Safe to use Cloudflare as a registrar?

Website, Application, Performance Registrar
1

I use Cloudflare as a registrar.
Does the Cloudflare API support a domain-transfer?

In other words, could I (or someone else with my API credentials) initiate a transfer of my domain to another registrar? I ask because WordPress caching plugins (e.g., WP Rocket) require Cloudflare API credentials, which means a hosting provider and their employees have access to them.

I’d like to lock my domain names so that no transfer can occur w/o a secondary password or other means.

2

They can unlock, but then they would need the Auth code. I don’t think the API exposes that. Maybe @cs-cf knows.

https://api.cloudflare.com/#registrar-domains-update-domain

3

Back to Quesiton: Does the Cloudflare API support a domain-transfer and domain register?