Question 1

Can Ana query Cloudflare analytics?

Accepted Answer

Yes. Cloudflare's GraphQL analytics API exposes traffic, cache, security, and performance data at the zone and account levels. Ana constructs targeted GraphQL queries to fetch the right slice of analytics and joins it with warehouse data in a single analysis.

Question 2

Does Ana support Cloudflare Workers data?

Accepted Answer

Yes. Ana can read Workers metadata, invocation metrics, KV storage metadata, and R2 bucket info through the Cloudflare API. This is useful for monitoring Workers health and correlating it with warehouse-measured downstream impact on users.

Question 3

How are Cloudflare tokens secured?

Accepted Answer

API tokens are encrypted in TextQL's credential vault and injected by our egress proxy at the network layer. Ana's Python sandbox never sees the raw token value. We recommend using scoped tokens with only the permissions Ana needs for the specific analyses you support.

Question 4

Can I use a scoped API token?

Accepted Answer

Yes, and we recommend it. Cloudflare lets you create API tokens with fine-grained permissions per resource and zone. Create a dedicated TextQL token with read-only analytics permissions to start, and expand scopes as needed. All activity is audit-logged by Cloudflare.

Question 5

Does Ana read raw Cloudflare logs?

Accepted Answer

For raw HTTP and security event logs, Cloudflare Logpush to your warehouse is the recommended pattern — Ana then queries the warehouse directly. For live aggregate analytics, Ana uses the Cloudflare GraphQL API without needing Logpush configured first.