@databricks/sdk-networking 0.1.0-dev.5 → 0.2.0

package/dist/v1/model.d.ts

@@ -1,13 +1,6 @@
 import { Temporal } from '@js-temporal/polyfill';
 import { FieldMask } from '@databricks/sdk-core/wkt';
 import { z } from 'zod';
-export declare const CustomerFacingVpcEndpointUseCase: {
-    readonly WORKSPACE_ACCESS: "WORKSPACE_ACCESS";
-    readonly DATAPLANE_RELAY_ACCESS: "DATAPLANE_RELAY_ACCESS";
-    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
-    readonly GENERAL_ACCESS: "GENERAL_ACCESS";
-};
-export type CustomerFacingVpcEndpointUseCase = (typeof CustomerFacingVpcEndpointUseCase)[keyof typeof CustomerFacingVpcEndpointUseCase] | (string & {});
 /**
  * The target resources that are supported by Network Connectivity Config.
  * Note: some egress types can support general types that are not defined in EgressResourceType.
@@ -48,6 +41,13 @@ export declare const PrivateAccessLevel: {
     readonly ACCOUNT: "ACCOUNT";
 };
 export type PrivateAccessLevel = (typeof PrivateAccessLevel)[keyof typeof PrivateAccessLevel] | (string & {});
+export declare const VpcEndpointUseCase: {
+    readonly WORKSPACE_ACCESS: "WORKSPACE_ACCESS";
+    readonly DATAPLANE_RELAY_ACCESS: "DATAPLANE_RELAY_ACCESS";
+    /** General access, replaces WORKSPACE_ACCESS in customer-facing API. */
+    readonly GENERAL_ACCESS: "GENERAL_ACCESS";
+};
+export type VpcEndpointUseCase = (typeof VpcEndpointUseCase)[keyof typeof VpcEndpointUseCase] | (string & {});
 export declare const VpcStatus: {
     readonly VALID: "VALID";
     readonly BROKEN: "BROKEN";
@@ -69,47 +69,98 @@ export declare const AccountIpAccessListType_IpAccessListType: {
     readonly BLOCK: "BLOCK";
 };
 export type AccountIpAccessListType_IpAccessListType = (typeof AccountIpAccessListType_IpAccessListType)[keyof typeof AccountIpAccessListType_IpAccessListType] | (string & {});
+export declare const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType: {
+    readonly INTERNET_DESTINATION_TYPE_UNSPECIFIED: "INTERNET_DESTINATION_TYPE_UNSPECIFIED";
+    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
+    readonly DNS_NAME: "DNS_NAME";
+};
+export type EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = (typeof EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType] | (string & {});
+/** The values should match the list of workloads used in networkconfig.proto */
+export declare const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter: {
+    readonly DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: "DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED";
+    /** SQL Warehouse product */
+    readonly DBSQL: "DBSQL";
+    /** Machine Learning serving product */
+    readonly ML_SERVING: "ML_SERVING";
+};
+export type EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = (typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter] | (string & {});
+export declare const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode: {
+    readonly ENFORCEMENT_MODE_UNSPECIFIED: "ENFORCEMENT_MODE_UNSPECIFIED";
+    /** Blocks traffic that violates network policy. This is the default mode. */
+    readonly ENFORCED: "ENFORCED";
+    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
+    readonly DRY_RUN: "DRY_RUN";
+};
+export type EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = (typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode] | (string & {});
+/**
+ * At which level can <Databricks> and <Databricks> managed compute access Internet.
+ * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
+ * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
+ * as well as UC connections and external locations.
+ */
+export declare const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode: {
+    readonly RESTRICTION_MODE_UNSPECIFIED: "RESTRICTION_MODE_UNSPECIFIED";
+    readonly FULL_ACCESS: "FULL_ACCESS";
+    readonly RESTRICTED_ACCESS: "RESTRICTED_ACCESS";
+};
+export type EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = (typeof EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode] | (string & {});
+export declare const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType: {
+    readonly STORAGE_DESTINATION_TYPE_UNSPECIFIED: "STORAGE_DESTINATION_TYPE_UNSPECIFIED";
+    /**
+     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
+     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
+     */
+    readonly AWS_S3: "AWS_S3";
+    readonly AZURE_STORAGE: "AZURE_STORAGE";
+    readonly GOOGLE_CLOUD_STORAGE: "GOOGLE_CLOUD_STORAGE";
+};
+export type EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = (typeof EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType] | (string & {});
+export declare const EndpointUseCase_EndpointUseCase: {
+    /** service-direct frontend private link connectivity. */
+    readonly SERVICE_DIRECT: "SERVICE_DIRECT";
+};
+export type EndpointUseCase_EndpointUseCase = (typeof EndpointUseCase_EndpointUseCase)[keyof typeof EndpointUseCase_EndpointUseCase] | (string & {});
 /**
  * Qualifies the breadth of API access permitted by an ingress network policy rule.
  * API_SCOPE_QUALIFIER_READ narrows matching to read-only variants of the listed scopes;
  * API_SCOPE_QUALIFIER_ALL matches any scope. When unset, scopes match exactly as listed.
  */
-export declare const CustomerFacingIngressNetworkPolicy_ApiScopeQualifier: {
+export declare const IngressNetworkPolicy_ApiScopeQualifier: {
     /** Narrows matching to read-only variants of the listed scopes (e.g. GET/HEAD requests). */
     readonly API_SCOPE_QUALIFIER_READ: "API_SCOPE_QUALIFIER_READ";
     /** Matches any scope regardless of access level. */
     readonly API_SCOPE_QUALIFIER_ALL: "API_SCOPE_QUALIFIER_ALL";
 };
-export type CustomerFacingIngressNetworkPolicy_ApiScopeQualifier = (typeof CustomerFacingIngressNetworkPolicy_ApiScopeQualifier)[keyof typeof CustomerFacingIngressNetworkPolicy_ApiScopeQualifier] | (string & {});
-export declare const CustomerFacingIngressNetworkPolicy_Authentication_IdentityType: {
+export type IngressNetworkPolicy_ApiScopeQualifier = (typeof IngressNetworkPolicy_ApiScopeQualifier)[keyof typeof IngressNetworkPolicy_ApiScopeQualifier] | (string & {});
+export declare const IngressNetworkPolicy_Authentication_IdentityType: {
     readonly IDENTITY_TYPE_UNSPECIFIED: "IDENTITY_TYPE_UNSPECIFIED";
     readonly IDENTITY_TYPE_ALL_USERS: "IDENTITY_TYPE_ALL_USERS";
     readonly IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS: "IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS";
     readonly IDENTITY_TYPE_SELECTED_IDENTITIES: "IDENTITY_TYPE_SELECTED_IDENTITIES";
 };
-export type CustomerFacingIngressNetworkPolicy_Authentication_IdentityType = (typeof CustomerFacingIngressNetworkPolicy_Authentication_IdentityType)[keyof typeof CustomerFacingIngressNetworkPolicy_Authentication_IdentityType] | (string & {});
-export declare const CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType: {
+export type IngressNetworkPolicy_Authentication_IdentityType = (typeof IngressNetworkPolicy_Authentication_IdentityType)[keyof typeof IngressNetworkPolicy_Authentication_IdentityType] | (string & {});
+export declare const IngressNetworkPolicy_AuthenticationIdentity_PrincipalType: {
     readonly PRINCIPAL_TYPE_UNSPECIFIED: "PRINCIPAL_TYPE_UNSPECIFIED";
     readonly PRINCIPAL_TYPE_USER: "PRINCIPAL_TYPE_USER";
     readonly PRINCIPAL_TYPE_SERVICE_PRINCIPAL: "PRINCIPAL_TYPE_SERVICE_PRINCIPAL";
 };
-export type CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType = (typeof CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType)[keyof typeof CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType] | (string & {});
-export declare const CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode: {
+export type IngressNetworkPolicy_AuthenticationIdentity_PrincipalType = (typeof IngressNetworkPolicy_AuthenticationIdentity_PrincipalType)[keyof typeof IngressNetworkPolicy_AuthenticationIdentity_PrincipalType] | (string & {});
+export declare const IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode: {
     readonly FULL_ACCESS: "FULL_ACCESS";
     readonly RESTRICTED_ACCESS: "RESTRICTED_ACCESS";
 };
-export type CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = (typeof CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode)[keyof typeof CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode] | (string & {});
-export declare const CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode: {
+export type IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode = (typeof IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode)[keyof typeof IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode] | (string & {});
+export declare const IngressNetworkPolicy_PrivateAccess_RestrictionMode: {
     readonly ALLOW_ALL_REGISTERED_ENDPOINTS: "ALLOW_ALL_REGISTERED_ENDPOINTS";
     readonly RESTRICTED_ACCESS: "RESTRICTED_ACCESS";
 };
-export type CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode = (typeof CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode)[keyof typeof CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode] | (string & {});
-export declare const CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode: {
+export type IngressNetworkPolicy_PrivateAccess_RestrictionMode = (typeof IngressNetworkPolicy_PrivateAccess_RestrictionMode)[keyof typeof IngressNetworkPolicy_PrivateAccess_RestrictionMode] | (string & {});
+export declare const IngressNetworkPolicy_PublicAccess_RestrictionMode: {
     readonly FULL_ACCESS: "FULL_ACCESS";
     readonly RESTRICTED_ACCESS: "RESTRICTED_ACCESS";
 };
-export type CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode = (typeof CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode)[keyof typeof CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode] | (string & {});
-export declare const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState: {
+export type IngressNetworkPolicy_PublicAccess_RestrictionMode = (typeof IngressNetworkPolicy_PublicAccess_RestrictionMode)[keyof typeof IngressNetworkPolicy_PublicAccess_RestrictionMode] | (string & {});
+export declare const NccPrivateEndpointRule_PrivateLinkConnectionState: {
     readonly PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     readonly ESTABLISHED: "ESTABLISHED";
@@ -120,7 +171,7 @@ export declare const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRu
      * be deleted for clean-up.
