@distilled.cloud/cloudflare 0.22.3 → 0.22.4

package/lib/services/zero-trust.d.ts

@@ -8518,9 +8518,9 @@ export declare const listAccessApplicationsForAccount: API.PaginatedOperationMet
 export declare const listAccessApplicationsForZone: API.PaginatedOperationMethod<ListAccessApplicationsForZoneRequest, ListAccessApplicationsResponse, ListAccessApplicationsError, Credentials | HttpClient.HttpClient>;
 interface CreateAccessApplicationBaseRequest {
     /** Body param: The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. */
-    domain: string;
+    domain?: string;
     /** Body param: The application type. */
-    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
+    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     /** Body param: When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always */
     allowAuthenticateViaWarp?: boolean;
     /** Body param: Enables loading application content in an iFrame. */
@@ -8614,23 +8614,956 @@ interface CreateAccessApplicationBaseRequest {
                 allowedClipboardLocalToRemoteFormats?: "text"[];
                 allowedClipboardRemoteToLocalFormats?: "text"[];
             };
-        };
-        isolationRequired?: boolean;
-        mfaConfig?: {
-            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
-            mfaDisabled?: boolean;
-            sessionDuration?: string;
-        };
-        precedence?: number;
-        purposeJustificationPrompt?: string;
-        purposeJustificationRequired?: boolean;
-        sessionDuration?: string;
-    })[];
-    /** Body param: Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The */
-    readServiceTokensFromHeader?: string;
-    /** Body param: Sets the SameSite cookie setting, which provides increased security against CSRF attacks. */
-    sameSiteCookieAttribute?: string;
-    /** Body param: Configuration for provisioning to this application via SCIM. This is currently in closed beta. */
+        };
+        isolationRequired?: boolean;
+        mfaConfig?: {
+            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
+            mfaDisabled?: boolean;
+            sessionDuration?: string;
+        };
+        precedence?: number;
+        purposeJustificationPrompt?: string;
+        purposeJustificationRequired?: boolean;
+        sessionDuration?: string;
+    })[] | {
+        decision: "allow" | "deny" | "non_identity" | "bypass" | (string & {});
+        include: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string;
+            };
+        })[];
+        name: string;
+        connectionRules?: {
+            ssh?: {
+                usernames: string[];
+                allowEmailAlias?: boolean;
+            };
+        };
+        exclude?: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string;
+            };
+        })[];
+        mfaConfig?: {
+            allowedAuthenticators?: "ssh_piv_key"[];
+            mfaDisabled?: boolean;
+            sessionDuration?: string;
+        };
+        require?: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string;
+            };
+        })[];
+    }[];
+    /** Body param: Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The */
+    readServiceTokensFromHeader?: string;
+    /** Body param: Sets the SameSite cookie setting, which provides increased security against CSRF attacks. */
+    sameSiteCookieAttribute?: string;
+    /** Body param: Configuration for provisioning to this application via SCIM. This is currently in closed beta. */
+    scimConfig?: {
+        idpUid: string;
+        remoteUri: string;
+        authentication?: {
+            password: string;
+            scheme: "httpbasic";
+            user: string;
+        } | {
+            token: string;
+            scheme: "oauthbearertoken";
+        } | {
+            authorizationUrl: string;
+            clientId: string;
+            clientSecret: string;
+            scheme: "oauth2";
+            tokenUrl: string;
+            scopes?: string[];
+        } | {
+            clientId: string;
+            clientSecret: string;
+            scheme: "access_service_token";
+        } | ({
+            password: string;
+            scheme: "httpbasic";
+            user: string;
+        } | {
+            token: string;
+            scheme: "oauthbearertoken";
+        } | {
+            authorizationUrl: string;
+            clientId: string;
+            clientSecret: string;
+            scheme: "oauth2";
+            tokenUrl: string;
+            scopes?: string[];
+        } | {
+            clientId: string;
+            clientSecret: string;
+            scheme: "access_service_token";
+        })[];
+        deactivateOnDelete?: boolean;
+        enabled?: boolean;
+        mappings?: {
+            schema: string;
+            enabled?: boolean;
+            filter?: string;
+            operations?: {
+                create?: boolean;
+                delete?: boolean;
+                update?: boolean;
+            };
+            strictness?: "strict" | "passthrough" | (string & {});
+            transformJsonata?: string;
+        }[];
+    };
+    /** @deprecated Body param: List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until   November 21, 2025.  If `destinations` are prov */
+    selfHostedDomains?: string[];
+    /** Body param: Returns a 401 status code when the request is blocked by a Service Auth policy. */
+    serviceAuth_401Redirect?: boolean;
+    /** Body param: The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for */
+    sessionDuration?: string;
+    /** Body param: Enables automatic authentication through cloudflared. */
+    skipInterstitial?: boolean;
+    /** Body param: The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard. */
+    tags?: string[];
+    /** Body param: Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clien */
+    useClientlessIsolationAppLauncherUrl?: boolean;
+    /** Body param */
+    saasApp?: {
+        authType?: "saml" | "oidc" | (string & {});
+        consumerServiceUrl?: string;
+        customAttributes?: {
+            friendlyName?: string;
+            name?: string;
+            nameFormat?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | (string & {});
+            required?: boolean;
+            source?: {
+                name?: string;
+                nameByIdp?: {
+                    idpId?: string;
+                    sourceName?: string;
+                }[];
+            };
+        }[];
+        defaultRelayState?: string;
+        idpEntityId?: string;
+        nameIdFormat?: "id" | "email" | (string & {});
+        nameIdTransformJsonata?: string;
+        publicKey?: string;
+        samlAttributeTransformJsonata?: string;
+        spEntityId?: string;
+        ssoEndpoint?: string;
+        accessTokenLifetime?: string;
+        allowPkceWithoutClientSecret?: boolean;
+        appLauncherUrl?: string;
+        clientId?: string;
+        clientSecret?: string;
+        customClaims?: {
+            name?: string;
+            required?: boolean;
+            scope?: "groups" | "profile" | "email" | "openid" | (string & {});
+            source?: {
+                name?: string;
+                nameByIdp?: Record<string, unknown>;
+            };
+        }[];
+        grantTypes?: ("authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | "hybrid" | "implicit" | (string & {}))[];
+        groupFilterRegex?: string;
+        hybridAndImplicitOptions?: {
+            returnAccessTokenFromAuthorizationEndpoint?: boolean;
+            returnIdTokenFromAuthorizationEndpoint?: boolean;
+        };
+        redirectUris?: string[];
+        refreshTokenOptions?: {
+            lifetime?: string;
+        };
+        scopes?: ("openid" | "groups" | "email" | "profile" | (string & {}))[];
+    };
+    /** Body param: The image URL of the logo shown in the App Launcher header. */
+    appLauncherLogoUrl?: string;
+    /** Body param: The background color of the App Launcher page. */
+    bgColor?: string;
+    /** Body param: The links in the App Launcher footer. */
+    footerLinks?: {
+        name: string;
+        url: string;
+    }[];
+    /** Body param: The background color of the App Launcher header. */
+    headerBgColor?: string;
+    /** Body param: The design of the App Launcher landing page shown to users when they log in. */
+    landingPageDesign?: {
