mvvmm · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
@@ -2751,9 +2751,14 @@
 /cloudflare-one/email-security/outbound-dlp/ /cloudflare-one/email-security/policies/outbound/outbound-dlp/ 301
 /cloudflare-one/email-security/settings/auto-moves/ /cloudflare-one/email-security/settings/detection-settings/auto-moves/ 301
 /cloudflare-one/email-security/directories/ /cloudflare-one/email-security/settings/domains-and-directories/directories/ 301
+/cloudflare-one/email-security/directories/manage-es-directories/ /cloudflare-one/email-security/settings/domains-and-directories/directories/manage-es-directories/ 301
+/cloudflare-one/email-security/directories/manage-integrated-directories/ /cloudflare-one/email-security/settings/domains-and-directories/directories/manage-integrated-directories/ 301
+/cloudflare-one/email-security/directories/manage-integrated-directories/manage-groups-directory/ /cloudflare-one/email-security/settings/domains-and-directories/directories/manage-integrated-directories/manage-groups-directory/ 301
+/cloudflare-one/email-security/directories/manage-integrated-directories/manage-users-directory/ /cloudflare-one/email-security/settings/domains-and-directories/directories/manage-integrated-directories/manage-users-directory/ 301
 /cloudflare-one/email-security/settings/domain-management/domain/ /cloudflare-one/email-security/settings/domains-and-directories/domains/ 301
 /cloudflare-one/email-security/settings/phish-submissions/ /cloudflare-one/email-security/settings/submission-settings/ 301
 /cloudflare-one/email-security/settings/phish-submissions/phishnet-365/ /cloudflare-one/email-security/settings/submission-settings/phishnet-365/ 301
+/cloudflare-one/email-security/settings/phish-submissions/phishnet-google-workspace/ /cloudflare-one/email-security/settings/submission-settings/phishnet-google-workspace/ 301
 /cloudflare-one/email-security/settings/phish-submissions/submission-addresses/ /cloudflare-one/email-security/settings/submission-settings/submission-addresses/ 301
 /cloudflare-one/email-security/monitoring/search-email/ /cloudflare-one/email-security/investigation/search-email/ 301
 

@@ -8,7 +8,7 @@ products:
 
 [Browser-based RDP](/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](/cloudflare-one/access-controls/policies/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients.
 
-Since we announced our [open beta](/changelog/access/#2025-06-30), we've made a few improvements:
+Since we announced our [open beta](/changelog/post/2025-07-01-browser-based-rdp-open-beta/), we've made a few improvements:
 
 - Support for targets with IPv6.
 - Support for [Magic WAN](/cloudflare-wan/) and [WARP Connector](/mesh/) as on-ramps.

@@ -10,7 +10,7 @@ products:
 
 To turn it off, edit the portal in **Access controls** > **AI controls** and turn off **Code Mode** under **Basic information**.
 
-When Code Mode is active, the portal exposes a single `code` tool instead of listing every tool from every upstream MCP server. The connected AI agent writes JavaScript that calls typed `codemode.*` methods for each upstream tool. The generated code runs in an isolated [Dynamic Worker](/workers/runtime-apis/bindings/worker-loader/) environment, keeping authentication credentials and environment variables out of the model context.
+When Code Mode is active, the portal exposes a single `code` tool instead of listing every tool from every upstream MCP server. The connected AI agent writes JavaScript that calls typed `codemode.*` methods for each upstream tool. The generated code runs in an isolated [Dynamic Worker](/dynamic-workers/) environment, keeping authentication credentials and environment variables out of the model context.
 
 To use Code Mode, append `?codemode=search_and_execute` to your portal URL when connecting from an MCP client:
 

@@ -18,7 +18,7 @@ https://<subdomain>.<domain>/mcp?optimize_context=minimize_tools
 