      */
     readonly DISCONNECTED: "DISCONNECTED";
-    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
+    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
     readonly EXPIRED: "EXPIRED";
     /** The endpoint has been created and pending approval. */
     readonly PENDING: "PENDING";
@@ -129,11 +180,9 @@ export declare const CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRu
     /** The endpoint creation failed. */
     readonly CREATE_FAILED: "CREATE_FAILED";
 };
-export type CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = (typeof CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
-export declare const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState: {
+export type NccPrivateEndpointRule_PrivateLinkConnectionState = (typeof NccPrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof NccPrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
+export declare const NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState: {
     readonly PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
-    /** The endpoint has been created and pending approval. */
-    readonly INIT: "INIT";
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     readonly ESTABLISHED: "ESTABLISHED";
     /** Connection was rejected by the private link resource owner. */
@@ -143,7 +192,7 @@ export declare const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpoint
      * be deleted for clean-up.
      */
     readonly DISCONNECTED: "DISCONNECTED";
-    /** If the endpoint was created but not approved in 14 days, it will be EXPIRED. */
+    /** If the endpoint is created but not approved in 14 days, it is EXPIRED. */
     readonly EXPIRED: "EXPIRED";
     /** The endpoint has been created and pending approval. */
     readonly PENDING: "PENDING";
@@ -152,60 +201,11 @@ export declare const CustomerFacingNetworkConnectivityConfigAzurePrivateEndpoint
     /** The endpoint creation failed. */
     readonly CREATE_FAILED: "CREATE_FAILED";
 };
-export type CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = (typeof CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
-export declare const EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType: {
-    readonly INTERNET_DESTINATION_TYPE_UNSPECIFIED: "INTERNET_DESTINATION_TYPE_UNSPECIFIED";
-    /** This is defined as `FQDN` in settings-policy/api/proto/messages.proto. Translation is done in accounts-lake-net-manager/src/util/NetworkPolicySettingUtil.scala. */
-    readonly DNS_NAME: "DNS_NAME";
-};
-export type EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType = (typeof EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination_InternetDestinationType] | (string & {});
-/** The values should match the list of workloads used in networkconfig.proto */
-export declare const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter: {
-    readonly DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED: "DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED";
-    /** SQL Warehouse product */
-    readonly DBSQL: "DBSQL";
-    /** Machine Learning serving product */
-    readonly ML_SERVING: "ML_SERVING";
-};
-export type EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter = (typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_DryRunModeProductFilter] | (string & {});
-export declare const EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode: {
-    readonly ENFORCEMENT_MODE_UNSPECIFIED: "ENFORCEMENT_MODE_UNSPECIFIED";
-    /** Blocks traffic that violates network policy. This is the default mode. */
-    readonly ENFORCED: "ENFORCED";
-    /** Logs violations without blocking traffic. Useful for testing policies before enforcement. */
-    readonly DRY_RUN: "DRY_RUN";
-};
-export type EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode = (typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement_EnforcementMode] | (string & {});
-/**
- * At which level can <Databricks> and <Databricks> managed compute access Internet.
- * FULL_ACCESS: <Databricks> can access Internet. No blocking rules will apply.
- * RESTRICTED_ACCESS: <Databricks> can only access explicitly allowed internet and storage destinations,
- * as well as UC connections and external locations.
- */
-export declare const EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode: {
-    readonly RESTRICTION_MODE_UNSPECIFIED: "RESTRICTION_MODE_UNSPECIFIED";
-    readonly FULL_ACCESS: "FULL_ACCESS";
-    readonly RESTRICTED_ACCESS: "RESTRICTED_ACCESS";
-};
-export type EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode = (typeof EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode] | (string & {});
-export declare const EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType: {
-    readonly STORAGE_DESTINATION_TYPE_UNSPECIFIED: "STORAGE_DESTINATION_TYPE_UNSPECIFIED";
-    /**
-     * AWS_S3 can be used both for direct AWS S3 access and for cross-cloud access from Azure and GCP
-     * When used in an Azure/GCP context, this indicates cross-cloud access from Azure/GCP to the specified S3 bucket
-     */
-    readonly AWS_S3: "AWS_S3";
-    readonly AZURE_STORAGE: "AZURE_STORAGE";
-    readonly GOOGLE_CLOUD_STORAGE: "GOOGLE_CLOUD_STORAGE";
-};
-export type EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType = (typeof EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType)[keyof typeof EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination_StorageDestinationType] | (string & {});
-export declare const EndpointUseCase_EndpointUseCase: {
-    /** service-direct frontend private link connectivity. */
-    readonly SERVICE_DIRECT: "SERVICE_DIRECT";
-};
-export type EndpointUseCase_EndpointUseCase = (typeof EndpointUseCase_EndpointUseCase)[keyof typeof EndpointUseCase_EndpointUseCase] | (string & {});
-export declare const NccPrivateEndpointRule_PrivateLinkConnectionState: {
+export type NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState = (typeof NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
+export declare const NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState: {
     readonly PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED: "PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED";
+    /** The endpoint has been created and pending approval. */
+    readonly INIT: "INIT";
     /** The endpoint has been approved and is ready to use in your serverless compute resources. */
     readonly ESTABLISHED: "ESTABLISHED";
     /** Connection was rejected by the private link resource owner. */
@@ -224,7 +224,7 @@ export declare const NccPrivateEndpointRule_PrivateLinkConnectionState: {
     /** The endpoint creation failed. */
     readonly CREATE_FAILED: "CREATE_FAILED";
 };
-export type NccPrivateEndpointRule_PrivateLinkConnectionState = (typeof NccPrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof NccPrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
+export type NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState = (typeof NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState)[keyof typeof NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState] | (string & {});
 /** Definition of an IP Access list */
 export interface AccountIpAccessList {
     /** Universally unique identifier (UUID) of the IP access list. */
@@ -256,13 +256,13 @@ export interface AccountNetworkPolicy {
     /** The network policies applying for egress traffic. */
     egress?: EgressNetworkPolicy | undefined;
     /** The network policies applying for ingress traffic. */
-    ingress?: CustomerFacingIngressNetworkPolicy | undefined;
+    ingress?: IngressNetworkPolicy | undefined;
     /**
      * The ingress policy for dry run mode. Dry run will always run even if the request
      * is allowed by the ingress policy. When this field is set, the policy will be evaluated
      * and emit logs only without blocking requests.
      */
-    ingressDryRun?: CustomerFacingIngressNetworkPolicy | undefined;
+    ingressDryRun?: IngressNetworkPolicy | undefined;
 }
 export interface AzurePrivateEndpointInfo {
     /** The name of the Private Endpoint in the Azure subscription. */
@@ -297,7 +297,7 @@ export interface CreateEndpointRequest {
     endpoint?: Endpoint | undefined;
 }
 /** Details required to configure a block list or allow list. */
-export interface CreateIpAccessList {
+export interface CreateIpAccessListRequest {
     /** Label for the IP access list. This **cannot** be empty. */
     label?: string | undefined;
     listType?: IpAccessListType | undefined;
@@ -471,481 +471,107 @@ export interface CreateVpcEndpointRequest {
     vpcEndpointInfo?: {
         $case: 'gcpVpcEndpointInfo';
         /** The cloud info of this vpc endpoint. */
-        gcpVpcEndpointInfo: CustomerFacingGcpVpcEndpointInfo;
+        gcpVpcEndpointInfo: GcpVpcEndpointInfo;
     } | undefined;
 }
-export interface CustomerFacingGcpVpcEndpointInfo {
-    pscConnectionId?: string | undefined;
-    projectId?: string | undefined;
-    pscEndpointName?: string | undefined;
-    endpointRegion?: string | undefined;
-    serviceAttachmentId?: string | undefined;
-}
-/**
- * This proto is under development.
- * The network policies applying for ingress traffic.
- * Any changes here should also be synced to estore/namespaces/lakehousenetworkmanager/latest.proto.
- */
-export interface CustomerFacingIngressNetworkPolicy {
-    /**
-     * The network policy restrictions for public access to the workspace.
-     * Configures how public internet traffic is allowed or denied access.
-     */
-    publicAccess?: CustomerFacingIngressNetworkPolicy_PublicAccess | undefined;
+export interface CustomerFacingNetworkConnectivityConfigEgressConfig {
     /**
-     * The network policy restrictions for private access to the workspace.
-     * Configures how registered private endpoints are allowed or denied access.
+     * The network connectivity rules that are applied by default without resource specific configurations.
+     * You can find the stable network information of your serverless compute resources here.
      */
-    privateAccess?: CustomerFacingIngressNetworkPolicy_PrivateAccess | undefined;
-    crossWorkspaceAccess?: CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess | undefined;
+    defaultRules?: NetworkConnectivityConfigEgressConfig_DefaultRule | undefined;
+    /** The network connectivity rules that configured for each destinations. These rules override default rules. */
+    targetRules?: CustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRule | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_AccountApiDestination {
-    scopes?: string[] | undefined;
-    /** Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. */
-    scopeQualifier?: CustomerFacingIngressNetworkPolicy_ApiScopeQualifier | undefined;
+/** Target rule controls the egress rules that are dedicated to specific resources. */
+export interface CustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRule {
+    azurePrivateEndpointRules?: NetworkConnectivityConfigAzurePrivateEndpointRule[] | undefined;
+    /** AWS private endpoint rule controls the AWS private endpoint based egress rules. */
+    awsPrivateEndpointRules?: NetworkConnectivityConfigAwsPrivateEndpointRule[] | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestination {
-    /** Must be set to true. */
-    allDestinations?: boolean | undefined;
+/** Next Id: 3 */
+export interface DeleteAccountIpAccessListRequest {
+    accountId?: string | undefined;
+    /** The ID for the corresponding IP access list */
+    listId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_AccountUiDestination {
-    /** Must be set to true. */
-    allDestinations?: boolean | undefined;
+/** The IP access list was successfully deleted. */
+export interface DeleteAccountIpAccessListResponse {
 }
-export interface CustomerFacingIngressNetworkPolicy_AppsRuntimeDestination {
-    /** Must be set to true. */
-    allDestinations?: boolean | undefined;
+export interface DeleteEndpointRequest {
+    name?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_Authentication {
-    identityType?: CustomerFacingIngressNetworkPolicy_Authentication_IdentityType | undefined;
-    /** Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES. */
-    identities?: CustomerFacingIngressNetworkPolicy_AuthenticationIdentity[] | undefined;
+export interface DeleteIpAccessListRequest {
+    /** The ID for the corresponding IP access list */
+    listId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_AuthenticationIdentity {
-    principalType?: CustomerFacingIngressNetworkPolicy_AuthenticationIdentity_PrincipalType | undefined;
-    principalId?: bigint | undefined;
+/** The IP access list was successfully deleted. */
+export interface DeleteIpAccessListResponse {
 }
-export interface CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess {
-    restrictionMode?: CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode | undefined;
-    denyRules?: CustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRule[] | undefined;
-    allowRules?: CustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRule[] | undefined;
+/**
+ * Initiates deleting a private endpoint rule. If the connection state is PENDING or EXPIRED, the private endpoint is
+ * immediately deleted. Otherwise, the private endpoint is deactivated and will be deleted after one day of
+ * deactivation. When a private endpoint is deactivated, the deactivated field is set to true and the private endpoint
+ * is not available to your serverless compute resources.
