Settings

Zone settings: the per-zone toggles behind the Cloudflare dashboard, from always_use_https and min_tls_version to browser_cache_ttl.

Get

Fetch a single zone setting by name.

$response = $client->zones()->settings()->get('ZONE_ID', 'SETTING_ID');

Edit

Update a single zone setting by name.

Cloudflare accepts one of two bodies, depending on the setting: value for nearly all of them, and enabled for the handful that take it, such as ssl_recommender.

$client->zones()->settings()->edit('ZONE_ID', 'always_use_https', ['value' => 'on']);
$client->zones()->settings()->edit('ZONE_ID', 'browser_cache_ttl', ['value' => 18000]);
$client->zones()->settings()->edit('ZONE_ID', 'ssl_recommender', ['enabled' => true]);

$response = $client->zones()->settings()->edit('ZONE_ID', 'SETTING_ID', []);

Replace Origin Tls Compliance Modes

Replace the Origin TLS Compliance Modes setting for a zone.

The one setting Cloudflare exposes a full-replace endpoint for: the modes you send become the whole list, and any mode you leave out is removed. An empty list clears the constraint. fips and pqh are supported today, and Cloudflare may add more, so read the current value before writing if you mean to keep what is already there.

$client->zones()->settings()->replaceOriginTlsComplianceModes('ZONE_ID', ['fips']);

$response = $client->zones()->settings()->replaceOriginTlsComplianceModes('ZONE_ID', []);

Delete Origin Tls Compliance Modes

Delete the Origin TLS Compliance Modes setting for a zone.

Removes the compliance constraint entirely, returning the zone to Cloudflare's default of not filtering the key-exchange algorithm list it offers the origin.

$response = $client->zones()->settings()->deleteOriginTlsComplianceModes('ZONE_ID');