 ### `search_and_execute`
 
-Hides all upstream tools and exposes only two tools: `query` and `execute`. The `query` tool searches and retrieves tool definitions. The `execute` tool runs the upstream tools in an isolated [Dynamic Worker](/workers/runtime-apis/bindings/worker-loader/) environment. This reduces the initial token cost to a small constant, regardless of how many tools are available through the portal.
+Hides all upstream tools and exposes only two tools: `query` and `execute`. The `query` tool searches and retrieves tool definitions. The `execute` tool runs the upstream tools in an isolated [Dynamic Worker](/dynamic-workers/) environment. This reduces the initial token cost to a small constant, regardless of how many tools are available through the portal.
 
 ```txt
 https://<subdomain>.<domain>/mcp?optimize_context=search_and_execute

@@ -109,7 +109,7 @@ const fetchUserHistory = async () => {
 
 #### agents-starter <Badge text="Updated" variant="tip" size="small" />
 
-We've fixed a number of small bugs in the [`agents-starter`](https://github.com/cloudflare/agents-starter) project — a real-time, chat-based example application with tool-calling & human-in-the-loop built using the Agents SDK. The starter has also been upgraded to use the latest [wrangler v4](/changelog/2025-03-13-wrangler-v4/) release.
+We've fixed a number of small bugs in the [`agents-starter`](https://github.com/cloudflare/agents-starter) project — a real-time, chat-based example application with tool-calling & human-in-the-loop built using the Agents SDK. The starter has also been upgraded to use the latest [wrangler v4](/changelog/post/2025-03-13-wrangler-v4/) release.
 
 If you're new to Agents, you can install and run the `agents-starter` project in two commands:
 

@@ -13,7 +13,7 @@ The [`@cloudflare/codemode`](https://www.npmjs.com/package/@cloudflare/codemode)
 
 [Code Mode](https://blog.cloudflare.com/code-mode/) enables LLMs to write and execute code that orchestrates your tools, instead of calling them one at a time. This can (and does) yield significant token savings, reduces context window pressure and improves overall model performance on a task.
 
-The new `Executor` interface is runtime agnostic and comes with a prebuilt `DynamicWorkerExecutor` to run generated code in a [Dynamic Worker Loader](/workers/runtime-apis/bindings/worker-loader/).
+The new `Executor` interface is runtime agnostic and comes with a prebuilt `DynamicWorkerExecutor` to run generated code in a [Dynamic Worker Loader](/dynamic-workers/).
 
 ## Breaking changes
 
@@ -27,7 +27,7 @@ The new `Executor` interface is runtime agnostic and comes with a prebuilt `Dyna
 
 ### `DynamicWorkerExecutor`
 
-Runs code in a [Dynamic Worker](/workers/runtime-apis/bindings/worker-loader/). It comes with the following features:
+Runs code in a [Dynamic Worker](/dynamic-workers/). It comes with the following features:
 
 - **Network isolation** — `fetch()` and `connect()` blocked by default (`globalOutbound: null`) when using `DynamicWorkerExecutor`
 - **Console capture** — `console.log/warn/error` captured and returned in `ExecuteResult.logs`

@@ -35,7 +35,7 @@ await env.KV.put(`backup:${userId}`, JSON.stringify(backup));
 await sandbox.restoreBackup(backup);
 ```
 
-Backups are stored in [R2](/r2) and can take advantage of [R2 object lifecycle rules](/sandbox/guides/backup-restore/#configure-r2-lifecycle-rules-for-automatic-cleanup) to ensure they do not persist forever.
+Backups are stored in [R2](/r2) and can take advantage of [R2 object lifecycle rules](/sandbox/sdk/guides/backup-restore/#set-a-name-and-ttl) to ensure they do not persist forever.
 
 Key capabilities:
 
@@ -48,4 +48,4 @@ Key capabilities:
 Backup and restore currently uses a FUSE overlay. Soon, native snapshotting at a lower level will be added to Containers and Sandboxes, improving speed and ergonomics. The current backup functionality provides a significant speed improvement over manually recreating a file system, but it will be further optimized in the future. The new snapshotting system will use a similar API, so changing to this system will be simple once it is available.
 :::
 