+ */
+export interface DeleteNccPrivateEndpointRuleRequest {
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /** Your Network Connectvity Configuration ID. */
+    networkConnectivityConfigId?: string | undefined;
+    /** Your private endpoint rule ID. */
+    privateEndpointRuleId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRule {
-    origin?: CustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOrigin | undefined;
-    destination?: CustomerFacingIngressNetworkPolicy_RequestDestination | undefined;
-    authentication?: CustomerFacingIngressNetworkPolicy_Authentication | undefined;
-    /** The label for this ingress rule. */
-    label?: string | undefined;
+export interface DeleteNetworkConnectivityConfigRequest {
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /** Your Network Connectivity Configuration ID. */
+    networkConnectivityConfigId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOrigin {
-    source?: {
-        $case: 'allSourceWorkspaces';
-        /** Matches all source workspaces. */
-        allSourceWorkspaces: boolean;
-    } | {
-        $case: 'selectedWorkspaces';
-        /** Specific source workspace IDs to match. */
-        selectedWorkspaces: CustomerFacingIngressNetworkPolicy_WorkspaceIdList;
-    } | undefined;
+export interface DeleteNetworkPolicyRequest {
+    /** The unique identifier of the network policy to delete. */
+    networkPolicyId?: string | undefined;
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_Endpoints {
-    endpointIds?: string[] | undefined;
+export interface DeleteNetworkRequest {
+    /** Databricks Account API network configuration ID. */
+    networkId?: string | undefined;
+    accountId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_IpRanges {
-    /** We only support IPv4 and IPv4 CIDR notation for now. */
-    ipRanges?: string[] | undefined;
+export interface DeletePrivateAccessSettingsRequest {
+    privateAccessSettingsId?: string | undefined;
+    accountId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestination {
-    /** Must be set to true. */
-    allDestinations?: boolean | undefined;
+export interface DeleteVpcEndpointRequest {
+    vpcEndpointId?: string | undefined;
+    accountId?: string | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_PrivateAccess {
-    restrictionMode?: CustomerFacingIngressNetworkPolicy_PrivateAccess_RestrictionMode | undefined;
-    denyRules?: CustomerFacingIngressNetworkPolicy_PrivateIngressRule[] | undefined;
-    allowRules?: CustomerFacingIngressNetworkPolicy_PrivateIngressRule[] | undefined;
+/** The network policies applying for egress traffic. */
+export interface EgressNetworkPolicy {
+    /** The access policy enforced for egress traffic to the internet. */
+    networkAccess?: EgressNetworkPolicy_NetworkAccessPolicy | undefined;
 }
-export interface CustomerFacingIngressNetworkPolicy_PrivateIngressRule {
-    origin?: CustomerFacingIngressNetworkPolicy_PrivateRequestOrigin | undefined;
-    destination?: CustomerFacingIngressNetworkPolicy_RequestDestination | undefined;
-    authentication?: CustomerFacingIngressNetworkPolicy_Authentication | undefined;
-    /** The label for this ingress rule. */
-    label?: string | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_PrivateRequestOrigin {
-    source?: {
-        $case: 'endpoints';
-        endpoints: CustomerFacingIngressNetworkPolicy_Endpoints;
-    } | {
-        $case: 'allRegisteredEndpoints';
-        allRegisteredEndpoints: boolean;
-    } | {
-        $case: 'azureWorkspacePrivateLink';
-        azureWorkspacePrivateLink: boolean;
-    } | {
-        $case: 'allPrivateAccess';
-        allPrivateAccess: boolean;
-    } | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_PublicAccess {
-    restrictionMode?: CustomerFacingIngressNetworkPolicy_PublicAccess_RestrictionMode | undefined;
-    denyRules?: CustomerFacingIngressNetworkPolicy_PublicIngressRule[] | undefined;
-    allowRules?: CustomerFacingIngressNetworkPolicy_PublicIngressRule[] | undefined;
-}
-/**
- * An ingress rule is enforced when a request satisfies all
- * specified attributes — including request origin, destination, and authentication.
- */
-export interface CustomerFacingIngressNetworkPolicy_PublicIngressRule {
-    origin?: CustomerFacingIngressNetworkPolicy_PublicRequestOrigin | undefined;
-    destination?: CustomerFacingIngressNetworkPolicy_RequestDestination | undefined;
-    authentication?: CustomerFacingIngressNetworkPolicy_Authentication | undefined;
-    /** The label for this ingress rule. */
-    label?: string | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_PublicRequestOrigin {
-    source?: {
-        $case: 'allIpRanges';
-        /** Matches all IPv4 and IPv6 ranges (both public and private). */
-        allIpRanges: boolean;
-    } | {
-        $case: 'includedIpRanges';
-        /** Will not allow IP ranges with private IPs. */
-        includedIpRanges: CustomerFacingIngressNetworkPolicy_IpRanges;
-    } | {
-        $case: 'excludedIpRanges';
-        /** Excluded means: all public IP ranges except this one. */
-        excludedIpRanges: CustomerFacingIngressNetworkPolicy_IpRanges;
-    } | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_RequestDestination {
-    /**
-     * When true, match all destinations, no other destination fields can be set.
-     * When not set or false, at least one specific destination must be provided.
-     */
-    allDestinations?: boolean | undefined;
-    workspaceUi?: CustomerFacingIngressNetworkPolicy_WorkspaceUiDestination | undefined;
-    workspaceApi?: CustomerFacingIngressNetworkPolicy_WorkspaceApiDestination | undefined;
-    appsRuntime?: CustomerFacingIngressNetworkPolicy_AppsRuntimeDestination | undefined;
-    lakebaseRuntime?: CustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestination | undefined;
-    accountUi?: CustomerFacingIngressNetworkPolicy_AccountUiDestination | undefined;
-    accountApi?: CustomerFacingIngressNetworkPolicy_AccountApiDestination | undefined;
-    /**
-     * Account DatabricksOne destination is not supported.
-     * DO NOT change the stage of this destination past PRIVATE_PREVIEW.
-     */
-    accountDatabricksOne?: CustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestination | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_WorkspaceApiDestination {
-    scopes?: string[] | undefined;
-    /** Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. */
-    scopeQualifier?: CustomerFacingIngressNetworkPolicy_ApiScopeQualifier | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_WorkspaceIdList {
-    workspaceIds?: bigint[] | undefined;
-}
-export interface CustomerFacingIngressNetworkPolicy_WorkspaceUiDestination {
-    /** Must be set to true. */
-    allDestinations?: boolean | undefined;
-}
-/** Properties of the new network connectivity configuration. */
-export interface CustomerFacingNetworkConnectivityConfig {
-    /** <Databricks> network connectivity configuration ID. */
-    networkConnectivityConfigId?: string | undefined;
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /**
-     * The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,
-     * and underscores. The length must be between 3 and 30 characters. The name must match the regular
-     * expression ^[0-9a-zA-Z-_]{3,30}$
-     */
-    name?: string | undefined;
-    /**
-     * The region for the network connectivity configuration.
-     * Only workspaces in the same region can be attached to the network connectivity configuration.
-     */
-    region?: string | undefined;
-    /** The network connectivity rules that apply to network traffic from your serverless compute resources. */
-    egressConfig?: CustomerFacingNetworkConnectivityConfigEgressConfig | undefined;
-    /** Time in epoch milliseconds when this object was updated. */
-    updatedTime?: bigint | undefined;
-    /** Time in epoch milliseconds when this object was created. */
-    creationTime?: bigint | undefined;
-}
-/**
- * Properties of the new private endpoint rule.
- * Note that for private endpoints towards a VPC endpoint service behind a customer-managed NLB,
- * you must approve the endpoint in AWS console after initialization.
- */
-export interface CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule {
-    /** The ID of a private endpoint rule. */
-    ruleId?: string | undefined;
-    /** The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object. */
-    networkConnectivityConfigId?: string | undefined;
-    /** <Databricks> account ID. You can find your account ID from the Accounts Console. */
-    accountId?: string | undefined;
-    /** The full target AWS endpoint service name that connects to the destination resources of the private endpoint. */
-    endpointService?: string | undefined;
-    /**
-     * Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.
-     *
-     * The target AWS resource FQDNs accessible via the VPC endpoint service.
-     * When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.
-     */
-    domainNames?: string[] | undefined;
-    /**
-     * Only used by private endpoints towards AWS S3 service.
-     *
-     * The globally unique S3 bucket names that will be accessed via the VPC endpoint.
-     * The bucket names must be in the same region as the NCC/endpoint service.
-     * When updating this field, we perform full update on this field.
-     * Please ensure a full list of desired resource_names is provided.
-     */
-    resourceNames?: string[] | undefined;
-    /** The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by <Databricks>. */
-    vpcEndpointId?: string | undefined;
-    /**
-     * The current status of this private endpoint. The private endpoint rules are effective only if the connection state
-     * is ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console
-     * before they take effect.
