Audit Log API Token accepted permission is too broad

[mickp]

For Workers & Pages, what is the name of the domain?

example.com

What is the issue or error you’re encountering

Audit Log API Token accepted permission is too broad

What steps have you taken to resolve the issue?

I have created an API Token too allow an external service to read and store the Cloudflare audit logs for an account.

It works by assigning the Account Settings Read permission to the token, but I don’t want the service to have access to any other account settings. The Account Settings Read permission is too broad.

I tested with a token assigned the “Access: Audit Log” permission which is available in the portal, but that doesn’t work.

Is there a more constrained permission that I could use?

Screenshot of the error

[ikmal]

It seems the audit log is only available at the account scope. Enabling this role alone will not cause the token to read other settings.

API token permissions · Cloudflare Fundamentals docs