-To get started, refer to the [backup and restore guide](/sandbox/guides/backup-restore/) for setup instructions and usage patterns, or the [Backups API reference](/sandbox/api/backups/) for full method documentation.
+To get started, refer to the [backup and restore guide](/sandbox/sdk/guides/backup-restore/) for setup instructions and usage patterns, or the [Backups API reference](/sandbox/sdk/api/backups/) for full method documentation.
@@ -66,4 +66,4 @@ To update to the latest version:
 npm i @cloudflare/sandbox@latest
 ```
 
-For full API details, refer to the [Sandbox file watching reference](/sandbox/api/file-watching/).
+For full API details, refer to the [Sandbox file watching reference](/sandbox/sdk/api/file-watching/).
@@ -49,4 +49,4 @@ To update to the latest version:
 
 <PackageManagers pkg="@cloudflare/sandbox@latest" />
 
-For full API details, refer to the [Sandbox tunnels reference](/sandbox/api/tunnels/).
+For full API details, refer to the [Sandbox tunnels reference](/sandbox/sdk/api/tunnels/).
@@ -15,4 +15,4 @@ AI Gateway's REST API now returns consistent responses when an AI provider rejec
 
 Update applications that handle AI Gateway REST API errors to treat HTTP `401` as an invalid or rejected provider credential.
 
-For details about providing provider credentials, refer to [Bring your own provider keys](/ai-gateway/configuration/bring-your-own-key/).
+For details about providing provider credentials, refer to [Bring your own provider keys](/ai-gateway/configuration/bring-your-own-keys/).
@@ -6,7 +6,7 @@ date: 2025-08-22
 
 [Audit Logs v2 dataset](/logs/logpush/logpush-job/datasets/account/audit_logs_v2/) is now available via Logpush.
 
-This expands on earlier releases of Audit Logs v2 in the [API](/changelog/2025-03-27-automatic-audit-logs-beta-release/) and [Dashboard UI](/changelog/2025-07-29-audit-logs-v2-ui-beta/).
+This expands on earlier releases of Audit Logs v2 in the [API](/changelog/post/2025-03-27-automatic-audit-logs-beta-release/) and [Dashboard UI](/changelog/post/2025-07-29-audit-logs-v2-ui-beta/).
 
 We recommend creating a new Logpush job for the Audit Logs v2 dataset.
 

@@ -15,7 +15,7 @@ import { PackageManagers } from "~/components";
 
 ## Basin Pipelines
 
-[Basin Pipelines](/basin-pipelines/), formerly Cloudflare Pipelines, ingests events from Workers, HTTP endpoints, and Cloudflare [Logpush](/logpush/). It transforms events with SQL and ingests them into Iceberg tables or files on R2. With Basin Pipelines you can:
+[Basin Pipelines](/basin-pipelines/), formerly Cloudflare Pipelines, ingests events from Workers, HTTP endpoints, and Cloudflare [Logpush](/logs/logpush/). It transforms events with SQL and ingests them into Iceberg tables or files on R2. With Basin Pipelines you can:
 
 - Ingest application and device events through HTTP endpoints or Workers bindings.
 - Filter and reshape Cloudflare logs before storing them as Iceberg tables, Parquet, or JSON.

@@ -6,7 +6,7 @@ products:
 date: 2026-09-09
 ---
 
-[Cloudflare CASB](/cloudflare-one/integrations/cloud-and-saas/) now integrates with [Zoom](/cloudflare-one/integrations/cloud-and-saas/zoom/). The integration connects through Cloudflare's pre-built OAuth application — no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes.
+[Cloudflare CASB](/cloudflare-one/integrations/cloud-and-saas/) now integrates with Zoom. The integration connects through Cloudflare's pre-built OAuth application — no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes.
 
 Zoom is widely used for meetings, webinars, and collaboration. Misconfigurations in account settings, meeting security controls, and recording access can expose organizations to data leakage, unauthorized access, and compliance risk. Cloudflare CASB ingests Zoom account data via API to surface security findings across these areas.
 
@@ -22,4 +22,4 @@ Starting today, security teams can scan for security findings across the followi
 
 ### Learn more
 
-This [integration](/cloudflare-one/integrations/cloud-and-saas/zoom/) is available to all Cloudflare Zero Trust customers today. New customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the Cloudflare One dashboard under **Cloud & SaaS findings** > **Integrations**. The integration begins scanning immediately and surfaces findings in the dashboard within minutes.
+This integration is available to all Cloudflare Zero Trust customers today. New customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the Cloudflare One dashboard under **Cloud & SaaS findings** > **Integrations**. The integration begins scanning immediately and surfaces findings in the dashboard within minutes.