-     * The possible values are:
-     * - PENDING: The endpoint has been created and pending approval.
-     * - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
-     * - REJECTED: Connection was rejected by the private link resource owner.
-     * - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
-     * - EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.
-     */
-    connectionState?: CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState | undefined;
-    /** Time in epoch milliseconds when this object was created. */
-    creationTime?: bigint | undefined;
-    /** Time in epoch milliseconds when this object was updated. */
-    updatedTime?: bigint | undefined;
-    /** Whether this private endpoint is deactivated. */
-    deactivated?: boolean | undefined;
-    /** Time in epoch milliseconds when this object was deactivated. */
-    deactivatedAt?: bigint | undefined;
-    /**
-     * Only used by private endpoints towards an AWS S3 service.
-     *
-     * Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.
-     */
-    enabled?: boolean | undefined;
-    errorMessage?: string | undefined;
-}
-/**
- * Properties of the new private endpoint rule.
- * Note that you must approve the endpoint in Azure portal after initialization.
- */
-export interface CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule {
-    /** The ID of a private endpoint rule. */
-    ruleId?: string | undefined;
-    /** The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object. */
-    networkConnectivityConfigId?: string | undefined;
-    /** The Azure resource ID of the target resource. */
-    resourceId?: string | undefined;
-    /**
-     * Only used by private endpoints to Azure first-party services.
-     *
-     * The sub-resource type (group ID) of the target resource.
-     * Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.
-     */
-    groupId?: string | undefined;
-    /** The name of the Azure private endpoint resource. */
-    endpointName?: string | undefined;
-    /**
-     * The current status of this private endpoint. The private endpoint rules are effective only if the connection state
-     * is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal
-     * before they take effect.
-     * The possible values are:
-     * - INIT: (deprecated) The endpoint has been created and pending approval.
-     * - PENDING: The endpoint has been created and pending approval.
-     * - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
-     * - REJECTED: Connection was rejected by the private link resource owner.
-     * - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
-     * - EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
-     */
-    connectionState?: CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState | undefined;
-    /** Time in epoch milliseconds when this object was created. */
-    creationTime?: bigint | undefined;
-    /** Time in epoch milliseconds when this object was updated. */
-    updatedTime?: bigint | undefined;
-    /** Whether this private endpoint is deactivated. */
-    deactivated?: boolean | undefined;
-    /** Time in epoch milliseconds when this object was deactivated. */
-    deactivatedAt?: bigint | undefined;
-    /**
-     * Not used by customer-managed private endpoint services.
-     *
-     * Domain names of target private link service.
-     * When updating this field, the full list of target domain_names must be specified.
-     */
-    domainNames?: string[] | undefined;
-    errorMessage?: string | undefined;
-}
-export interface CustomerFacingNetworkConnectivityConfigEgressConfig {
-    /**
-     * The network connectivity rules that are applied by default without resource specific configurations.
-     * You can find the stable network information of your serverless compute resources here.
-     */
-    defaultRules?: NetworkConnectivityConfigEgressConfig_DefaultRule | undefined;
-    /** The network connectivity rules that configured for each destinations. These rules override default rules. */
-    targetRules?: CustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRule | undefined;
-}
-/** Target rule controls the egress rules that are dedicated to specific resources. */
-export interface CustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRule {
-    azurePrivateEndpointRules?: CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule[] | undefined;
-    /** AWS private endpoint rule controls the AWS private endpoint based egress rules. */
-    awsPrivateEndpointRules?: CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule[] | undefined;
-}
-/** * */
-export interface CustomerFacingPrivateAccessSettings {
-    /** <Databricks> private access settings ID. */
-    privateAccessSettingsId?: string | undefined;
-    /** The <Databricks> account ID that hosts the private access settings. */
-    accountId?: string | undefined;
-    /** The human-readable name of the private access settings object. */
-    privateAccessSettingsName?: string | undefined;
-    /** The AWS region for workspaces attached to this private access settings object. */
-    region?: string | undefined;
-    /** Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled. */
-    publicAccessEnabled?: boolean | undefined;
-    /**
-     * The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.
-     * `ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your <Databricks> account connect to your workspace.
-     * `ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.
-     */
-    privateAccessLevel?: PrivateAccessLevel | undefined;
-    /**
-     * An array of Databricks VPC endpoint IDs. This is the <Databricks> ID that is returned when registering the VPC endpoint configuration in your <Databricks> account. This is not the ID of the VPC endpoint in AWS.
-     * Only used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints that in your account that can connect to your workspace over AWS PrivateLink.
-     * If hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.
-     */
-    allowedVpcEndpointIds?: string[] | undefined;
-}
-/** * */
-export interface CustomerFacingVpcEndpoint {
-    /** Databricks VPC endpoint ID. This is the <Databricks>-specific name of the VPC endpoint. Do not confuse this with the `aws_vpc_endpoint_id`, which is the ID within AWS of the VPC endpoint. */
-    vpcEndpointId?: string | undefined;
-    /**
-     * The <Databricks> account ID that hosts the VPC endpoint configuration.
-     * TODO - This may signal an OpenAPI diff; it does not show up in the generated spec
-     */
-    accountId?: string | undefined;
-    /** The human-readable name of the storage configuration. */
-    vpcEndpointName?: string | undefined;
-    /** The ID of the VPC endpoint object in AWS. */
-    awsVpcEndpointId?: string | undefined;
-    /** The ID of the <Databricks> [endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-service.html) that this VPC endpoint is connected to. For a list of endpoint service IDs for each supported AWS region, see the [Databricks PrivateLink documentation](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html). */
-    awsEndpointServiceId?: string | undefined;
-    /**
-     * This enumeration represents the type of Databricks VPC endpoint service that was used when creating this VPC endpoint.
-     * If the VPC endpoint connects to the <Databricks> control plane for either the front-end connection or the back-end REST API connection, the value is GENERAL_ACCESS.
-     * If the VPC endpoint connects to the <Databricks> workspace for the back-end secure cluster connectivity relay, the value is DATAPLANE_RELAY_ACCESS.
-     */
-    useCase?: CustomerFacingVpcEndpointUseCase | undefined;
-    /** The AWS region in which this VPC endpoint object exists. */
-    region?: string | undefined;
-    /** The AWS Account in which the VPC endpoint object exists. */
-    awsAccountId?: string | undefined;
-    /** The current state (such as `available` or `rejected`) of the VPC endpoint. Derived from AWS. For the full set of values, see [AWS DescribeVpcEndpoint documentation](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html). */
-    state?: string | undefined;
-    vpcEndpointInfo?: {
-        $case: 'gcpVpcEndpointInfo';
-        /**
-         * The cloud info of this vpc endpoint.
-         * Info for a GCP vpc endpoint.
-         */
-        gcpVpcEndpointInfo: CustomerFacingGcpVpcEndpointInfo;
-    } | undefined;
-}
-/** Next Id: 3 */
-export interface DeleteAccountIpAccessListRequest {
-    accountId?: string | undefined;
-    /** The ID for the corresponding IP access list */
-    listId?: string | undefined;
-}
-/** The IP access list was successfully deleted. */
-export interface DeleteAccountIpAccessListResponse {
-}
-export interface DeleteEndpointRequest {
-    name?: string | undefined;
-}
-export interface DeleteIpAccessList {
-    /** The ID for the corresponding IP access list */
-    listId?: string | undefined;
-}
-/** The IP access list was successfully deleted. */
-export interface DeleteIpAccessListResponse {
-}
-/**
- * Initiates deleting a private endpoint rule. If the connection state is PENDING or EXPIRED, the private endpoint is
- * immediately deleted. Otherwise, the private endpoint is deactivated and will be deleted after one day of
- * deactivation. When a private endpoint is deactivated, the deactivated field is set to true and the private endpoint
- * is not available to your serverless compute resources.
- */
-export interface DeleteNccPrivateEndpointRuleRequest {
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /** Your Network Connectvity Configuration ID. */
-    networkConnectivityConfigId?: string | undefined;
-    /** Your private endpoint rule ID. */
-    privateEndpointRuleId?: string | undefined;
-}
-export interface DeleteNetworkConnectivityConfigRequest {
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /** Your Network Connectivity Configuration ID. */
-    networkConnectivityConfigId?: string | undefined;
-}
-export interface DeleteNetworkPolicyRequest {
-    /** The unique identifier of the network policy to delete. */
-    networkPolicyId?: string | undefined;
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-}
-export interface DeleteNetworkRequest {
-    /** Databricks Account API network configuration ID. */
-    networkId?: string | undefined;
-    accountId?: string | undefined;
-}
-export interface DeletePrivateAccessSettingsRequest {
-    privateAccessSettingsId?: string | undefined;
-    accountId?: string | undefined;
-}
-export interface DeleteVpcEndpointRequest {
-    vpcEndpointId?: string | undefined;
-    accountId?: string | undefined;
-}
-/**
- * The network policies applying for egress traffic.
- * This message is used by the UI/REST API. We translate this message to the format expected by the
- * dataplane in Lakehouse Network Manager (for the format expected by the dataplane, see networkconfig.textproto).
- * This policy should be consistent with [[com.databricks.api.proto.settingspolicy.EgressNetworkPolicy]].
- * Details see API-design: https://docs.google.com/document/d/1DKWO_FpZMCY4cF2O62LpwII1lx8gsnDGG-qgE3t3TOA/
- */
-export interface EgressNetworkPolicy {
-    /** The access policy enforced for egress traffic to the internet. */
-    networkAccess?: EgressNetworkPolicy_NetworkAccessPolicy | undefined;
-}
-export interface EgressNetworkPolicy_NetworkAccessPolicy {
-    /** The restriction mode that controls how serverless workloads can access the internet. */
-    restrictionMode?: EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode | undefined;
-    /** List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. */
-    allowedInternetDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination[] | undefined;
-    /** List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. */
-    allowedStorageDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination[] | undefined;
-    /** Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES */
-    policyEnforcement?: EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement | undefined;
-    /**
-     * List of internet destinations that serverless workloads are blocked from accessing.
