@pulumi/databricks 1.92.0-alpha.1778394392 → 1.92.0

package/types/output.d.ts

@@ -89,6 +89,12 @@ export interface AccountNetworkPolicyEgressNetworkAccess {
      * List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
      */
     allowedStorageDestinations?: outputs.AccountNetworkPolicyEgressNetworkAccessAllowedStorageDestination[];
+    /**
+     * List of internet destinations that serverless workloads are blocked from accessing.
+     * These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
+     * Currently supports DNS_NAME type only; IP_RANGE support is planned
+     */
+    blockedInternetDestinations?: outputs.AccountNetworkPolicyEgressNetworkAccessBlockedInternetDestination[];
     /**
      * Optional. When policyEnforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES
      */
@@ -118,6 +124,13 @@ export interface AccountNetworkPolicyEgressNetworkAccessAllowedStorageDestinatio
      */
     storageDestinationType?: string;
 }
+export interface AccountNetworkPolicyEgressNetworkAccessBlockedInternetDestination {
+    destination?: string;
+    /**
+     * The type of internet destination. Currently only DNS_NAME is supported. Possible values are: `DNS_NAME`
+     */
+    internetDestinationType?: string;
+}
 export interface AccountNetworkPolicyEgressNetworkAccessPolicyEnforcement {
     /**
      * When empty, it means dry run for all products.
@@ -132,11 +145,164 @@ export interface AccountNetworkPolicyEgressNetworkAccessPolicyEnforcement {
     enforcementMode?: string;
 }
 export interface AccountNetworkPolicyIngress {
+    /**
+     * The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.AccountNetworkPolicyIngressPrivateAccess;
+    /**
+     * The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
+     */
     publicAccess?: outputs.AccountNetworkPolicyIngressPublicAccess;
 }
 export interface AccountNetworkPolicyIngressDryRun {
+    /**
+     * The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccess;
+    /**
+     * The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
+     */
     publicAccess?: outputs.AccountNetworkPolicyIngressDryRunPublicAccess;
 }
+export interface AccountNetworkPolicyIngressDryRunPrivateAccess {
+    allowRules?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRule[];
+    denyRules?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRule[];
+    restrictionMode: string;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRule {
+    authentication?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthentication;
+    destination?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination;
+    label?: string;
+    origin?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthentication {
+    /**
+     * Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity {
+    principalId?: string;
+    /**
+     * Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
+    allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime;
+    workspaceApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi;
+    workspaceUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin {
+    allPrivateAccess?: boolean;
+    allRegisteredEndpoints?: boolean;
+    azureWorkspacePrivateLink?: boolean;
+    endpoints?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
+    endpointIds?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRule {
+    authentication?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthentication;
+    destination?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination;
+    label?: string;
+    origin?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthentication {
+    /**
+     * Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity {
+    principalId?: string;
+    /**
+     * Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
+    allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime;
+    workspaceApi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi;
+    workspaceUi?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin {
+    allPrivateAccess?: boolean;
+    allRegisteredEndpoints?: boolean;
+    azureWorkspacePrivateLink?: boolean;
+    endpoints?: outputs.AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface AccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
+    endpointIds?: string[];
+}
 export interface AccountNetworkPolicyIngressDryRunPublicAccess {
     allowRules?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRule[];
     denyRules?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRule[];
@@ -145,10 +311,6 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccess {
 export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRule {
     authentication?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentication;
     destination?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination;
-    /**
-     * User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
-     */
     label?: string;
     origin?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOrigin;
 }
@@ -170,14 +332,33 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentic
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime;
     workspaceApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi;
-    /**
-     * Workspace destinations
-     */
     workspaceUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi;
 }
+export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
 export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
     scopes?: string[];
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi {
@@ -212,10 +393,6 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginInc
 export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRule {
     authentication?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentication;
     destination?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination;
-    /**
-     * User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
-     */
     label?: string;
     origin?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOrigin;
 }
@@ -237,14 +414,33 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentica
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime;
     workspaceApi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi;
-    /**
-     * Workspace destinations
-     */
     workspaceUi?: outputs.AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi;
 }
+export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
 export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
     scopes?: string[];