+        buttonColor?: string;
+        buttonTextColor?: string;
+        imageUrl?: string;
+        message?: string;
+        title?: string;
+    };
+    /** Body param: Determines when to skip the App Launcher landing page. */
+    skipAppLauncherLoginPage?: boolean;
+    /** Body param */
+    targetCriteria?: {
+        port: number;
+        protocol: "SSH";
+        targetAttributes: Record<string, unknown>;
+    }[] | {
+        port: number;
+        protocol: "RDP";
+        targetAttributes: Record<string, unknown>;
+    }[];
+}
+export interface CreateAccessApplicationForAccountRequest extends CreateAccessApplicationBaseRequest {
+    /** Path param: The Account ID to use for this endpoint. */
+    accountId: string;
+}
+export interface CreateAccessApplicationForZoneRequest extends CreateAccessApplicationBaseRequest {
+    /** Path param: The Zone ID to use for this endpoint. */
+    zoneId: string;
+}
+export declare const CreateAccessApplicationForAccountRequest: Schema.Schema<CreateAccessApplicationForAccountRequest>;
+export declare const CreateAccessApplicationForZoneRequest: Schema.Schema<CreateAccessApplicationForZoneRequest>;
+export type CreateAccessApplicationResponse = {
+    domain: string;
+    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
+    id?: string | null;
+    allowAuthenticateViaWarp?: boolean | null;
+    allowIframe?: boolean | null;
+    allowedIdps?: string[] | null;
+    appLauncherVisible?: boolean | null;
+    aud?: string | null;
+    autoRedirectToIdentity?: boolean | null;
+    corsHeaders?: {
+        allowAllHeaders?: boolean | null;
+        allowAllMethods?: boolean | null;
+        allowAllOrigins?: boolean | null;
+        allowCredentials?: boolean | null;
+        allowedHeaders?: string[] | null;
+        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[] | null;
+        allowedOrigins?: string[] | null;
+        maxAge?: number | null;
+    } | null;
+    customDenyMessage?: string | null;
+    customDenyUrl?: string | null;
+    customNonIdentityDenyUrl?: string | null;
+    customPages?: string[] | null;
+    destinations?: ({
+        type?: "public" | null;
+        uri?: string | null;
+    } | {
+        cidr?: string | null;
+        hostname?: string | null;
+        l4Protocol?: "tcp" | "udp" | (string & {}) | null;
+        portRange?: string | null;
+        type?: "private" | null;
+        vnetId?: string | null;
+    } | {
+        mcpServerId?: string | null;
+        type?: "via_mcp_server_portal" | null;
+    })[] | null;
+    enableBindingCookie?: boolean | null;
+    httpOnlyCookieAttribute?: boolean | null;
+    logoUrl?: string | null;
+    mfaConfig?: {
+        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
+        mfaDisabled?: boolean | null;
+        sessionDuration?: string | null;
+    } | null;
+    name?: string | null;
+    oauthConfiguration?: {
+        dynamicClientRegistration?: {
+            allowAnyOnLocalhost?: boolean | null;
+            allowAnyOnLoopback?: boolean | null;
+            allowedUris?: string[] | null;
+            enabled?: boolean | null;
+        } | null;
+        enabled?: boolean | null;
+        grant?: {
+            accessTokenLifetime?: string | null;
+            sessionDuration?: string | null;
+        } | null;
+    } | null;
+    optionsPreflightBypass?: boolean | null;
+    pathCookieAttribute?: boolean | null;
+    policies?: {
+        id?: string | null;
+        approvalGroups?: {
+            approvalsNeeded: number;
+            emailAddresses?: string[] | null;
+            emailListUuid?: string | null;
+        }[] | null;
+        approvalRequired?: boolean | null;
+        connectionRules?: {
+            rdp?: {
+                allowedClipboardLocalToRemoteFormats?: "text"[] | null;
+                allowedClipboardRemoteToLocalFormats?: "text"[] | null;
+            } | null;
+        } | null;
+        createdAt?: string | null;
+        decision?: "allow" | "deny" | "non_identity" | "bypass" | (string & {}) | null;
+        exclude?: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string | null;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string | null;
+            };
+        })[] | null;
+        include?: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string | null;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string | null;
+            };
+        })[] | null;
+        isolationRequired?: boolean | null;
+        mfaConfig?: {
+            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
+            mfaDisabled?: boolean | null;
+            sessionDuration?: string | null;
+        } | null;
+        name?: string | null;
+        precedence?: number | null;
+        purposeJustificationPrompt?: string | null;
+        purposeJustificationRequired?: boolean | null;
+        require?: ({
+            group: {
+                id: string;
+            };
+        } | {
+            anyValidServiceToken: unknown;
+        } | {
+            authContext: {
+                id: string;
+                acId: string;
+                identityProviderId: string;
+            };
+        } | {
+            authMethod: {
+                authMethod: string;
+            };
+        } | {
+            azureAD: {
+                id: string;
+                identityProviderId: string;
+            };
+        } | {
+            certificate: unknown;
+        } | {
+            commonName: {
+                commonName: string;
+            };
+        } | {
+            geo: {
+                countryCode: string;
+            };
+        } | {
+            devicePosture: {
+                integrationUid: string;
+            };
+        } | {
+            emailDomain: {
+                domain: string;
+            };
+        } | {
+            emailList: {
+                id: string;
+            };
+        } | {
+            email: {
+                email: string;
+            };
+        } | {
+            everyone: unknown;
+        } | {
+            externalEvaluation: {
+                evaluateUrl: string;
+                keysUrl: string;
+            };
+        } | {
+            githubOrganization: {
+                identityProviderId: string;
+                name: string;
+                team?: string | null;
+            };
+        } | {
+            gsuite: {
+                email: string;
+                identityProviderId: string;
+            };
+        } | {
+            loginMethod: {
+                id: string;
+            };
+        } | {
+            ipList: {
+                id: string;
+            };
+        } | {
+            ip: {
+                ip: string;
+            };
+        } | {
+            okta: {
+                identityProviderId: string;
+                name: string;
+            };
+        } | {
+            saml: {
+                attributeName: string;
+                attributeValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            oidc: {
+                claimName: string;
+                claimValue: string;
+                identityProviderId: string;
+            };
+        } | {
+            serviceToken: {
+                tokenId: string;
+            };
+        } | {
+            linkedAppToken: {
+                appUid: string;
+            };
+        } | {
+            userRiskScore: {
+                userRiskScore: ("low" | "medium" | "high" | "unscored" | (string & {}))[];
+            };
+        } | {
+            cloudflareAccountMember: {
+                accountId?: string | null;
+            };
+        })[] | null;
+        sessionDuration?: string | null;
+        updatedAt?: string | null;
+    }[] | null;
+    readServiceTokensFromHeader?: string | null;
+    sameSiteCookieAttribute?: string | null;
     scimConfig?: {
         idpUid: string;
         remoteUri: string;
@@ -8647,7 +9580,7 @@ interface CreateAccessApplicationBaseRequest {
             clientSecret: string;
             scheme: "oauth2";
             tokenUrl: string;
-            scopes?: string[];
+            scopes?: string[] | null;
         } | {
             clientId: string;
             clientSecret: string;
@@ -8665,112 +9598,42 @@ interface CreateAccessApplicationBaseRequest {
             clientSecret: string;
             scheme: "oauth2";
             tokenUrl: string;