-     * These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
-     * Currently supports DNS_NAME type only; IP_RANGE support is planned.
-     */
-    blockedInternetDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination[] | undefined;
-    /**
-     * List of <Databricks> workspace destinations that serverless workloads are
-     * allowed to access when in RESTRICTED_ACCESS mode.
-     */
-    allowedDatabricksDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestination[] | undefined;
+export interface EgressNetworkPolicy_NetworkAccessPolicy {
+    /** The restriction mode that controls how serverless workloads can access the internet. */
+    restrictionMode?: EgressNetworkPolicy_NetworkAccessPolicy_RestrictionMode | undefined;
+    /** List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. */
+    allowedInternetDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination[] | undefined;
+    /** List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode. */
+    allowedStorageDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_StorageDestination[] | undefined;
+    /** Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES */
+    policyEnforcement?: EgressNetworkPolicy_NetworkAccessPolicy_PolicyEnforcement | undefined;
+    /**
+     * List of internet destinations that serverless workloads are blocked from accessing.
+     * These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
+     * Currently supports DNS_NAME type only; IP_RANGE support is planned.
+     */
+    blockedInternetDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_InternetDestination[] | undefined;
+    /**
+     * List of <Databricks> workspace destinations that serverless workloads are
+     * allowed to access when in RESTRICTED_ACCESS mode.
+     */
+    allowedDatabricksDestinations?: EgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestination[] | undefined;
 }
 export interface EgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestination {
     /** The workspace IDs to allow egress traffic to. */
@@ -1056,6 +682,13 @@ export interface GcpNetworkInfo {
     /** Name of the secondary range within the subnet that will be used by GKE as Service IP range. */
     serviceIpRangeName?: string | undefined;
 }
+export interface GcpVpcEndpointInfo {
+    pscConnectionId?: string | undefined;
+    projectId?: string | undefined;
+    pscEndpointName?: string | undefined;
+    endpointRegion?: string | undefined;
+    serviceAttachmentId?: string | undefined;
+}
 /** Next Id: 3 */
 export interface GetAccountIpAccessListRequest {
     accountId?: string | undefined;
@@ -1068,7 +701,7 @@ export interface GetAccountIpAccessListResponse {
 export interface GetEndpointRequest {
     name?: string | undefined;
 }
-export interface GetIpAccessList {
+export interface GetIpAccessListRequest {
     /** The ID for the corresponding IP access list */
     listId?: string | undefined;
 }
@@ -1076,46 +709,212 @@ export interface GetIpAccessList {
 export interface GetIpAccessListResponse {
     ipAccessList?: IpAccessList | undefined;
 }
-export interface GetNccPrivateEndpointRuleRequest {
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /** Your Network Connectvity Configuration ID. */
-    networkConnectivityConfigId?: string | undefined;
-    /** Your private endpoint rule ID. */
-    privateEndpointRuleId?: string | undefined;
+export interface GetNccPrivateEndpointRuleRequest {
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /** Your Network Connectvity Configuration ID. */
+    networkConnectivityConfigId?: string | undefined;
+    /** Your private endpoint rule ID. */
+    privateEndpointRuleId?: string | undefined;
+}
+/** ***************************** Public facing RPC requests and responses *****************************\// */
+export interface GetNetworkConnectivityConfigRequest {
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /** Your Network Connectivity Configuration ID. */
+    networkConnectivityConfigId?: string | undefined;
+}
+export interface GetNetworkPolicyRequest {
+    /** The unique identifier of the network policy to retrieve. */
+    networkPolicyId?: string | undefined;
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+}
+export interface GetNetworkRequest {
+    /** Databricks Account API network configuration ID. */
+    networkId?: string | undefined;
+    accountId?: string | undefined;
+}
+export interface GetPrivateAccessSettingsRequest {
+    privateAccessSettingsId?: string | undefined;
+    accountId?: string | undefined;
+}
+export interface GetVpcEndpointRequest {
+    /** Databricks VPC endpoint ID. */
+    vpcEndpointId?: string | undefined;
+    accountId?: string | undefined;
+}
+export interface GetWorkspaceNetworkOptionRequest {
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /** The workspace ID. */
+    workspaceId?: bigint | undefined;
+}
+/**
+ * This proto is under development.
+ * The network policies applying for ingress traffic.
+ * Any changes here should also be synced to estore/namespaces/lakehousenetworkmanager/latest.proto.
+ */
+export interface IngressNetworkPolicy {
+    /**
+     * The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access.
+     */
+    publicAccess?: IngressNetworkPolicy_PublicAccess | undefined;
+    /**
+     * The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access.
+     */
+    privateAccess?: IngressNetworkPolicy_PrivateAccess | undefined;
+    crossWorkspaceAccess?: IngressNetworkPolicy_CrossWorkspaceAccess | undefined;
+}
+export interface IngressNetworkPolicy_AccountApiDestination {
+    scopes?: string[] | undefined;
+    /** Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. */
+    scopeQualifier?: IngressNetworkPolicy_ApiScopeQualifier | undefined;
+}
+export interface IngressNetworkPolicy_AccountDatabricksOneDestination {
+    /** Must be set to true. */
+    allDestinations?: boolean | undefined;
+}
+export interface IngressNetworkPolicy_AccountUiDestination {
+    /** Must be set to true. */
+    allDestinations?: boolean | undefined;
+}
+export interface IngressNetworkPolicy_AppsRuntimeDestination {
+    /** Must be set to true. */
+    allDestinations?: boolean | undefined;
+}
+export interface IngressNetworkPolicy_Authentication {
+    identityType?: IngressNetworkPolicy_Authentication_IdentityType | undefined;
+    /** Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES. */
+    identities?: IngressNetworkPolicy_AuthenticationIdentity[] | undefined;
+}
+export interface IngressNetworkPolicy_AuthenticationIdentity {
+    principalType?: IngressNetworkPolicy_AuthenticationIdentity_PrincipalType | undefined;
+    principalId?: bigint | undefined;
+}
+export interface IngressNetworkPolicy_CrossWorkspaceAccess {
+    restrictionMode?: IngressNetworkPolicy_CrossWorkspaceAccess_RestrictionMode | undefined;
+    denyRules?: IngressNetworkPolicy_CrossWorkspaceIngressRule[] | undefined;
+    allowRules?: IngressNetworkPolicy_CrossWorkspaceIngressRule[] | undefined;
+}
+export interface IngressNetworkPolicy_CrossWorkspaceIngressRule {
+    origin?: IngressNetworkPolicy_CrossWorkspaceRequestOrigin | undefined;
+    destination?: IngressNetworkPolicy_RequestDestination | undefined;
+    authentication?: IngressNetworkPolicy_Authentication | undefined;
+    /** The label for this ingress rule. */
+    label?: string | undefined;
+}
+export interface IngressNetworkPolicy_CrossWorkspaceRequestOrigin {
+    source?: {
+        $case: 'allSourceWorkspaces';
+        /** Matches all source workspaces. */
+        allSourceWorkspaces: boolean;
+    } | {
+        $case: 'selectedWorkspaces';
+        /** Specific source workspace IDs to match. */
+        selectedWorkspaces: IngressNetworkPolicy_WorkspaceIdList;
+    } | undefined;
+}
+export interface IngressNetworkPolicy_Endpoints {
+    endpointIds?: string[] | undefined;
+}
+export interface IngressNetworkPolicy_IpRanges {
+    /** We only support IPv4 and IPv4 CIDR notation for now. */
+    ipRanges?: string[] | undefined;
+}
+export interface IngressNetworkPolicy_LakebaseRuntimeDestination {
+    /** Must be set to true. */
+    allDestinations?: boolean | undefined;
+}
+export interface IngressNetworkPolicy_PrivateAccess {
+    restrictionMode?: IngressNetworkPolicy_PrivateAccess_RestrictionMode | undefined;
+    denyRules?: IngressNetworkPolicy_PrivateIngressRule[] | undefined;
+    allowRules?: IngressNetworkPolicy_PrivateIngressRule[] | undefined;
+}
+export interface IngressNetworkPolicy_PrivateIngressRule {
+    origin?: IngressNetworkPolicy_PrivateRequestOrigin | undefined;
+    destination?: IngressNetworkPolicy_RequestDestination | undefined;
+    authentication?: IngressNetworkPolicy_Authentication | undefined;
+    /** The label for this ingress rule. */
+    label?: string | undefined;
+}
+export interface IngressNetworkPolicy_PrivateRequestOrigin {
+    source?: {
+        $case: 'endpoints';
+        endpoints: IngressNetworkPolicy_Endpoints;
+    } | {
+        $case: 'allRegisteredEndpoints';
+        allRegisteredEndpoints: boolean;
+    } | {
+        $case: 'azureWorkspacePrivateLink';
+        azureWorkspacePrivateLink: boolean;
+    } | {
+        $case: 'allPrivateAccess';
+        allPrivateAccess: boolean;
+    } | undefined;
+}
+export interface IngressNetworkPolicy_PublicAccess {
+    restrictionMode?: IngressNetworkPolicy_PublicAccess_RestrictionMode | undefined;
+    denyRules?: IngressNetworkPolicy_PublicIngressRule[] | undefined;
+    allowRules?: IngressNetworkPolicy_PublicIngressRule[] | undefined;
 }
-/** ***************************** Public facing RPC requests and responses *****************************\// */
-export interface GetNetworkConnectivityConfigRequest {
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /** Your Network Connectivity Configuration ID. */
-    networkConnectivityConfigId?: string | undefined;
+/**
+ * An ingress rule is enforced when a request satisfies all
+ * specified attributes — including request origin, destination, and authentication.
