Skip to content
pqdoctor

Services a Worker calls

The post-quantum check in a project’s Deploy tab finds hosts by reading the code and the wrangler configuration, and it says so: a host built at runtime from a secret, KV or the request can’t be found that way. Services this Worker calls (observed) closes that gap with what Cloudflare recorded about the deployed Worker’s fetch() subrequests.

Those calls to third-party APIs are hops Cloudflare doesn’t control, so they’re hops that can stay classical.

Deploy → Services this Worker calls (observed): outside services checked one at a time; Cloudflare's own, plain-http and private destinations labelled and not checkedDeploy → Services this Worker calls (observed): outside services checked one at a time; Cloudflare's own, plain-http and private destinations labelled and not checked
Deploy → Services this Worker calls (observed): outside services checked one at a time; Cloudflare's own, plain-http and private destinations labelled and not checked · Demo mode, sample data

How it works

Section titled “How it works”
  1. Read observed calls makes one read with your read token. The source is Cloudflare’s GraphQL dataset workersSubrequestsAdaptiveGroups: subrequests by hostname over the last 24 hours, on every plan, with Account → Account Analytics → Read. If that can’t be read, Flarebox falls back to the Worker’s traces (fetch spans), which need [observability.traces] enabled = true in its wrangler configuration. The panel says which permission or setting is missing.
  2. Only scheme, host and port are kept. Paths, queries, fragments and user information are dropped before anything is stored or shown, because URLs can carry tokens. A test checks that no path or query survives.
  3. Each destination gets a label:
Label Checked?
Outside service Yes, on a click
Cloudflare (internal): *.workers.dev, R2, KV, Cloudflare’s own IP ranges No: not a third-party hop
The Worker’s own route No
Plain http No: nothing is encrypted, so there’s no TLS to check. Move it to https://
Private or reserved address Never
  1. Check N observed hosts runs pqdoctor on the outside services only, one at a time, 1.5 seconds apart. Results join the same history, fix reports and CBOM as every other host.

What it misses

Section titled “What it misses”

The list is labelled “observed in the last 24 h” and never called complete:

  • the counts are sampled estimates, and rarely called hosts can be missed;
  • fetches that threw aren’t counted;
  • service bindings and Durable Object calls aren’t fetches;
  • only the hostname is recorded, so each host is checked as https on port 443.

Verified

Section titled “Verified”

Against a real account: the query and its fields are accepted by Cloudflare, and a real Worker’s hourly rows parse, merge across hours, and Cloudflare’s own destinations (Turnstile’s challenges.cloudflare.com) are labelled internal and not checked.