@@ -45,6 +45,6 @@ If you are looking for older product updates, refer to the following locations.
 - [Magic WAN](/cloudflare-wan/changelog/)
 - [Network Interconnect](/network-interconnect/changelog/)
 - [Risk score](/cloudflare-one/changelog/risk-score/)
-- [Cloudflare One Client](/changelog/cloudflare-one-client/)
+- [Cloudflare One Client](/changelog/product/cloudflare-one-client/)
 
 </Details>
@@ -14,7 +14,7 @@ You can now set a maximum time-to-live (TTL) for DNS responses returned by Gatew
 The setting is available at two levels:
 
 - **Account level** - In **Traffic Policies** > **Traffic Settings**, under **Proxy and inspection**. This sets the default cap for all DNS locations.
-- **Per-location** - Each [DNS location](/cloudflare-one/networks/resolvers-proxies/) can inherit the account setting, disable the cap, or override it with a custom value.
+- **Per-location** - Each [DNS location](/cloudflare-one/networks/resolvers-and-proxies/) can inherit the account setting, disable the cap, or override it with a custom value.
 
 Two new fields are also available in DNS logs: `upstream_record_ttls` (the original TTL from the upstream response) and `applied_max_ttl` (the cap Gateway applied). These appear in the DNS logs column picker and in Logpush datasets.
 

@@ -15,4 +15,4 @@ This allows you to:
 - Build container images as part of CI/CD workflows
 - Deploy arbitrary images supplied at runtime within a container
 
-For [Sandbox SDK](/sandbox/) users, see the [Docker-in-Docker guide](/sandbox/guides/docker-in-docker/) for instructions on combining Docker with the SandboxSDK. For general Containers usage, see the [Containers FAQ](/containers/faq/#can-i-run-docker-inside-a-container-docker-in-docker).
+For [Sandbox SDK](/sandbox/) users, see the [Docker-in-Docker guide](/sandbox/sdk/guides/docker-in-docker/) for instructions on combining Docker with the SandboxSDK. For general Containers usage, see the [Containers FAQ](/containers/faq/#can-i-run-docker-inside-a-container-docker-in-docker).
@@ -78,4 +78,4 @@ This provides an easy way to associate state with any container instance, and in
 
 Upgrade to `@cloudflare/containers` version 0.2.0 or later, or `@cloudflare/sandbox` version 0.8.0 or later to use outbound Workers.
 
-Refer to [Containers outbound traffic](/containers/configuration/outbound-traffic/) and [Sandboxes outbound traffic](/sandbox/guides/outbound-traffic/) for more details and examples.
+Refer to [Containers outbound traffic](/containers/configuration/outbound-traffic/) and [Sandboxes outbound traffic](/sandbox/sdk/guides/outbound-traffic/) for more details and examples.
@@ -109,4 +109,4 @@ Handlers accept `params`, so you can customize behavior per instance without def
 
 Upgrade to `@cloudflare/containers@0.3.0` or `@cloudflare/sandbox@0.8.9` to use these features.
 
-For more details, refer to [Sandbox outbound traffic](/sandbox/guides/outbound-traffic/) and [Container outbound traffic](/containers/configuration/outbound-traffic/).
+For more details, refer to [Sandbox outbound traffic](/sandbox/sdk/guides/outbound-traffic/) and [Container outbound traffic](/containers/configuration/outbound-traffic/).
@@ -14,4 +14,4 @@ Cloudflare Containers can now provide self-hosted execution environments for the
 
 You can configure the reference implementation to meet your needs by extending the Container to provide controlled access to data and the network or by integrating it with other Cloudflare products.
 
-To get started, refer to [Run Codex on Cloudflare using the OpenAI Agents API](/sandbox/tutorials/openai-agents-api/).
+To get started, refer to [Run Codex on Cloudflare using the OpenAI Agents API](/sandbox/coding-agents/openai-agents-api/).
@@ -6,7 +6,7 @@ products:
 date: 2026-09-01
 ---
 
-Beginning September 1, 2026, D1 queries on the [Workers Free plan](/workers/platform/pricing/#workers) will fail when an account exceeds the daily [row read or row write limits](/d1/platform/pricing/). Queries via the [Workers Binding API](/d1/worker-api/) and the [REST API](/d1/rest-api/) will return errors until the limit resets at midnight UTC. Stored data is not affected.
+Beginning September 1, 2026, D1 queries on the [Workers Free plan](/workers/platform/pricing/#workers) will fail when an account exceeds the daily [row read or row write limits](/d1/platform/pricing/). Queries via the [Workers Binding API](/d1/worker-api/) and the [REST API](/api/resources/d1/subresources/database/methods/create/) will return errors until the limit resets at midnight UTC. Stored data is not affected.
 
