` or quote marks.

invalid-delivery: delivery.native is not a boolean, is set on a non-rdp app, or conflicts with required / browser-only recording.

invalid-recording: recording.notice is not {text} or its text is over 300 characters; recording.browser_only is not a boolean or the app is not rdp/ssh/vnc.

invalid-redirection: redirection is not an object, or has an unknown key or a non-boolean value.

invalid-redirection-rules: redirection_rules is not a list of at most 20 valid rules (unknown group / person ids, bad country codes, empty when or set).

invalid-rdp-security: rdp_security on a non-rdp app or not any/nla/tls/rdp.

invalid-rdp-domain: rdp_domain on a non-rdp app or not a domain name like CONTOSO.

invalid-remote-app: remote_app on a non-rdp app, or remote_app.program is invalid.

invalid-remote-app-setup-done: remote_app_setup_done is not a boolean, or the app has no RemoteApp program that needs setup.

invalid-allowed-apps: allowed_apps is invalid (mode, enforce, preset, more than 50 apps, or an entry's platform / name / publisher / identifier / sha256 / thumbprint / alerts).

invalid-share: smb: host or shares is invalid, or port/hostnames/ports was sent (a file server is always on 445); or shares / smb_mode / protection_profile_id was sent for a non-smb app.

invalid-smb-mode: smb_mode is not direct or gateway.

unknown-protection-profile-id: protection_profile_id does not exist.

invalid-egress: egress: hostnames (1-20 valid, non-Cloudraw names) or ports (1-10 ports) is invalid.

invalid-target: host is empty or longer than 253 characters, or port is not 1-65535.

invalid-connector-ids: connector_ids does not hold 1-5 connectors.

unknown-connector-id: One of connector_ids does not exist or is being removed.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connection-not-found tenant-not-found

connection-not-found: No application with this id in the workspace.

tenant-not-found: No workspace with this id.

409 version-conflict share-server-already-published

version-conflict: If-Match does not match the current version.

share-server-already-published: smb: another application already publishes the new host.

502 allowed-apps-failed provisioning-failed

allowed-apps-failed: The allowed-applications policy could not be applied right now; nothing was changed. Retry.

provisioning-failed: The new target or hosting connectors could not be applied right now. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X PATCH "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "display_name": "Finance terminal (HQ)",
  "recording": {
    "on": true,
    "required": true
  },
  "redirection": {
    "clipboard_out": false,
    "drives": false
  },
  "connector_ids": [
    "cn0r4w8t2kq",
    "cn7k2x9m0sd"
  ]
}'

PowerShell

$body = @'
{
  "display_name": "Finance terminal (HQ)",
  "recording": {
    "on": true,
    "required": true
  },
  "redirection": {
    "clipboard_out": false,
    "drives": false
  },
  "connector_ids": [
    "cn0r4w8t2kq",
    "cn7k2x9m0sd"
  ]
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Patch -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.patch(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "display_name": "Finance terminal (HQ)",
        "recording": {
            "on": True,
            "required": True
        },
        "redirection": {
            "clipboard_out": False,
            "drives": False
        },
        "connector_ids": [
            "cn0r4w8t2kq",
            "cn7k2x9m0sd"
        ]
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "display_name": "Finance terminal (HQ)",
    "recording": {
      "on": true,
      "required": true
    },
    "redirection": {
      "clipboard_out": false,
      "drives": false
    },
    "connector_ids": [
      "cn0r4w8t2kq",
      "cn7k2x9m0sd"
    ]
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "cx9m2v7d1pa",
  "name": "finance-terminal",
  "display_name": "Finance terminal (HQ)",
  "type": "rdp",
  "host": "10.20.0.15",
  "port": 3389,
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq",
    "cn7k2x9m0sd"
  ],
  "rdp_security": "any",
  "rdp_domain": null,
  "access_groups": [],
  "clientless": true,
  "intercept": "finance-terminal.q7x2m.cloudraw",
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 2,
  "created_by_integrator": null,
  "delivery": {
    "client": true,
    "portal": true,
    "rbi": false,
    "onetime_rdp": false,
    "native": false
  },
  "recording": {
    "on": true,
    "required": true,
    "mode": null,
    "notice": {
      "on": true,
      "mandatory": true,
      "text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later.",
      "custom": false,
      "default_text": "This session is recorded. What you see and do on screen is saved for security and compliance, and authorized people in your organization can watch it later."
    }
  },
  "redirection": {
    "clipboard_in": true,
    "clipboard_out": false,
    "drives": false,
    "printers": false,
    "audio_out": true,
    "mic": false,
    "camera": false,
    "usb": false
  },
  "reauth": {
    "every_minutes": null
  },
  "posture": [],
  "appfw": {
    "mode": "off",
    "allow": []
  },
  "redirection_rules": [],
  "allowed_apps": null,
  "remote_app": null,
  "gateway_only": {
    "on": false,
    "reason": null
  },
  "guides": {
    "app": {
      "id": "app-remote-app",
      "section": null,
      "title": "Publish a remote desktop",
      "url": "https://cdapi.cloudraw.com/guides/app-remote-app",
      "pdf_url": null
    },
    "allowed_apps": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    },
    "alerts": {
      "id": "app-allowed-apps",
      "section": null,
      "title": "Allowed applications",
      "url": "https://cdapi.cloudraw.com/guides/app-allowed-apps",
      "pdf_url": null
    }
  },
  "icon": null,
  "browser": {
    "supported": true,
    "ready": true,
    "error": null,
    "opens": "desktop"
  },
  "controls_enforcement": {
    "delivery": "stored",
    "recording": "partial:browser_sessions_only",
    "redirection": "partial:browser_sessions_only",
    "reauth": "stored",
    "posture": "stored",
    "appfw": "stored",
    "allowed_apps": "partial:client_min_version"
  }
}

Delete an application

DELETE/v0/tenants/{tenant_id}/connections/{connection_id}

full-access token

Unpublishes the application. Every access rule that targets it is deleted too, and its active sessions are ended. Cannot be undone. Audited (one row per removed rule and ended session). The answer is a finished task.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
connection_idstringrequired
Application (connection) id.
Example: cx9m2v7d1pa

Responses

202 Deleted (the task is already done).

application/json

idstringrequired
tenant_idstring
statestringrequired
One of: pending, running, done, failed.
result_uristring | null
errorobject | string | null
Why it failed, or a short status note (e.g. revoke_pending).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 connection-not-found tenant-not-found

connection-not-found: No application with this id in the workspace.

tenant-not-found: No workspace with this id.

502 delete-failed

delete-failed: The application could not be removed right now. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa" -Headers $headers

Python

import os, uuid, requests

r = requests.delete(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.status_code)

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/connections/cx9m2v7d1pa", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);

Response 202 · application/json

{
  "id": "task_8k2m0x9s1d",
  "tenant_id": "tq7x2m9k4ab",
  "state": "done",
  "result_uri": null,
  "error": null
}