-            scopes?: string[];
+            scopes?: string[] | null;
         } | {
             clientId: string;
             clientSecret: string;
             scheme: "access_service_token";
-        })[];
-        deactivateOnDelete?: boolean;
-        enabled?: boolean;
+        })[] | null;
+        deactivateOnDelete?: boolean | null;
+        enabled?: boolean | null;
         mappings?: {
             schema: string;
-            enabled?: boolean;
-            filter?: string;
+            enabled?: boolean | null;
+            filter?: string | null;
             operations?: {
-                create?: boolean;
-                delete?: boolean;
-                update?: boolean;
-            };
-            strictness?: "strict" | "passthrough" | (string & {});
-            transformJsonata?: string;
-        }[];
-    };
-    /** @deprecated Body param: List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until   November 21, 2025.  If `destinations` are prov */
-    selfHostedDomains?: string[];
-    /** Body param: Returns a 401 status code when the request is blocked by a Service Auth policy. */
-    serviceAuth_401Redirect?: boolean;
-    /** Body param: The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for */
-    sessionDuration?: string;
-    /** Body param: Enables automatic authentication through cloudflared. */
-    skipInterstitial?: boolean;
-    /** Body param: The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard. */
-    tags?: string[];
-    /** Body param: Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clien */
-    useClientlessIsolationAppLauncherUrl?: boolean;
-}
-export interface CreateAccessApplicationForAccountRequest extends CreateAccessApplicationBaseRequest {
-    /** Path param: The Account ID to use for this endpoint. */
-    accountId: string;
-}
-export interface CreateAccessApplicationForZoneRequest extends CreateAccessApplicationBaseRequest {
-    /** Path param: The Zone ID to use for this endpoint. */
-    zoneId: string;
-}
-export declare const CreateAccessApplicationForAccountRequest: Schema.Schema<CreateAccessApplicationForAccountRequest>;
-export declare const CreateAccessApplicationForZoneRequest: Schema.Schema<CreateAccessApplicationForZoneRequest>;
-export type CreateAccessApplicationResponse = {
-    domain: string;
-    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
+                create?: boolean | null;
+                delete?: boolean | null;
+                update?: boolean | null;
+            } | null;
+            strictness?: "strict" | "passthrough" | (string & {}) | null;
+            transformJsonata?: string | null;
+        }[] | null;
+    } | null;
+    selfHostedDomains?: string[] | null;
+    serviceAuth_401Redirect?: boolean | null;
+    sessionDuration?: string | null;
+    skipInterstitial?: boolean | null;
+    tags?: string[] | null;
+    useClientlessIsolationAppLauncherUrl?: boolean | null;
+} | {
     id?: string | null;
-    allowAuthenticateViaWarp?: boolean | null;
-    allowIframe?: boolean | null;
     allowedIdps?: string[] | null;
     appLauncherVisible?: boolean | null;
     aud?: string | null;
     autoRedirectToIdentity?: boolean | null;
-    corsHeaders?: {
-        allowAllHeaders?: boolean | null;
-        allowAllMethods?: boolean | null;
-        allowAllOrigins?: boolean | null;
-        allowCredentials?: boolean | null;
-        allowedHeaders?: string[] | null;
-        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[] | null;
-        allowedOrigins?: string[] | null;
-        maxAge?: number | null;
-    } | null;
-    customDenyMessage?: string | null;
-    customDenyUrl?: string | null;
-    customNonIdentityDenyUrl?: string | null;
     customPages?: string[] | null;
-    destinations?: ({
-        type?: "public" | null;
-        uri?: string | null;
-    } | {
-        cidr?: string | null;
-        hostname?: string | null;
-        l4Protocol?: "tcp" | "udp" | (string & {}) | null;
-        portRange?: string | null;
-        type?: "private" | null;
-        vnetId?: string | null;
-    } | {
-        mcpServerId?: string | null;
-        type?: "via_mcp_server_portal" | null;
-    })[] | null;
-    enableBindingCookie?: boolean | null;
-    httpOnlyCookieAttribute?: boolean | null;
     logoUrl?: string | null;
-    mfaConfig?: {
-        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
-        mfaDisabled?: boolean | null;
-        sessionDuration?: string | null;
-    } | null;
     name?: string | null;
-    oauthConfiguration?: {
-        dynamicClientRegistration?: {
-            allowAnyOnLocalhost?: boolean | null;
-            allowAnyOnLoopback?: boolean | null;
-            allowedUris?: string[] | null;
-            enabled?: boolean | null;
-        } | null;
-        enabled?: boolean | null;
-        grant?: {
-            accessTokenLifetime?: string | null;
-            sessionDuration?: string | null;
-        } | null;
-    } | null;
-    optionsPreflightBypass?: boolean | null;
-    pathCookieAttribute?: boolean | null;
     policies?: {
         id?: string | null;
         approvalGroups?: {
@@ -9133,8 +9996,59 @@ export type CreateAccessApplicationResponse = {
         sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
-    readServiceTokensFromHeader?: string | null;
-    sameSiteCookieAttribute?: string | null;
+    saasApp?: {
+        authType?: "saml" | "oidc" | (string & {}) | null;
+        consumerServiceUrl?: string | null;
+        customAttributes?: {
+            friendlyName?: string | null;
+            name?: string | null;
+            nameFormat?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | (string & {}) | null;
+            required?: boolean | null;
+            source?: {
+                name?: string | null;
+                nameByIdp?: {
+                    idpId?: string | null;
+                    sourceName?: string | null;
+                }[] | null;
+            } | null;
+        }[] | null;
+        defaultRelayState?: string | null;
+        idpEntityId?: string | null;
+        nameIdFormat?: "id" | "email" | (string & {}) | null;
+        nameIdTransformJsonata?: string | null;
+        publicKey?: string | null;
+        samlAttributeTransformJsonata?: string | null;
+        spEntityId?: string | null;
+        ssoEndpoint?: string | null;
+    } | {
+        accessTokenLifetime?: string | null;
+        allowPkceWithoutClientSecret?: boolean | null;
+        appLauncherUrl?: string | null;
+        authType?: "saml" | "oidc" | (string & {}) | null;
+        clientId?: string | null;
+        clientSecret?: string | null;
+        customClaims?: {
+            name?: string | null;
+            required?: boolean | null;
+            scope?: "groups" | "profile" | "email" | "openid" | (string & {}) | null;
+            source?: {
+                name?: string | null;
+                nameByIdp?: Record<string, unknown> | null;
+            } | null;
+        }[] | null;
+        grantTypes?: ("authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | "hybrid" | "implicit" | (string & {}))[] | null;
+        groupFilterRegex?: string | null;
+        hybridAndImplicitOptions?: {
+            returnAccessTokenFromAuthorizationEndpoint?: boolean | null;
+            returnIdTokenFromAuthorizationEndpoint?: boolean | null;
+        } | null;
+        publicKey?: string | null;
+        redirectUris?: string[] | null;
+        refreshTokenOptions?: {
+            lifetime?: string | null;
+        } | null;
+        scopes?: ("openid" | "groups" | "email" | "profile" | (string & {}))[] | null;
+    } | null;
     scimConfig?: {
         idpUid: string;
         remoteUri: string;
@@ -9190,20 +10104,32 @@ export type CreateAccessApplicationResponse = {
             transformJsonata?: string | null;
         }[] | null;
     } | null;
-    selfHostedDomains?: string[] | null;
-    serviceAuth_401Redirect?: boolean | null;
-    sessionDuration?: string | null;
-    skipInterstitial?: boolean | null;
     tags?: string[] | null;
-    useClientlessIsolationAppLauncherUrl?: boolean | null;
+    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {}) | null;
 } | {
+    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
     allowedIdps?: string[] | null;
-    appLauncherVisible?: boolean | null;
+    appLauncherLogoUrl?: string | null;
