The way I would do it would be by going to Manage Account > Configurations > Lists and pressing Create list. This allows you to create a list with IP addresses and prefixes.
After the list is created you can create a custom WAF rule in Security > WAF > Create rule like this:
It’s not always possible because of IP Lists limits…
For instance, simple use case, i would like to allow list UptimeRobot IPs, but it’s not working with Cloudflare lists :
From: /configurations/lists : We get this error:
"invalid value for ip at position 149: filters.api.IPv6 IP addresses are not supported. We suggest using a /64 CIDR instead "