+ */
+export interface IngressNetworkPolicy_PublicIngressRule {
+    origin?: IngressNetworkPolicy_PublicRequestOrigin | undefined;
+    destination?: IngressNetworkPolicy_RequestDestination | undefined;
+    authentication?: IngressNetworkPolicy_Authentication | undefined;
+    /** The label for this ingress rule. */
+    label?: string | undefined;
 }
-export interface GetNetworkPolicyRequest {
-    /** The unique identifier of the network policy to retrieve. */
-    networkPolicyId?: string | undefined;
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
+export interface IngressNetworkPolicy_PublicRequestOrigin {
+    source?: {
+        $case: 'allIpRanges';
+        /** Matches all IPv4 and IPv6 ranges (both public and private). */
+        allIpRanges: boolean;
+    } | {
+        $case: 'includedIpRanges';
+        /** Will not allow IP ranges with private IPs. */
+        includedIpRanges: IngressNetworkPolicy_IpRanges;
+    } | {
+        $case: 'excludedIpRanges';
+        /** Excluded means: all public IP ranges except this one. */
+        excludedIpRanges: IngressNetworkPolicy_IpRanges;
+    } | undefined;
 }
-export interface GetNetworkRequest {
-    /** Databricks Account API network configuration ID. */
-    networkId?: string | undefined;
-    accountId?: string | undefined;
+export interface IngressNetworkPolicy_RequestDestination {
+    /**
+     * When true, match all destinations, no other destination fields can be set.
+     * When not set or false, at least one specific destination must be provided.
+     */
+    allDestinations?: boolean | undefined;
+    workspaceUi?: IngressNetworkPolicy_WorkspaceUiDestination | undefined;
+    workspaceApi?: IngressNetworkPolicy_WorkspaceApiDestination | undefined;
+    appsRuntime?: IngressNetworkPolicy_AppsRuntimeDestination | undefined;
+    lakebaseRuntime?: IngressNetworkPolicy_LakebaseRuntimeDestination | undefined;
+    accountUi?: IngressNetworkPolicy_AccountUiDestination | undefined;
+    accountApi?: IngressNetworkPolicy_AccountApiDestination | undefined;
+    /**
+     * Account DatabricksOne destination is not supported.
+     * DO NOT change the stage of this destination past PRIVATE_PREVIEW.
+     */
+    accountDatabricksOne?: IngressNetworkPolicy_AccountDatabricksOneDestination | undefined;
 }
-export interface GetPrivateAccessSettingsRequest {
-    privateAccessSettingsId?: string | undefined;
-    accountId?: string | undefined;
+export interface IngressNetworkPolicy_WorkspaceApiDestination {
+    scopes?: string[] | undefined;
+    /** Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. */
+    scopeQualifier?: IngressNetworkPolicy_ApiScopeQualifier | undefined;
 }
-export interface GetVpcEndpointRequest {
-    /** Databricks VPC endpoint ID. */
-    vpcEndpointId?: string | undefined;
-    accountId?: string | undefined;
+export interface IngressNetworkPolicy_WorkspaceIdList {
+    workspaceIds?: bigint[] | undefined;
 }
-export interface GetWorkspaceNetworkOptionRequest {
-    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
-    accountId?: string | undefined;
-    /** The workspace ID. */
-    workspaceId?: bigint | undefined;
+export interface IngressNetworkPolicy_WorkspaceUiDestination {
+    /** Must be set to true. */
+    allDestinations?: boolean | undefined;
 }
 /** Definition of an IP Access list */
 export interface IpAccessList {
@@ -1188,7 +987,7 @@ export interface ListNetworkConnectivityConfigsRequest {
 }
 /** The network connectivity configuration list was successfully retrieved. */
 export interface ListNetworkConnectivityConfigsResponse {
-    items?: CustomerFacingNetworkConnectivityConfig[] | undefined;
+    items?: NetworkConnectivityConfig[] | undefined;
     /** A token that can be used to get the next page of results. If null, there are no more results to show. */
     nextPageToken?: string | undefined;
 }
@@ -1214,13 +1013,13 @@ export interface ListPrivateAccessSettingsRequest {
     accountId?: string | undefined;
 }
 export interface ListPrivateAccessSettingsResponse {
-    privateAccessSettings?: CustomerFacingPrivateAccessSettings[] | undefined;
+    privateAccessSettings?: PrivateAccessSettings[] | undefined;
 }
 export interface ListVpcEndpointRequest {
     accountId?: string | undefined;
 }
 export interface ListVpcEndpointResponse {
-    vpcEndpoints?: CustomerFacingVpcEndpoint[] | undefined;
+    vpcEndpoints?: VpcEndpoint[] | undefined;
 }
 /**
  * Properties of the new private endpoint rule.
@@ -1325,6 +1124,140 @@ export interface Network {
         gcpNetworkInfo: GcpNetworkInfo;
     } | undefined;
 }
+/** Properties of the new network connectivity configuration. */
+export interface NetworkConnectivityConfig {
+    /** <Databricks> network connectivity configuration ID. */
+    networkConnectivityConfigId?: string | undefined;
+    /** Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console. */
+    accountId?: string | undefined;
+    /**
+     * The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,
+     * and underscores. The length must be between 3 and 30 characters. The name must match the regular
+     * expression ^[0-9a-zA-Z-_]{3,30}$
+     */
+    name?: string | undefined;
+    /**
+     * The region for the network connectivity configuration.
+     * Only workspaces in the same region can be attached to the network connectivity configuration.
+     */
+    region?: string | undefined;
+    /** The network connectivity rules that apply to network traffic from your serverless compute resources. */
+    egressConfig?: CustomerFacingNetworkConnectivityConfigEgressConfig | undefined;
+    /** Time in epoch milliseconds when this object was updated. */
+    updatedTime?: bigint | undefined;
+    /** Time in epoch milliseconds when this object was created. */
+    creationTime?: bigint | undefined;
+}
+/**
+ * Properties of the new private endpoint rule.
+ * Note that for private endpoints towards a VPC endpoint service behind a customer-managed NLB,
+ * you must approve the endpoint in AWS console after initialization.
+ */
+export interface NetworkConnectivityConfigAwsPrivateEndpointRule {
+    /** The ID of a private endpoint rule. */
+    ruleId?: string | undefined;
+    /** The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object. */
+    networkConnectivityConfigId?: string | undefined;
+    /** <Databricks> account ID. You can find your account ID from the Accounts Console. */
+    accountId?: string | undefined;
+    /** The full target AWS endpoint service name that connects to the destination resources of the private endpoint. */
+    endpointService?: string | undefined;
+    /**
+     * Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.
+     *
+     * The target AWS resource FQDNs accessible via the VPC endpoint service.
+     * When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.
+     */
+    domainNames?: string[] | undefined;
+    /**
+     * Only used by private endpoints towards AWS S3 service.
+     *
+     * The globally unique S3 bucket names that will be accessed via the VPC endpoint.
+     * The bucket names must be in the same region as the NCC/endpoint service.
+     * When updating this field, we perform full update on this field.
+     * Please ensure a full list of desired resource_names is provided.
+     */
+    resourceNames?: string[] | undefined;
+    /** The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by <Databricks>. */
+    vpcEndpointId?: string | undefined;
+    /**
+     * The current status of this private endpoint. The private endpoint rules are effective only if the connection state
+     * is ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console
+     * before they take effect.
+     * The possible values are:
+     * - PENDING: The endpoint has been created and pending approval.
+     * - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
+     * - REJECTED: Connection was rejected by the private link resource owner.
+     * - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
+     * - EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.
+     */
+    connectionState?: NetworkConnectivityConfigAwsPrivateEndpointRule_PrivateLinkConnectionState | undefined;
+    /** Time in epoch milliseconds when this object was created. */
+    creationTime?: bigint | undefined;
+    /** Time in epoch milliseconds when this object was updated. */
+    updatedTime?: bigint | undefined;
+    /** Whether this private endpoint is deactivated. */
+    deactivated?: boolean | undefined;
+    /** Time in epoch milliseconds when this object was deactivated. */
+    deactivatedAt?: bigint | undefined;
+    /**
+     * Only used by private endpoints towards an AWS S3 service.
+     *
+     * Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.
+     */
+    enabled?: boolean | undefined;
+    errorMessage?: string | undefined;
+}
+/**
+ * Properties of the new private endpoint rule.
+ * Note that you must approve the endpoint in Azure portal after initialization.
+ */
+export interface NetworkConnectivityConfigAzurePrivateEndpointRule {
+    /** The ID of a private endpoint rule. */
+    ruleId?: string | undefined;
+    /** The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object. */
+    networkConnectivityConfigId?: string | undefined;
+    /** The Azure resource ID of the target resource. */
+    resourceId?: string | undefined;
+    /**
+     * Only used by private endpoints to Azure first-party services.
+     *
+     * The sub-resource type (group ID) of the target resource.
+     * Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.
+     */
+    groupId?: string | undefined;
+    /** The name of the Azure private endpoint resource. */
+    endpointName?: string | undefined;
+    /**
+     * The current status of this private endpoint. The private endpoint rules are effective only if the connection state
+     * is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal
+     * before they take effect.
+     * The possible values are:
+     * - INIT: (deprecated) The endpoint has been created and pending approval.
+     * - PENDING: The endpoint has been created and pending approval.
+     * - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
+     * - REJECTED: Connection was rejected by the private link resource owner.
+     * - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
+     * - EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
+     */
+    connectionState?: NetworkConnectivityConfigAzurePrivateEndpointRule_PrivateLinkConnectionState | undefined;
+    /** Time in epoch milliseconds when this object was created. */
+    creationTime?: bigint | undefined;
+    /** Time in epoch milliseconds when this object was updated. */
+    updatedTime?: bigint | undefined;
+    /** Whether this private endpoint is deactivated. */
+    deactivated?: boolean | undefined;
+    /** Time in epoch milliseconds when this object was deactivated. */
+    deactivatedAt?: bigint | undefined;
+    /**
+     * Not used by customer-managed private endpoint services.
+     *
+     * Domain names of target private link service.
+     * When updating this field, the full list of target domain_names must be specified.
+     */
+    domainNames?: string[] | undefined;
+    errorMessage?: string | undefined;
+}
 /**
  * Egress network configurations. Provides network configurations for Databricks -> Customer
  * traffic.