     aud?: string | null;
     autoRedirectToIdentity?: boolean | null;
+    bgColor?: string | null;
+    customDenyUrl?: string | null;
+    customNonIdentityDenyUrl?: string | null;
     customPages?: string[] | null;
-    logoUrl?: string | null;
+    domain?: string | null;
+    footerLinks?: {
+        name: string;
+        url: string;
+    }[] | null;
+    headerBgColor?: string | null;
+    landingPageDesign?: {
+        buttonColor?: string | null;
+        buttonTextColor?: string | null;
+        imageUrl?: string | null;
+        message?: string | null;
+        title?: string | null;
+    } | null;
     name?: string | null;
     policies?: {
         id?: string | null;
@@ -9567,140 +10493,18 @@ export type CreateAccessApplicationResponse = {
         sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
-    saasApp?: {
-        authType?: "saml" | "oidc" | (string & {}) | null;
-        consumerServiceUrl?: string | null;
-        customAttributes?: {
-            friendlyName?: string | null;
-            name?: string | null;
-            nameFormat?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | (string & {}) | null;
-            required?: boolean | null;
-            source?: {
-                name?: string | null;
-                nameByIdp?: {
-                    idpId?: string | null;
-                    sourceName?: string | null;
-                }[] | null;
-            } | null;
-        }[] | null;
-        defaultRelayState?: string | null;
-        idpEntityId?: string | null;
-        nameIdFormat?: "id" | "email" | (string & {}) | null;
-        nameIdTransformJsonata?: string | null;
-        publicKey?: string | null;
-        samlAttributeTransformJsonata?: string | null;
-        spEntityId?: string | null;
-        ssoEndpoint?: string | null;
-    } | {
-        accessTokenLifetime?: string | null;
-        allowPkceWithoutClientSecret?: boolean | null;
-        appLauncherUrl?: string | null;
-        authType?: "saml" | "oidc" | (string & {}) | null;
-        clientId?: string | null;
-        clientSecret?: string | null;
-        customClaims?: {
-            name?: string | null;
-            required?: boolean | null;
-            scope?: "groups" | "profile" | "email" | "openid" | (string & {}) | null;
-            source?: {
-                name?: string | null;
-                nameByIdp?: Record<string, unknown> | null;
-            } | null;
-        }[] | null;
-        grantTypes?: ("authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | "hybrid" | "implicit" | (string & {}))[] | null;
-        groupFilterRegex?: string | null;
-        hybridAndImplicitOptions?: {
-            returnAccessTokenFromAuthorizationEndpoint?: boolean | null;
-            returnIdTokenFromAuthorizationEndpoint?: boolean | null;
-        } | null;
-        publicKey?: string | null;
-        redirectUris?: string[] | null;
-        refreshTokenOptions?: {
-            lifetime?: string | null;
-        } | null;
-        scopes?: ("openid" | "groups" | "email" | "profile" | (string & {}))[] | null;
-    } | null;
-    scimConfig?: {
-        idpUid: string;
-        remoteUri: string;
-        authentication?: {
-            password: string;
-            scheme: "httpbasic";
-            user: string;
-        } | {
-            token: string;
-            scheme: "oauthbearertoken";
-        } | {
-            authorizationUrl: string;
-            clientId: string;
-            clientSecret: string;
-            scheme: "oauth2";
-            tokenUrl: string;
-            scopes?: string[] | null;
-        } | {
-            clientId: string;
-            clientSecret: string;
-            scheme: "access_service_token";
-        } | ({
-            password: string;
-            scheme: "httpbasic";
-            user: string;
-        } | {
-            token: string;
-            scheme: "oauthbearertoken";
-        } | {
-            authorizationUrl: string;
-            clientId: string;
-            clientSecret: string;
-            scheme: "oauth2";
-            tokenUrl: string;
-            scopes?: string[] | null;
-        } | {
-            clientId: string;
-            clientSecret: string;
-            scheme: "access_service_token";
-        })[] | null;
-        deactivateOnDelete?: boolean | null;
-        enabled?: boolean | null;
-        mappings?: {
-            schema: string;
-            enabled?: boolean | null;
-            filter?: string | null;
-            operations?: {
-                create?: boolean | null;
-                delete?: boolean | null;
-                update?: boolean | null;
-            } | null;
-            strictness?: "strict" | "passthrough" | (string & {}) | null;
-            transformJsonata?: string | null;
-        }[] | null;
-    } | null;
-    tags?: string[] | null;
-    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {}) | null;
+    sessionDuration?: string | null;
+    skipAppLauncherLoginPage?: boolean | null;
 } | {
     type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
     allowedIdps?: string[] | null;
-    appLauncherLogoUrl?: string | null;
     aud?: string | null;
     autoRedirectToIdentity?: boolean | null;
-    bgColor?: string | null;
     customDenyUrl?: string | null;
     customNonIdentityDenyUrl?: string | null;
     customPages?: string[] | null;
     domain?: string | null;
-    footerLinks?: {
-        name: string;
-        url: string;
-    }[] | null;
-    headerBgColor?: string | null;
-    landingPageDesign?: {
-        buttonColor?: string | null;
-        buttonTextColor?: string | null;
-        imageUrl?: string | null;
-        message?: string | null;
-        title?: string | null;
-    } | null;
     name?: string | null;
     policies?: {
         id?: string | null;
@@ -10065,17 +10869,12 @@ export type CreateAccessApplicationResponse = {
         updatedAt?: string | null;
     }[] | null;
     sessionDuration?: string | null;
-    skipAppLauncherLoginPage?: boolean | null;
 } | {
-    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
-    allowedIdps?: string[] | null;
+    appLauncherVisible?: boolean | null;
     aud?: string | null;
-    autoRedirectToIdentity?: boolean | null;
-    customDenyUrl?: string | null;
-    customNonIdentityDenyUrl?: string | null;
-    customPages?: string[] | null;
     domain?: string | null;
+    logoUrl?: string | null;
     name?: string | null;
     policies?: {
         id?: string | null;
@@ -10439,26 +11238,24 @@ export type CreateAccessApplicationResponse = {
         sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
-    sessionDuration?: string | null;
+    tags?: string[] | null;
+    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {}) | null;
 } | {
+    targetCriteria: {
+        port: number;
+        protocol: "SSH";
+        targetAttributes: Record<string, unknown>;
+    }[];
+    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
-    appLauncherVisible?: boolean | null;
     aud?: string | null;
-    domain?: string | null;
-    logoUrl?: string | null;
     name?: string | null;
     policies?: {
         id?: string | null;
-        approvalGroups?: {
-            approvalsNeeded: number;
-            emailAddresses?: string[] | null;
-            emailListUuid?: string | null;
-        }[] | null;
-        approvalRequired?: boolean | null;
         connectionRules?: {
-            rdp?: {
-                allowedClipboardLocalToRemoteFormats?: "text"[] | null;
-                allowedClipboardRemoteToLocalFormats?: "text"[] | null;
+            ssh?: {
+                usernames: string[];
+                allowEmailAlias?: boolean | null;
             } | null;
         } | null;
         createdAt?: string | null;
@@ -10685,16 +11482,12 @@ export type CreateAccessApplicationResponse = {
                 accountId?: string | null;
             };
         })[] | null;
-        isolationRequired?: boolean | null;
         mfaConfig?: {
-            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
+            allowedAuthenticators?: "ssh_piv_key"[] | null;
             mfaDisabled?: boolean | null;
             sessionDuration?: string | null;
         } | null;
         name?: string | null;
-        precedence?: number | null;
-        purposeJustificationPrompt?: string | null;
-        purposeJustificationRequired?: boolean | null;
