Deadlock in mutually exclusive account_id and zone_id resolution raises erroneous ValueError

Search the codebase for _get_account_id_path_param, _get_zone_id_path_param, and the mutually exclusive account_id/zone_id pattern; begin with zero_trust.access.applications.list. Reproduce the account_id-only call described in the issue, then verify that requests with exactly one parameter no longer raise the missing-parameter ValueError while supplying both still raises the mutual-exclusion error.

Confirm this is a Python library issue and not an underlying Cloudflare API issue.

• This is an issue with the Python library

Describe the bug

In multiple classes, there is logic that attempts to extract an account_id or zone_id from the base client object if they are not provided as arguments. The code then verifies that exactly one of these parameters is present.

The current implementation looks like this:

if account_id is None:
    account_id = self._client._get_account_id_path_param()
if zone_id is None:
    zone_id = self._client._get_zone_id_path_param()
if account_id and zone_id:
    raise ValueError("You cannot provide both account_id and zone_id")

The Bug

Both _get_account_id_path_param() and _get_zone_id_path_param() actively raise a ValueError if the client does not possess the requested parameter. This inadvertently creates a deadlock:

• If you only provide one parameter (as required), the attempt to fetch the missing second parameter from the client throws a ValueError.
• To bypass the first two if statements without throwing an error, you would have to provide both parameters (either via arguments or the client). However, doing so triggers the third if statement, throwing a ValueError for providing both.

Expected Behavior

The method should execute successfully, recognizing that exactly one mutually exclusive parameter (account_id or zone_id) was provided.

Actual Behavior

A ValueError is incorrectly raised no matter what combination of account_id or zone_id is provided.

Proposed Solution

There are two straightforward ways to resolve this deadlock:

• Wrap the parameter retrievals in a try...except block that catches and suppresses the ValueErrors.
• Modify the _get_*_path_param() methods so they return None instead of throwing an exception when a parameter is missing.

To Reproduce

I personally encountered this issue using client.zero_trust.access.applications.list(account_id=account_id), but a quick search indicates this pattern appears in roughly 180 occurrences across the codebase.

1. Initalize the Cloudflare client with an API key
2. Retrieve the target account ID via searching or just first available, e.g. account_id = next(tier(client.accounts.list())).id
3. Attempt to fetch the applications list using only the account_id: applications = client.zero_trust.access.applications.list(account_id=account_id)
4. ValueError incorrectly raised: Missing zone_id argument; Please provide it at the client level, e.g. Cloudflare(zone_id='abcd') or per method.

Code snippets

OS

macOS 15.7.4

Python version

3.13.11

Library version

5.0.0b2