@@ -1369,6 +1302,31 @@ export interface NetworkWarning {
     /** Details of the warning. */
     warningMessage?: string | undefined;
 }
+/** * */
+export interface PrivateAccessSettings {
+    /** <Databricks> private access settings ID. */
+    privateAccessSettingsId?: string | undefined;
+    /** The <Databricks> account ID that hosts the private access settings. */
+    accountId?: string | undefined;
+    /** The human-readable name of the private access settings object. */
+    privateAccessSettingsName?: string | undefined;
+    /** The AWS region for workspaces attached to this private access settings object. */
+    region?: string | undefined;
+    /** Determines if the workspace can be accessed over public internet. For fully private workspaces, you can optionally specify false, but only if you implement both the front-end and the back-end PrivateLink connections. Otherwise, specify true, which means that public access is enabled. */
+    publicAccessEnabled?: boolean | undefined;
+    /**
+     * The private access level controls which VPC endpoints can connect to the UI or API of any workspace that attaches this private access settings object.
+     * `ACCOUNT` level access (the default) allows only VPC endpoints that are registered in your <Databricks> account connect to your workspace.
+     * `ENDPOINT` level access allows only specified VPC endpoints connect to your workspace. For details, see allowed_vpc_endpoint_ids.
+     */
+    privateAccessLevel?: PrivateAccessLevel | undefined;
+    /**
+     * An array of Databricks VPC endpoint IDs. This is the <Databricks> ID that is returned when registering the VPC endpoint configuration in your <Databricks> account. This is not the ID of the VPC endpoint in AWS.
+     * Only used when private_access_level is set to ENDPOINT. This is an allow list of VPC endpoints that in your account that can connect to your workspace over AWS PrivateLink.
+     * If hybrid access to your workspace is enabled by setting public_access_enabled to true, this control only works for PrivateLink connections. To control how your workspace is accessed via public internet, see IP access lists.
+     */
+    allowedVpcEndpointIds?: string[] | undefined;
+}
 /** Details required to replace an IP access list. */
 export interface ReplaceAccountIpAccessListRequest {
     accountId?: string | undefined;
@@ -1386,7 +1344,7 @@ export interface ReplaceAccountIpAccessListResponse {
     ipAccessList?: AccountIpAccessList | undefined;
 }
 /** Details required to replace an IP access list. */
-export interface ReplaceIpAccessList {
+export interface ReplaceIpAccessListRequest {
     /** The ID for the corresponding IP access list */
     listId?: string | undefined;
     /** Label for the IP access list. This **cannot** be empty. */
@@ -1417,7 +1375,7 @@ export interface UpdateAccountIpAccessListResponse {
     ipAccessList?: AccountIpAccessList | undefined;
 }
 /** Details required to update an IP access list. */
-export interface UpdateIpAccessList {
+export interface UpdateIpAccessListRequest {
     /** The ID for the corresponding IP access list */
     listId?: string | undefined;
     /** Label for the IP access list. This **cannot** be empty. */
@@ -1452,7 +1410,7 @@ export interface UpdateNetworkPolicyRequest {
 }
 export interface UpdatePrivateAccessSettingsRequest {
     /** Properties of the new private access settings object. */
-    customerFacingPrivateAccessSettings?: CustomerFacingPrivateAccessSettings | undefined;
+    customerFacingPrivateAccessSettings?: PrivateAccessSettings | undefined;
 }
 /**
  * Properties of the new private endpoint rule.
@@ -1537,6 +1495,39 @@ export interface UpdateWorkspaceNetworkOptionRequest {
     /** The network option details for the workspace. */
     workspaceNetworkOption?: WorkspaceNetworkOption | undefined;
 }
+/** * */
+export interface VpcEndpoint {
+    /** Databricks VPC endpoint ID. This is the <Databricks>-specific name of the VPC endpoint. Do not confuse this with the `aws_vpc_endpoint_id`, which is the ID within AWS of the VPC endpoint. */
+    vpcEndpointId?: string | undefined;
+    /** The <Databricks> account ID that hosts the VPC endpoint configuration. */
+    accountId?: string | undefined;
+    /** The human-readable name of the storage configuration. */
+    vpcEndpointName?: string | undefined;
+    /** The ID of the VPC endpoint object in AWS. */
+    awsVpcEndpointId?: string | undefined;
+    /** The ID of the <Databricks> [endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/endpoint-service.html) that this VPC endpoint is connected to. For a list of endpoint service IDs for each supported AWS region, see the [Databricks PrivateLink documentation](https://docs.databricks.com/administration-guide/cloud-configurations/aws/privatelink.html). */
+    awsEndpointServiceId?: string | undefined;
+    /**
+     * This enumeration represents the type of Databricks VPC endpoint service that was used when creating this VPC endpoint.
+     * If the VPC endpoint connects to the <Databricks> control plane for either the front-end connection or the back-end REST API connection, the value is GENERAL_ACCESS.
+     * If the VPC endpoint connects to the <Databricks> workspace for the back-end secure cluster connectivity relay, the value is DATAPLANE_RELAY_ACCESS.
+     */
+    useCase?: VpcEndpointUseCase | undefined;
+    /** The AWS region in which this VPC endpoint object exists. */
+    region?: string | undefined;
+    /** The AWS Account in which the VPC endpoint object exists. */
+    awsAccountId?: string | undefined;
+    /** The current state (such as `available` or `rejected`) of the VPC endpoint. Derived from AWS. For the full set of values, see [AWS DescribeVpcEndpoint documentation](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html). */
+    state?: string | undefined;
+    vpcEndpointInfo?: {
+        $case: 'gcpVpcEndpointInfo';
+        /**
+         * The cloud info of this vpc endpoint.
+         * Info for a GCP vpc endpoint.
+         */
+        gcpVpcEndpointInfo: GcpVpcEndpointInfo;
+    } | undefined;
+}
 export interface WorkspaceNetworkOption {
     /**
      * The network policy ID to apply to the workspace. This controls the network access rules
@@ -1553,37 +1544,8 @@ export declare const unmarshalAccountNetworkPolicySchema: z.ZodType<AccountNetwo
 export declare const unmarshalAzurePrivateEndpointInfoSchema: z.ZodType<AzurePrivateEndpointInfo>;
 export declare const unmarshalCreateAccountIpAccessListResponseSchema: z.ZodType<CreateAccountIpAccessListResponse>;
 export declare const unmarshalCreateIpAccessListResponseSchema: z.ZodType<CreateIpAccessListResponse>;
-export declare const unmarshalCustomerFacingGcpVpcEndpointInfoSchema: z.ZodType<CustomerFacingGcpVpcEndpointInfo>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicySchema: z.ZodType<CustomerFacingIngressNetworkPolicy>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_AccountApiDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_AccountUiDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_AppsRuntimeDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_Authentication>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema: z.ZodType<CustomerFacingIngressNetworkPolicy_AuthenticationIdentity>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_CrossWorkspaceAccess>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRule>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOrigin>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_EndpointsSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_Endpoints>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_IpRangesSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_IpRanges>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PrivateAccess>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PrivateIngressRule>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PrivateRequestOrigin>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PublicAccess>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PublicIngressRule>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_PublicRequestOrigin>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_RequestDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_WorkspaceApiDestination>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_WorkspaceIdList>;
-export declare const unmarshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema: z.ZodType<CustomerFacingIngressNetworkPolicy_WorkspaceUiDestination>;
-export declare const unmarshalCustomerFacingNetworkConnectivityConfigSchema: z.ZodType<CustomerFacingNetworkConnectivityConfig>;
-export declare const unmarshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema: z.ZodType<CustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRule>;
-export declare const unmarshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema: z.ZodType<CustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRule>;
 export declare const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema: z.ZodType<CustomerFacingNetworkConnectivityConfigEgressConfig>;
 export declare const unmarshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema: z.ZodType<CustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRule>;
-export declare const unmarshalCustomerFacingPrivateAccessSettingsSchema: z.ZodType<CustomerFacingPrivateAccessSettings>;
-export declare const unmarshalCustomerFacingVpcEndpointSchema: z.ZodType<CustomerFacingVpcEndpoint>;
 export declare const unmarshalDeleteAccountIpAccessListResponseSchema: z.ZodType<DeleteAccountIpAccessListResponse>;
 export declare const unmarshalDeleteIpAccessListResponseSchema: z.ZodType<DeleteIpAccessListResponse>;
 export declare const unmarshalEgressNetworkPolicySchema: z.ZodType<EgressNetworkPolicy>;
@@ -1595,8 +1557,32 @@ export declare const unmarshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDes
 export declare const unmarshalEndpointSchema: z.ZodType<Endpoint>;
 export declare const unmarshalGcpEndpointSchema: z.ZodType<GcpEndpoint>;
 export declare const unmarshalGcpNetworkInfoSchema: z.ZodType<GcpNetworkInfo>;
+export declare const unmarshalGcpVpcEndpointInfoSchema: z.ZodType<GcpVpcEndpointInfo>;
 export declare const unmarshalGetAccountIpAccessListResponseSchema: z.ZodType<GetAccountIpAccessListResponse>;
 export declare const unmarshalGetIpAccessListResponseSchema: z.ZodType<GetIpAccessListResponse>;
+export declare const unmarshalIngressNetworkPolicySchema: z.ZodType<IngressNetworkPolicy>;
+export declare const unmarshalIngressNetworkPolicy_AccountApiDestinationSchema: z.ZodType<IngressNetworkPolicy_AccountApiDestination>;
+export declare const unmarshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema: z.ZodType<IngressNetworkPolicy_AccountDatabricksOneDestination>;
+export declare const unmarshalIngressNetworkPolicy_AccountUiDestinationSchema: z.ZodType<IngressNetworkPolicy_AccountUiDestination>;
+export declare const unmarshalIngressNetworkPolicy_AppsRuntimeDestinationSchema: z.ZodType<IngressNetworkPolicy_AppsRuntimeDestination>;