         require?: ({
             group: {
                 id: string;
@@ -10806,27 +11599,87 @@ export type CreateAccessApplicationResponse = {
                 accountId?: string | null;
             };
         })[] | null;
-        sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
-    tags?: string[] | null;
-    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {}) | null;
 } | {
+    domain: string;
     targetCriteria: {
         port: number;
-        protocol: "SSH";
+        protocol: "RDP";
         targetAttributes: Record<string, unknown>;
     }[];
     type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
+    allowAuthenticateViaWarp?: boolean | null;
+    allowIframe?: boolean | null;
+    allowedIdps?: string[] | null;
+    appLauncherVisible?: boolean | null;
     aud?: string | null;
+    autoRedirectToIdentity?: boolean | null;
+    corsHeaders?: {
+        allowAllHeaders?: boolean | null;
+        allowAllMethods?: boolean | null;
+        allowAllOrigins?: boolean | null;
+        allowCredentials?: boolean | null;
+        allowedHeaders?: string[] | null;
+        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[] | null;
+        allowedOrigins?: string[] | null;
+        maxAge?: number | null;
+    } | null;
+    customDenyMessage?: string | null;
+    customDenyUrl?: string | null;
+    customNonIdentityDenyUrl?: string | null;
+    customPages?: string[] | null;
+    destinations?: ({
+        type?: "public" | null;
+        uri?: string | null;
+    } | {
+        cidr?: string | null;
+        hostname?: string | null;
+        l4Protocol?: "tcp" | "udp" | (string & {}) | null;
+        portRange?: string | null;
+        type?: "private" | null;
+        vnetId?: string | null;
+    } | {
+        mcpServerId?: string | null;
+        type?: "via_mcp_server_portal" | null;
+    })[] | null;
+    enableBindingCookie?: boolean | null;
+    httpOnlyCookieAttribute?: boolean | null;
+    logoUrl?: string | null;
+    mfaConfig?: {
+        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
+        mfaDisabled?: boolean | null;
+        sessionDuration?: string | null;
+    } | null;
     name?: string | null;
+    oauthConfiguration?: {
+        dynamicClientRegistration?: {
+            allowAnyOnLocalhost?: boolean | null;
+            allowAnyOnLoopback?: boolean | null;
+            allowedUris?: string[] | null;
+            enabled?: boolean | null;
+        } | null;
+        enabled?: boolean | null;
+        grant?: {
+            accessTokenLifetime?: string | null;
+            sessionDuration?: string | null;
+        } | null;
+    } | null;
+    optionsPreflightBypass?: boolean | null;
+    pathCookieAttribute?: boolean | null;
     policies?: {
         id?: string | null;
+        approvalGroups?: {
+            approvalsNeeded: number;
+            emailAddresses?: string[] | null;
+            emailListUuid?: string | null;
+        }[] | null;
+        approvalRequired?: boolean | null;
         connectionRules?: {
-            ssh?: {
-                usernames: string[];
-                allowEmailAlias?: boolean | null;
+            rdp?: {
+                allowedClipboardLocalToRemoteFormats?: "text"[] | null;
+                allowedClipboardRemoteToLocalFormats?: "text"[] | null;
             } | null;
         } | null;
         createdAt?: string | null;
@@ -11053,12 +11906,16 @@ export type CreateAccessApplicationResponse = {
                 accountId?: string | null;
             };
         })[] | null;
+        isolationRequired?: boolean | null;
         mfaConfig?: {
-            allowedAuthenticators?: "ssh_piv_key"[] | null;
+            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
             mfaDisabled?: boolean | null;
             sessionDuration?: string | null;
         } | null;
         name?: string | null;
+        precedence?: number | null;
+        purposeJustificationPrompt?: string | null;
+        purposeJustificationRequired?: boolean | null;
         require?: ({
             group: {
                 id: string;
@@ -11170,33 +12027,79 @@ export type CreateAccessApplicationResponse = {
                 accountId?: string | null;
             };
         })[] | null;
+        sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
+    readServiceTokensFromHeader?: string | null;
+    sameSiteCookieAttribute?: string | null;
+    scimConfig?: {
+        idpUid: string;
+        remoteUri: string;
+        authentication?: {
+            password: string;
+            scheme: "httpbasic";
+            user: string;
+        } | {
+            token: string;
+            scheme: "oauthbearertoken";
+        } | {
+            authorizationUrl: string;
+            clientId: string;
+            clientSecret: string;
+            scheme: "oauth2";
+            tokenUrl: string;
+            scopes?: string[] | null;
+        } | {
+            clientId: string;
+            clientSecret: string;
+            scheme: "access_service_token";
+        } | ({
+            password: string;
+            scheme: "httpbasic";
+            user: string;
+        } | {
+            token: string;
+            scheme: "oauthbearertoken";
+        } | {
+            authorizationUrl: string;
+            clientId: string;
+            clientSecret: string;
+            scheme: "oauth2";
+            tokenUrl: string;
+            scopes?: string[] | null;
+        } | {
+            clientId: string;
+            clientSecret: string;
+            scheme: "access_service_token";
+        })[] | null;
+        deactivateOnDelete?: boolean | null;
+        enabled?: boolean | null;
+        mappings?: {
+            schema: string;
+            enabled?: boolean | null;
+            filter?: string | null;
+            operations?: {
+                create?: boolean | null;
+                delete?: boolean | null;
+                update?: boolean | null;
+            } | null;
+            strictness?: "strict" | "passthrough" | (string & {}) | null;
+            transformJsonata?: string | null;
+        }[] | null;
+    } | null;
+    selfHostedDomains?: string[] | null;
+    serviceAuth_401Redirect?: boolean | null;
+    sessionDuration?: string | null;
+    skipInterstitial?: boolean | null;
+    tags?: string[] | null;
+    useClientlessIsolationAppLauncherUrl?: boolean | null;
 } | {
-    domain: string;
-    targetCriteria: {
-        port: number;
-        protocol: "RDP";
-        targetAttributes: Record<string, unknown>;
-    }[];
     type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
     allowAuthenticateViaWarp?: boolean | null;
-    allowIframe?: boolean | null;
     allowedIdps?: string[] | null;
-    appLauncherVisible?: boolean | null;
     aud?: string | null;
     autoRedirectToIdentity?: boolean | null;
-    corsHeaders?: {
-        allowAllHeaders?: boolean | null;
-        allowAllMethods?: boolean | null;
-        allowAllOrigins?: boolean | null;
-        allowCredentials?: boolean | null;
-        allowedHeaders?: string[] | null;
-        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[] | null;
-        allowedOrigins?: string[] | null;
-        maxAge?: number | null;
-    } | null;
     customDenyMessage?: string | null;
     customDenyUrl?: string | null;
     customNonIdentityDenyUrl?: string | null;
@@ -11215,14 +12118,8 @@ export type CreateAccessApplicationResponse = {
         mcpServerId?: string | null;
         type?: "via_mcp_server_portal" | null;
     })[] | null;
-    enableBindingCookie?: boolean | null;
     httpOnlyCookieAttribute?: boolean | null;
     logoUrl?: string | null;
-    mfaConfig?: {
-        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
-        mfaDisabled?: boolean | null;
-        sessionDuration?: string | null;
-    } | null;
     name?: string | null;
     oauthConfiguration?: {
         dynamicClientRegistration?: {
@@ -11238,7 +12135,6 @@ export type CreateAccessApplicationResponse = {
         } | null;
     } | null;
     optionsPreflightBypass?: boolean | null;
-    pathCookieAttribute?: boolean | null;
     policies?: {
         id?: string | null;
         approvalGroups?: {
@@ -11601,7 +12497,6 @@ export type CreateAccessApplicationResponse = {
         sessionDuration?: string | null;
         updatedAt?: string | null;
     }[] | null;
