Which permissions are required to run wrangler pages deployments tail?

[adam26]

For Workers & Pages, what is the name of the domain?

releasedhub.com

What is the error number?

10000

What is the error message?

Authentication error [code: 10000]

What is the issue or error you’re encountering

Cannot run wrangler pages deployment tail --format json --project-name $project --environment preview $deploymentUrl

What steps have you taken to resolve the issue?

I have created an API Token with the following permissions:

Permissions
Account > Cloudflare Pages > Read
Account > Workers Tail > Read
Account > Logs > Read
User > Memberships > Read
User > User Details > Read
Zone > Logs > Read

Account > Released

Zone > All zones

This is apparently not enough for me to run:

What are the steps to reproduce the issue?

Run wrangler pages deployment tail --format json --project-name $project --environment preview $deploymentUrl

I get:

✘ [ERROR] A request to the Cloudflare API (/accounts/$ACCOUNT/pages/projects/$PROJECT/deployments/$ID/tails) failed.

Authentication error [code: 10000]

It looks like you are authenticating Wrangler via a custom API token set in an environment variable.
Please ensure it has the correct permissions for this operation.

Getting User settings…
The API Token is read from the CLOUDFLARE_API_TOKEN in your environment.
You are logged in with an API Token, associated with the email $EMAIL.
┌──────────────┬──────────────────────────────────┐
│ Account Name │ Account ID │
├──────────────┼──────────────────────────────────┤
│ $NAME │ $ID │

The API URL listed is not documented (e.g. it’s not Cloudflare API | Pages › Projects › Deployments › History › Logs › Get Deployment Logs). All of those routes only require Pages Read or Pages Write, but that is apparently not enough for this undocumented route.

[adam26]

I just created a “Read all Resources” preset token. Same error…

[cherryjimbo]

You’ll likely need “Workers Admin”. Permissions for Pages/Workers unfortunately aren’t super fine-grained today.

[adam26]

I don’t see any Permission called Workers Admin? Or even “Admin”, just “Edit” as a permission level.

[adam26]

Ok I’ve added a few “Edit” permissions and something worked there. …that’s absolutely terrible? Why would I need Edit level to read a tail?

[adam26]

Ok for future travelers, the permission needed is Account > Cloudflare Pages > Edit

I am disappointed and dejected that this is the state of things.

1. Reading requires write permissions
2. No documentation of required permissions for either wrangler or the API endpoint it hits
3. General lack of any reasonable way to get logs out of Cloudflare Pages besides via interactive live streams. This is not production-ready.