+export declare const unmarshalIngressNetworkPolicy_AuthenticationSchema: z.ZodType<IngressNetworkPolicy_Authentication>;
+export declare const unmarshalIngressNetworkPolicy_AuthenticationIdentitySchema: z.ZodType<IngressNetworkPolicy_AuthenticationIdentity>;
+export declare const unmarshalIngressNetworkPolicy_CrossWorkspaceAccessSchema: z.ZodType<IngressNetworkPolicy_CrossWorkspaceAccess>;
+export declare const unmarshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema: z.ZodType<IngressNetworkPolicy_CrossWorkspaceIngressRule>;
+export declare const unmarshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema: z.ZodType<IngressNetworkPolicy_CrossWorkspaceRequestOrigin>;
+export declare const unmarshalIngressNetworkPolicy_EndpointsSchema: z.ZodType<IngressNetworkPolicy_Endpoints>;
+export declare const unmarshalIngressNetworkPolicy_IpRangesSchema: z.ZodType<IngressNetworkPolicy_IpRanges>;
+export declare const unmarshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema: z.ZodType<IngressNetworkPolicy_LakebaseRuntimeDestination>;
+export declare const unmarshalIngressNetworkPolicy_PrivateAccessSchema: z.ZodType<IngressNetworkPolicy_PrivateAccess>;
+export declare const unmarshalIngressNetworkPolicy_PrivateIngressRuleSchema: z.ZodType<IngressNetworkPolicy_PrivateIngressRule>;
+export declare const unmarshalIngressNetworkPolicy_PrivateRequestOriginSchema: z.ZodType<IngressNetworkPolicy_PrivateRequestOrigin>;
+export declare const unmarshalIngressNetworkPolicy_PublicAccessSchema: z.ZodType<IngressNetworkPolicy_PublicAccess>;
+export declare const unmarshalIngressNetworkPolicy_PublicIngressRuleSchema: z.ZodType<IngressNetworkPolicy_PublicIngressRule>;
+export declare const unmarshalIngressNetworkPolicy_PublicRequestOriginSchema: z.ZodType<IngressNetworkPolicy_PublicRequestOrigin>;
+export declare const unmarshalIngressNetworkPolicy_RequestDestinationSchema: z.ZodType<IngressNetworkPolicy_RequestDestination>;
+export declare const unmarshalIngressNetworkPolicy_WorkspaceApiDestinationSchema: z.ZodType<IngressNetworkPolicy_WorkspaceApiDestination>;
+export declare const unmarshalIngressNetworkPolicy_WorkspaceIdListSchema: z.ZodType<IngressNetworkPolicy_WorkspaceIdList>;
+export declare const unmarshalIngressNetworkPolicy_WorkspaceUiDestinationSchema: z.ZodType<IngressNetworkPolicy_WorkspaceUiDestination>;
 export declare const unmarshalIpAccessListSchema: z.ZodType<IpAccessList>;
 export declare const unmarshalListAccountIpAccessListsResponseSchema: z.ZodType<ListAccountIpAccessListsResponse>;
 export declare const unmarshalListEndpointsResponseSchema: z.ZodType<ListEndpointsResponse>;
@@ -1606,55 +1592,33 @@ export declare const unmarshalListNetworkConnectivityConfigsResponseSchema: z.Zo
 export declare const unmarshalListNetworkPoliciesResponseSchema: z.ZodType<ListNetworkPoliciesResponse>;
 export declare const unmarshalNccPrivateEndpointRuleSchema: z.ZodType<NccPrivateEndpointRule>;
 export declare const unmarshalNetworkSchema: z.ZodType<Network>;
+export declare const unmarshalNetworkConnectivityConfigSchema: z.ZodType<NetworkConnectivityConfig>;
+export declare const unmarshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema: z.ZodType<NetworkConnectivityConfigAwsPrivateEndpointRule>;
+export declare const unmarshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema: z.ZodType<NetworkConnectivityConfigAzurePrivateEndpointRule>;
 export declare const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema: z.ZodType<NetworkConnectivityConfigEgressConfig_DefaultRule>;
 export declare const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema: z.ZodType<NetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRule>;
 export declare const unmarshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema: z.ZodType<NetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRule>;
 export declare const unmarshalNetworkHealthSchema: z.ZodType<NetworkHealth>;
 export declare const unmarshalNetworkVpcEndpointsSchema: z.ZodType<NetworkVpcEndpoints>;
 export declare const unmarshalNetworkWarningSchema: z.ZodType<NetworkWarning>;
+export declare const unmarshalPrivateAccessSettingsSchema: z.ZodType<PrivateAccessSettings>;
 export declare const unmarshalReplaceAccountIpAccessListResponseSchema: z.ZodType<ReplaceAccountIpAccessListResponse>;
 export declare const unmarshalReplaceIpAccessListResponseSchema: z.ZodType<ReplaceIpAccessListResponse>;
 export declare const unmarshalUpdateAccountIpAccessListResponseSchema: z.ZodType<UpdateAccountIpAccessListResponse>;
 export declare const unmarshalUpdateIpAccessListResponseSchema: z.ZodType<UpdateIpAccessListResponse>;
+export declare const unmarshalVpcEndpointSchema: z.ZodType<VpcEndpoint>;
 export declare const unmarshalWorkspaceNetworkOptionSchema: z.ZodType<WorkspaceNetworkOption>;
 export declare const marshalAccountNetworkPolicySchema: z.ZodType;
 export declare const marshalAzurePrivateEndpointInfoSchema: z.ZodType;
 export declare const marshalCreateAccountIpAccessListRequestSchema: z.ZodType;
-export declare const marshalCreateIpAccessListSchema: z.ZodType;
+export declare const marshalCreateIpAccessListRequestSchema: z.ZodType;
 export declare const marshalCreateNetworkConnectivityConfigurationSchema: z.ZodType;
 export declare const marshalCreateNetworkRequestSchema: z.ZodType;
 export declare const marshalCreatePrivateAccessSettingsRequestSchema: z.ZodType;
 export declare const marshalCreatePrivateEndpointRuleSchema: z.ZodType;
 export declare const marshalCreateVpcEndpointRequestSchema: z.ZodType;
-export declare const marshalCustomerFacingGcpVpcEndpointInfoSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicySchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AccountApiDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AccountDatabricksOneDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AccountUiDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AppsRuntimeDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AuthenticationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_AuthenticationIdentitySchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceAccessSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_EndpointsSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_IpRangesSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_LakebaseRuntimeDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PrivateAccessSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PrivateIngressRuleSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PrivateRequestOriginSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PublicAccessSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PublicIngressRuleSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_PublicRequestOriginSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_RequestDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_WorkspaceApiDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_WorkspaceIdListSchema: z.ZodType;
-export declare const marshalCustomerFacingIngressNetworkPolicy_WorkspaceUiDestinationSchema: z.ZodType;
-export declare const marshalCustomerFacingNetworkConnectivityConfigAwsPrivateEndpointRuleSchema: z.ZodType;
-export declare const marshalCustomerFacingNetworkConnectivityConfigAzurePrivateEndpointRuleSchema: z.ZodType;
 export declare const marshalCustomerFacingNetworkConnectivityConfigEgressConfigSchema: z.ZodType;
 export declare const marshalCustomerFacingNetworkConnectivityConfigEgressConfig_CustomerFacingTargetRuleSchema: z.ZodType;
-export declare const marshalCustomerFacingPrivateAccessSettingsSchema: z.ZodType;
 export declare const marshalEgressNetworkPolicySchema: z.ZodType;
 export declare const marshalEgressNetworkPolicy_NetworkAccessPolicySchema: z.ZodType;
 export declare const marshalEgressNetworkPolicy_NetworkAccessPolicy_DatabricksDestinationSchema: z.ZodType;
@@ -1664,14 +1628,41 @@ export declare const marshalEgressNetworkPolicy_NetworkAccessPolicy_StorageDesti
 export declare const marshalEndpointSchema: z.ZodType;
 export declare const marshalGcpEndpointSchema: z.ZodType;
 export declare const marshalGcpNetworkInfoSchema: z.ZodType;
+export declare const marshalGcpVpcEndpointInfoSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicySchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AccountApiDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AccountDatabricksOneDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AccountUiDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AppsRuntimeDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AuthenticationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_AuthenticationIdentitySchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_CrossWorkspaceAccessSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_CrossWorkspaceIngressRuleSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_CrossWorkspaceRequestOriginSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_EndpointsSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_IpRangesSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_LakebaseRuntimeDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PrivateAccessSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PrivateIngressRuleSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PrivateRequestOriginSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PublicAccessSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PublicIngressRuleSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_PublicRequestOriginSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_RequestDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_WorkspaceApiDestinationSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_WorkspaceIdListSchema: z.ZodType;
+export declare const marshalIngressNetworkPolicy_WorkspaceUiDestinationSchema: z.ZodType;
+export declare const marshalNetworkConnectivityConfigAwsPrivateEndpointRuleSchema: z.ZodType;
+export declare const marshalNetworkConnectivityConfigAzurePrivateEndpointRuleSchema: z.ZodType;
 export declare const marshalNetworkConnectivityConfigEgressConfig_DefaultRuleSchema: z.ZodType;
 export declare const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AwsStableIpRuleSchema: z.ZodType;
 export declare const marshalNetworkConnectivityConfigEgressConfig_DefaultRule_AzureServiceEndpointRuleSchema: z.ZodType;
 export declare const marshalNetworkVpcEndpointsSchema: z.ZodType;
+export declare const marshalPrivateAccessSettingsSchema: z.ZodType;
 export declare const marshalReplaceAccountIpAccessListRequestSchema: z.ZodType;
-export declare const marshalReplaceIpAccessListSchema: z.ZodType;
+export declare const marshalReplaceIpAccessListRequestSchema: z.ZodType;
 export declare const marshalUpdateAccountIpAccessListRequestSchema: z.ZodType;
-export declare const marshalUpdateIpAccessListSchema: z.ZodType;
+export declare const marshalUpdateIpAccessListRequestSchema: z.ZodType;
 export declare const marshalUpdatePrivateEndpointRuleSchema: z.ZodType;
 export declare const marshalWorkspaceNetworkOptionSchema: z.ZodType;
 export declare function updatePrivateEndpointRuleFieldMask(...paths: string[]): FieldMask<UpdatePrivateEndpointRule>;