-    readServiceTokensFromHeader?: string | null;
     sameSiteCookieAttribute?: string | null;
     scimConfig?: {
         idpUid: string;
@@ -11658,12 +12553,8 @@ export type CreateAccessApplicationResponse = {
             transformJsonata?: string | null;
         }[] | null;
     } | null;
-    selfHostedDomains?: string[] | null;
-    serviceAuth_401Redirect?: boolean | null;
     sessionDuration?: string | null;
-    skipInterstitial?: boolean | null;
     tags?: string[] | null;
-    useClientlessIsolationAppLauncherUrl?: boolean | null;
 } | {
     type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
     id?: string | null;
@@ -11689,6 +12580,7 @@ export type CreateAccessApplicationResponse = {
         mcpServerId?: string | null;
         type?: "via_mcp_server_portal" | null;
     })[] | null;
+    domain?: string | null;
     httpOnlyCookieAttribute?: boolean | null;
     logoUrl?: string | null;
     name?: string | null;
@@ -12126,66 +13018,124 @@ export type CreateAccessApplicationResponse = {
     } | null;
     sessionDuration?: string | null;
     tags?: string[] | null;
-} | {
-    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
-    id?: string | null;
-    allowAuthenticateViaWarp?: boolean | null;
-    allowedIdps?: string[] | null;
-    aud?: string | null;
-    autoRedirectToIdentity?: boolean | null;
-    customDenyMessage?: string | null;
-    customDenyUrl?: string | null;
-    customNonIdentityDenyUrl?: string | null;
-    customPages?: string[] | null;
+};
+export declare const CreateAccessApplicationResponse: Schema.Schema<CreateAccessApplicationResponse>;
+export type CreateAccessApplicationError = DefaultErrors;
+export declare const createAccessApplicationForAccount: API.OperationMethod<CreateAccessApplicationForAccountRequest, CreateAccessApplicationResponse, CreateAccessApplicationError, Credentials | HttpClient.HttpClient>;
+export declare const createAccessApplicationForZone: API.OperationMethod<CreateAccessApplicationForZoneRequest, CreateAccessApplicationResponse, CreateAccessApplicationError, Credentials | HttpClient.HttpClient>;
+interface UpdateAccessApplicationBaseRequest {
+    appId: string;
+    /** Body param: The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. */
+    domain?: string;
+    /** Body param: The application type. */
+    type?: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
+    /** Body param: When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always */
+    allowAuthenticateViaWarp?: boolean;
+    /** Body param: Enables loading application content in an iFrame. */
+    allowIframe?: boolean;
+    /** Body param: The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. */
+    allowedIdps?: string[];
+    /** Body param: Displays the application in the App Launcher. */
+    appLauncherVisible?: boolean;
+    /** Body param: When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps. */
+    autoRedirectToIdentity?: boolean;
+    /** Body param */
+    corsHeaders?: {
+        allowAllHeaders?: boolean;
+        allowAllMethods?: boolean;
+        allowAllOrigins?: boolean;
+        allowCredentials?: boolean;
+        allowedHeaders?: string[];
+        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[];
+        allowedOrigins?: string[];
+        maxAge?: number;
+    };
+    /** Body param: The custom error message shown to a user when they are denied access to the application. */
+    customDenyMessage?: string;
+    /** Body param: The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. */
+    customDenyUrl?: string;
+    /** Body param: The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. */
+    customNonIdentityDenyUrl?: string;
+    /** Body param: The custom pages that will be displayed when applicable for this application */
+    customPages?: string[];
+    /** Body param: List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `se */
     destinations?: ({
-        type?: "public" | null;
-        uri?: string | null;
+        type?: "public";
+        uri?: string;
     } | {
-        cidr?: string | null;
-        hostname?: string | null;
-        l4Protocol?: "tcp" | "udp" | (string & {}) | null;
-        portRange?: string | null;
-        type?: "private" | null;
-        vnetId?: string | null;
+        cidr?: string;
+        hostname?: string;
+        l4Protocol?: "tcp" | "udp" | (string & {});
+        portRange?: string;
+        type?: "private";
+        vnetId?: string;
     } | {
-        mcpServerId?: string | null;
-        type?: "via_mcp_server_portal" | null;
-    })[] | null;
-    domain?: string | null;
-    httpOnlyCookieAttribute?: boolean | null;
-    logoUrl?: string | null;
-    name?: string | null;
+        mcpServerId?: string;
+        type?: "via_mcp_server_portal";
+    })[];
+    /** Body param: Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. */
+    enableBindingCookie?: boolean;
+    /** Body param: Enables the HttpOnly cookie attribute, which increases security against XSS attacks. */
+    httpOnlyCookieAttribute?: boolean;
+    /** Body param: The image URL for the logo shown in the App Launcher dashboard. */
+    logoUrl?: string;
+    /** Body param: Configures multi-factor authentication (MFA) settings. */
+    mfaConfig?: {
+        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
+        mfaDisabled?: boolean;
+        sessionDuration?: string;
+    };
+    /** Body param: The name of the application. */
+    name?: string;
+    /** Body param:  Beta:  Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compati */
     oauthConfiguration?: {
         dynamicClientRegistration?: {
-            allowAnyOnLocalhost?: boolean | null;
-            allowAnyOnLoopback?: boolean | null;
-            allowedUris?: string[] | null;
-            enabled?: boolean | null;
-        } | null;
-        enabled?: boolean | null;
+            allowAnyOnLocalhost?: boolean;
+            allowAnyOnLoopback?: boolean;
+            allowedUris?: string[];
+            enabled?: boolean;
+        };
+        enabled?: boolean;
         grant?: {
-            accessTokenLifetime?: string | null;
-            sessionDuration?: string | null;
-        } | null;
-    } | null;
-    optionsPreflightBypass?: boolean | null;
-    policies?: {
-        id?: string | null;
+            accessTokenLifetime?: string;
+            sessionDuration?: string;
+        };
+    };
+    /** Body param: Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set. */
+    optionsPreflightBypass?: boolean;
+    /** Body param: Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default */
+    pathCookieAttribute?: boolean;
+    /** Body param: The policies that Access applies to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application. Reusable a */
+    policies?: ({
+        id?: string;
+        precedence?: number;
+    } | string | {
+        id?: string;
         approvalGroups?: {
             approvalsNeeded: number;
-            emailAddresses?: string[] | null;
-            emailListUuid?: string | null;
-        }[] | null;
-        approvalRequired?: boolean | null;
+            emailAddresses?: string[];
+            emailListUuid?: string;
+        }[];
+        approvalRequired?: boolean;
         connectionRules?: {
             rdp?: {
-                allowedClipboardLocalToRemoteFormats?: "text"[] | null;
-                allowedClipboardRemoteToLocalFormats?: "text"[] | null;
-            } | null;
-        } | null;
-        createdAt?: string | null;
-        decision?: "allow" | "deny" | "non_identity" | "bypass" | (string & {}) | null;
-        exclude?: ({
+                allowedClipboardLocalToRemoteFormats?: "text"[];
+                allowedClipboardRemoteToLocalFormats?: "text"[];
+            };
+        };
+        isolationRequired?: boolean;
+        mfaConfig?: {
+            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
+            mfaDisabled?: boolean;
+            sessionDuration?: string;
+        };
+        precedence?: number;
+        purposeJustificationPrompt?: string;
+        purposeJustificationRequired?: boolean;
+        sessionDuration?: string;
+    })[] | {
+        decision: "allow" | "deny" | "non_identity" | "bypass" | (string & {});
+        include: ({
             group: {
                 id: string;
             };
@@ -12243,7 +13193,7 @@ export type CreateAccessApplicationResponse = {