 You will receive email alerts when the daily limit is reached. The following errors indicate that a limit has been exceeded:
 

@@ -8,7 +8,7 @@ import { Render } from "~/components";
 
 You now have more transparency about team and user submissions for phishing emails through a **Reclassification** tab in the Zero Trust dashboard.
 
-Reclassifications happen when users or admins [submit a phish](/cloudflare-one/email-security/settings/phish-submissions/) to Email security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models.
+Reclassifications happen when users or admins [submit a phish](/cloudflare-one/email-security/settings/submission-settings/) to Email security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models.
 
 This new tab increases your visibility into this process, allowing you to view what submissions you have made and what the outcomes of those submissions are.
 

@@ -8,7 +8,7 @@ Cloudflare Email security customers who have Microsoft 365 environments can quic
 
 Simply deploy our add-in, create a DLP policy in Cloudflare, and configure Outlook to trigger behaviors like displaying a banner, alerting end users before sending, or preventing delivery entirely.
 
-Refer to [Outbound Data Loss Prevention](/cloudflare-one/email-security/outbound-dlp/) to learn more about this feature.
+Refer to [Outbound Data Loss Prevention](/cloudflare-one/email-security/policies/outbound/outbound-dlp/) to learn more about this feature.
 
 In GUI alert:
Original file line number	Diff line number	Diff line change
Expand Up		@@ -49,4 +49,4 @@ To update to the latest version:

		<PackageManagers pkg="@cloudflare/sandbox@latest" />

		For full API details, refer to the [Sandbox tunnels reference](/sandbox/api/tunnels/).
		For full API details, refer to the [Sandbox tunnels reference](/sandbox/sdk/api/tunnels/).
Original file line number	Diff line number	Diff line change
Expand Up		@@ -15,4 +15,4 @@ AI Gateway's REST API now returns consistent responses when an AI provider rejec

		Update applications that handle AI Gateway REST API errors to treat HTTP `401` as an invalid or rejected provider credential.

		For details about providing provider credentials, refer to [Bring your own provider keys](/ai-gateway/configuration/bring-your-own-key/).
		For details about providing provider credentials, refer to [Bring your own provider keys](/ai-gateway/configuration/bring-your-own-keys/).
Original file line number	Diff line number	Diff line change
Expand Up		@@ -78,4 +78,4 @@ This provides an easy way to associate state with any container instance, and in

		Upgrade to `@cloudflare/containers` version 0.2.0 or later, or `@cloudflare/sandbox` version 0.8.0 or later to use outbound Workers.

		Refer to [Containers outbound traffic](/containers/configuration/outbound-traffic/) and [Sandboxes outbound traffic](/sandbox/guides/outbound-traffic/) for more details and examples.
		Refer to [Containers outbound traffic](/containers/configuration/outbound-traffic/) and [Sandboxes outbound traffic](/sandbox/sdk/guides/outbound-traffic/) for more details and examples.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -109,4 +109,4 @@ Handlers accept `params`, so you can customize behavior per instance without def

		Upgrade to `@cloudflare/containers@0.3.0` or `@cloudflare/sandbox@0.8.9` to use these features.

		For more details, refer to [Sandbox outbound traffic](/sandbox/guides/outbound-traffic/) and [Container outbound traffic](/containers/configuration/outbound-traffic/).
		For more details, refer to [Sandbox outbound traffic](/sandbox/sdk/guides/outbound-traffic/) and [Container outbound traffic](/containers/configuration/outbound-traffic/).
Original file line number	Diff line number	Diff line change
Expand Up		@@ -14,4 +14,4 @@ Cloudflare Containers can now provide self-hosted execution environments for the

		You can configure the reference implementation to meet your needs by extending the Container to provide controlled access to data and the network or by integrating it with other Cloudflare products.

		To get started, refer to [Run Codex on Cloudflare using the OpenAI Agents API](/sandbox/tutorials/openai-agents-api/).
		To get started, refer to [Run Codex on Cloudflare using the OpenAI Agents API](/sandbox/coding-agents/openai-agents-api/).