A Cloudflare device ID is useful, but sometimes the value I actually need for troubleshooting is the virtual IPv4 or IPv6 assigned by Cloudflare One Client.

The useful lookup is the device registration rather than only the base device record.

The pattern I use is:

Access/Gateway context provides device ID
        ↓
Query active registrations for that device
        ↓
Select the relevant active registration
        ↓
Read virtual IPv4 / IPv6

Conceptually the API request is scoped to the device ID and active registrations:

GET /accounts/{account_id}/devices/registrations
    ?device.id={device_id}
    &status=active

A device can have more than one registration over time, so code should not assume the first record is automatically the current one. I prefer to select the most recently relevant active registration and tolerate missing virtual addresses.

That makes the values useful additions to custom Access and Gateway diagnostic pages because they can then be correlated with Zero Trust logs and routing behaviour.

Related: Making Cloudflare Access Denials Actually Useful.