             githubOrganization: {
                 identityProviderId: string;
                 name: string;
-                team?: string | null;
+                team?: string;
             };
         } | {
             gsuite: {
@@ -12293,10 +13243,17 @@ export type CreateAccessApplicationResponse = {
             };
         } | {
             cloudflareAccountMember: {
-                accountId?: string | null;
+                accountId?: string;
             };
-        })[] | null;
-        include?: ({
+        })[];
+        name: string;
+        connectionRules?: {
+            ssh?: {
+                usernames: string[];
+                allowEmailAlias?: boolean;
+            };
+        };
+        exclude?: ({
             group: {
                 id: string;
             };
@@ -12354,7 +13311,7 @@ export type CreateAccessApplicationResponse = {
             githubOrganization: {
                 identityProviderId: string;
                 name: string;
-                team?: string | null;
+                team?: string;
             };
         } | {
             gsuite: {
@@ -12404,19 +13361,14 @@ export type CreateAccessApplicationResponse = {
             };
         } | {
             cloudflareAccountMember: {
-                accountId?: string | null;
+                accountId?: string;
             };
-        })[] | null;
-        isolationRequired?: boolean | null;
+        })[];
         mfaConfig?: {
-            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[] | null;
-            mfaDisabled?: boolean | null;
-            sessionDuration?: string | null;
-        } | null;
-        name?: string | null;
-        precedence?: number | null;
-        purposeJustificationPrompt?: string | null;
-        purposeJustificationRequired?: boolean | null;
+            allowedAuthenticators?: "ssh_piv_key"[];
+            mfaDisabled?: boolean;
+            sessionDuration?: string;
+        };
         require?: ({
             group: {
                 id: string;
@@ -12475,7 +13427,7 @@ export type CreateAccessApplicationResponse = {
             githubOrganization: {
                 identityProviderId: string;
                 name: string;
-                team?: string | null;
+                team?: string;
             };
         } | {
             gsuite: {
@@ -12525,186 +13477,10 @@ export type CreateAccessApplicationResponse = {
             };
         } | {
             cloudflareAccountMember: {
-                accountId?: string | null;
-            };
-        })[] | null;
-        sessionDuration?: string | null;
-        updatedAt?: string | null;
-    }[] | null;
-    sameSiteCookieAttribute?: string | null;
-    scimConfig?: {
-        idpUid: string;
-        remoteUri: string;
-        authentication?: {
-            password: string;
-            scheme: "httpbasic";
-            user: string;
-        } | {
-            token: string;
-            scheme: "oauthbearertoken";
-        } | {
-            authorizationUrl: string;
-            clientId: string;
-            clientSecret: string;
-            scheme: "oauth2";
-            tokenUrl: string;
-            scopes?: string[] | null;
-        } | {
-            clientId: string;
-            clientSecret: string;
-            scheme: "access_service_token";
-        } | ({
-            password: string;
-            scheme: "httpbasic";
-            user: string;
-        } | {
-            token: string;
-            scheme: "oauthbearertoken";
-        } | {
-            authorizationUrl: string;
-            clientId: string;
-            clientSecret: string;
-            scheme: "oauth2";
-            tokenUrl: string;
-            scopes?: string[] | null;
-        } | {
-            clientId: string;
-            clientSecret: string;
-            scheme: "access_service_token";
-        })[] | null;
-        deactivateOnDelete?: boolean | null;
-        enabled?: boolean | null;
-        mappings?: {
-            schema: string;
-            enabled?: boolean | null;
-            filter?: string | null;
-            operations?: {
-                create?: boolean | null;
-                delete?: boolean | null;
-                update?: boolean | null;
-            } | null;
-            strictness?: "strict" | "passthrough" | (string & {}) | null;
-            transformJsonata?: string | null;
-        }[] | null;
-    } | null;
-    sessionDuration?: string | null;
-    tags?: string[] | null;
-};
-export declare const CreateAccessApplicationResponse: Schema.Schema<CreateAccessApplicationResponse>;
-export type CreateAccessApplicationError = DefaultErrors;
-export declare const createAccessApplicationForAccount: API.OperationMethod<CreateAccessApplicationForAccountRequest, CreateAccessApplicationResponse, CreateAccessApplicationError, Credentials | HttpClient.HttpClient>;
-export declare const createAccessApplicationForZone: API.OperationMethod<CreateAccessApplicationForZoneRequest, CreateAccessApplicationResponse, CreateAccessApplicationError, Credentials | HttpClient.HttpClient>;
-interface UpdateAccessApplicationBaseRequest {
-    appId: string;
-    /** Body param: The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. */
-    domain: string;
-    /** Body param: The application type. */
-    type: "self_hosted" | "saas" | "ssh" | "vnc" | "app_launcher" | "warp" | "biso" | "bookmark" | "dash_sso" | "infrastructure" | "rdp" | "mcp" | "mcp_portal" | "proxy_endpoint" | (string & {});
-    /** Body param: When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always */
-    allowAuthenticateViaWarp?: boolean;
-    /** Body param: Enables loading application content in an iFrame. */
-    allowIframe?: boolean;
-    /** Body param: The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. */
-    allowedIdps?: string[];
-    /** Body param: Displays the application in the App Launcher. */
-    appLauncherVisible?: boolean;
-    /** Body param: When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps. */
-    autoRedirectToIdentity?: boolean;
-    /** Body param */
-    corsHeaders?: {
-        allowAllHeaders?: boolean;
-        allowAllMethods?: boolean;
-        allowAllOrigins?: boolean;
-        allowCredentials?: boolean;
-        allowedHeaders?: string[];
-        allowedMethods?: ("GET" | "POST" | "HEAD" | "PUT" | "DELETE" | "CONNECT" | "OPTIONS" | "TRACE" | "PATCH" | (string & {}))[];
-        allowedOrigins?: string[];
-        maxAge?: number;
-    };
-    /** Body param: The custom error message shown to a user when they are denied access to the application. */
-    customDenyMessage?: string;
-    /** Body param: The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. */
-    customDenyUrl?: string;
-    /** Body param: The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. */
-    customNonIdentityDenyUrl?: string;
-    /** Body param: The custom pages that will be displayed when applicable for this application */
-    customPages?: string[];
-    /** Body param: List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `se */
-    destinations?: ({
-        type?: "public";
-        uri?: string;
-    } | {
-        cidr?: string;
-        hostname?: string;
-        l4Protocol?: "tcp" | "udp" | (string & {});
-        portRange?: string;
-        type?: "private";
-        vnetId?: string;
-    } | {
-        mcpServerId?: string;
-        type?: "via_mcp_server_portal";
-    })[];
-    /** Body param: Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. */
-    enableBindingCookie?: boolean;
-    /** Body param: Enables the HttpOnly cookie attribute, which increases security against XSS attacks. */
-    httpOnlyCookieAttribute?: boolean;
-    /** Body param: The image URL for the logo shown in the App Launcher dashboard. */
-    logoUrl?: string;
-    /** Body param: Configures multi-factor authentication (MFA) settings. */
-    mfaConfig?: {
-        allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
-        mfaDisabled?: boolean;
-        sessionDuration?: string;
-    };
-    /** Body param: The name of the application. */
-    name?: string;
-    /** Body param:  Beta:  Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compati */
-    oauthConfiguration?: {
-        dynamicClientRegistration?: {
-            allowAnyOnLocalhost?: boolean;
-            allowAnyOnLoopback?: boolean;
-            allowedUris?: string[];
-            enabled?: boolean;
-        };
-        enabled?: boolean;
-        grant?: {
-            accessTokenLifetime?: string;
-            sessionDuration?: string;
-        };
-    };
-    /** Body param: Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set. */
-    optionsPreflightBypass?: boolean;
-    /** Body param: Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default */
-    pathCookieAttribute?: boolean;
-    /** Body param: The policies that Access applies to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application. Reusable a */
-    policies?: ({
-        id?: string;
-        precedence?: number;
-    } | string | {
-        id?: string;
-        approvalGroups?: {
-            approvalsNeeded: number;
-            emailAddresses?: string[];
-            emailListUuid?: string;
-        }[];
-        approvalRequired?: boolean;
-        connectionRules?: {
-            rdp?: {
-                allowedClipboardLocalToRemoteFormats?: "text"[];
-                allowedClipboardRemoteToLocalFormats?: "text"[];
+                accountId?: string;
             };
-        };
-        isolationRequired?: boolean;
-        mfaConfig?: {
-            allowedAuthenticators?: ("totp" | "biometrics" | "security_key" | (string & {}))[];
-            mfaDisabled?: boolean;
-            sessionDuration?: string;
-        };
-        precedence?: number;
-        purposeJustificationPrompt?: string;
-        purposeJustificationRequired?: boolean;
-        sessionDuration?: string;
-    })[];
+        })[];
+    }[];
     /** Body param: Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The */
     readServiceTokensFromHeader?: string;
     /** Body param: Sets the SameSite cookie setting, which provides increased security against CSRF attacks. */
@@ -12777,6 +13553,88 @@ interface UpdateAccessApplicationBaseRequest {
     tags?: string[];
     /** Body param: Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clien */
     useClientlessIsolationAppLauncherUrl?: boolean;
+    /** Body param */
+    saasApp?: {
+        authType?: "saml" | "oidc" | (string & {});
+        consumerServiceUrl?: string;
+        customAttributes?: {
+            friendlyName?: string;
+            name?: string;
+            nameFormat?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" | (string & {});
+            required?: boolean;
+            source?: {
+                name?: string;
+                nameByIdp?: {
+                    idpId?: string;
+                    sourceName?: string;
+                }[];
+            };
+        }[];
+        defaultRelayState?: string;
+        idpEntityId?: string;
+        nameIdFormat?: "id" | "email" | (string & {});
+        nameIdTransformJsonata?: string;
+        publicKey?: string;
+        samlAttributeTransformJsonata?: string;
+        spEntityId?: string;
+        ssoEndpoint?: string;
+        accessTokenLifetime?: string;
+        allowPkceWithoutClientSecret?: boolean;
+        appLauncherUrl?: string;
+        clientId?: string;
+        clientSecret?: string;
+        customClaims?: {
+            name?: string;
+            required?: boolean;
+            scope?: "groups" | "profile" | "email" | "openid" | (string & {});
+            source?: {
+                name?: string;
+                nameByIdp?: Record<string, unknown>;
+            };
+        }[];
+        grantTypes?: ("authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | "hybrid" | "implicit" | (string & {}))[];
+        groupFilterRegex?: string;
+        hybridAndImplicitOptions?: {
+            returnAccessTokenFromAuthorizationEndpoint?: boolean;
+            returnIdTokenFromAuthorizationEndpoint?: boolean;
+        };
+        redirectUris?: string[];
+        refreshTokenOptions?: {
+            lifetime?: string;
+        };
+        scopes?: ("openid" | "groups" | "email" | "profile" | (string & {}))[];
+    };
+    /** Body param: The image URL of the logo shown in the App Launcher header. */
+    appLauncherLogoUrl?: string;
+    /** Body param: The background color of the App Launcher page. */
+    bgColor?: string;
+    /** Body param: The links in the App Launcher footer. */
+    footerLinks?: {
+        name: string;
+        url: string;
+    }[];
+    /** Body param: The background color of the App Launcher header. */
+    headerBgColor?: string;
+    /** Body param: The design of the App Launcher landing page shown to users when they log in. */
+    landingPageDesign?: {
+        buttonColor?: string;
+        buttonTextColor?: string;
+        imageUrl?: string;
+        message?: string;
+        title?: string;
+    };
+    /** Body param: Determines when to skip the App Launcher landing page. */
+    skipAppLauncherLoginPage?: boolean;
+    /** Body param */
+    targetCriteria?: {
+        port: number;
+        protocol: "SSH";
+        targetAttributes: Record<string, unknown>;
+    }[] | {
+        port: number;
+        protocol: "RDP";
+        targetAttributes: Record<string, unknown>;
+    }[];
 }
 export interface UpdateAccessApplicationForAccountRequest extends UpdateAccessApplicationBaseRequest {
     /** Path param: The Account ID to use for this endpoint. */
@@ -30269,14 +31127,14 @@ export interface UpdateDlpEntryRequest {
     /** Path param */
     accountId: string;
     /** Body param */
-    name: string;
+    name?: string;
     /** Body param */
-    pattern: {
+    pattern?: {
         regex: string;
         validation?: "luhn";
     };
     /** Body param */
-    type: "custom";
+    type: "custom" | "predefined" | "integration" | (string & {});
     /** Body param */
     description?: string | null;
     /** Body param */
@@ -35326,7 +36184,7 @@ export interface CreateGatewayProxyEndpointRequest {
     /** Body param: Specify the name of the proxy endpoint. */
     name: string;
     /** Body param: The proxy endpoint kind */
-    kind?: "ip";
+    kind?: "ip" | "identity" | (string & {});
 }
 export declare const CreateGatewayProxyEndpointRequest: Schema.Schema<CreateGatewayProxyEndpointRequest>;
 export type CreateGatewayProxyEndpointResponse = {
@@ -37066,6 +37924,30 @@ interface CreateIdentityProviderBaseRequest {
         emailClaimName?: string;
         prompt?: "login" | "select_account" | "none" | (string & {});
         supportGroups?: boolean;
+        centrifyAccount?: string;
+        centrifyAppId?: string;
+        appsDomain?: string;
+        authUrl?: string;
+        certsUrl?: string;
+        pkceEnabled?: boolean;
+        scopes?: string[];
+        tokenUrl?: string;
+        authorizationServerId?: string;
+        oktaAccount?: string;
+        oneloginAccount?: string;
+        pingEnvId?: string;
+        attributes?: string[];
+        emailAttributeName?: string;
+        enableEncryption?: boolean;
+        headerAttributes?: {
+            attributeName?: string;
+            headerName?: string;
+        }[];
+        idpPublicCerts?: string[];
+        issuerUrl?: string;
+        signRequest?: boolean;
+        ssoTargetUrl?: string;
+        restrictToAccountMembers?: boolean;
     };
     /** Body param: The name of the identity provider, shown to users on the login page. */
     name: string;
@@ -37496,6 +38378,30 @@ interface UpdateIdentityProviderBaseRequest {
         emailClaimName?: string;
         prompt?: "login" | "select_account" | "none" | (string & {});
         supportGroups?: boolean;
+        centrifyAccount?: string;
+        centrifyAppId?: string;
+        appsDomain?: string;
+        authUrl?: string;
+        certsUrl?: string;
+        pkceEnabled?: boolean;
+        scopes?: string[];
+        tokenUrl?: string;
+        authorizationServerId?: string;
+        oktaAccount?: string;
+        oneloginAccount?: string;
+        pingEnvId?: string;
+        attributes?: string[];
+        emailAttributeName?: string;
+        enableEncryption?: boolean;
+        headerAttributes?: {
+            attributeName?: string;
+            headerName?: string;
+        }[];
+        idpPublicCerts?: string[];
+        issuerUrl?: string;
+        signRequest?: boolean;
+        ssoTargetUrl?: string;
+        restrictToAccountMembers?: boolean;
     };
     /** Body param: The name of the identity provider, shown to users on the login page. */
     name: string;