 }
 export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi {
@@ -276,6 +472,141 @@ export interface AccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginIncl
      */
     ipRanges?: string[];
 }
+export interface AccountNetworkPolicyIngressPrivateAccess {
+    allowRules?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRule[];
+    denyRules?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRule[];
+    restrictionMode: string;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRule {
+    authentication?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleAuthentication;
+    destination?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestination;
+    label?: string;
+    origin?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleAuthentication {
+    /**
+     * Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleAuthenticationIdentity {
+    principalId?: string;
+    /**
+     * Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi;
+    allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationLakebaseRuntime;
+    workspaceApi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceApi;
+    workspaceUi?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin {
+    allPrivateAccess?: boolean;
+    allRegisteredEndpoints?: boolean;
+    azureWorkspacePrivateLink?: boolean;
+    endpoints?: outputs.AccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints {
+    endpointIds?: string[];
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRule {
+    authentication?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleAuthentication;
+    destination?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestination;
+    label?: string;
+    origin?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleAuthentication {
+    /**
+     * Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticationIdentity {
+    principalId?: string;
+    /**
+     * Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi;
+    allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationLakebaseRuntime;
+    workspaceApi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceApi;
+    workspaceUi?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin {
+    allPrivateAccess?: boolean;
+    allRegisteredEndpoints?: boolean;
+    azureWorkspacePrivateLink?: boolean;
+    endpoints?: outputs.AccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface AccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints {
+    endpointIds?: string[];
+}
 export interface AccountNetworkPolicyIngressPublicAccess {
     allowRules?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRule[];
     denyRules?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRule[];
@@ -284,10 +615,6 @@ export interface AccountNetworkPolicyIngressPublicAccess {
 export interface AccountNetworkPolicyIngressPublicAccessAllowRule {
     authentication?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleAuthentication;
     destination?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestination;
-    /**
-     * User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
-     */
     label?: string;
     origin?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleOrigin;
 }
@@ -309,14 +636,33 @@ export interface AccountNetworkPolicyIngressPublicAccessAllowRuleAuthenticationI
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi;
     allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationLakebaseRuntime;
     workspaceApi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceApi;
-    /**
-     * Workspace destinations
-     */
     workspaceUi?: outputs.AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceUi;
 }
+export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
 export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
     scopes?: string[];
 }
 export interface AccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceUi {
@@ -351,10 +697,6 @@ export interface AccountNetworkPolicyIngressPublicAccessAllowRuleOriginIncludedI
 export interface AccountNetworkPolicyIngressPublicAccessDenyRule {
     authentication?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleAuthentication;
     destination?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestination;
-    /**
-     * User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
-     */
     label?: string;
     origin?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleOrigin;
 }
@@ -376,14 +718,33 @@ export interface AccountNetworkPolicyIngressPublicAccessDenyRuleAuthenticationId
     principalType?: string;
 }
 export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestination {
+    accountApi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi;
+    accountDatabricksOne?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    accountUi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi;
     allDestinations?: boolean;
+    appsRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAppsRuntime;
+    lakebaseRuntime?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationLakebaseRuntime;
     workspaceApi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceApi;
-    /**
-     * Workspace destinations
-     */
     workspaceUi?: outputs.AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceUi;
 }
+export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi {
+    scopeQualifier?: string;
+    scopes?: string[];
+}
+export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAppsRuntime {
+    allDestinations?: boolean;
+}
+export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationLakebaseRuntime {
+    allDestinations?: boolean;
+}
 export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
     scopes?: string[];
 }
 export interface AccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceUi {
@@ -1633,6 +1994,7 @@ export interface ClusterGcpAttributes {
      * Boot disk size in GB
      */
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     /**
      * The first `firstOnDemand` nodes of the cluster will be placed on on-demand instances. If this value is greater than 0, the cluster driver node will be placed on an on-demand instance. If this value is greater than or equal to the current cluster size, all nodes will be placed on on-demand instances. If this value is less than the current cluster size, `firstOnDemand` nodes will be placed on on-demand instances, and the remainder will be placed on availability instances. This value does not affect cluster size and cannot be mutated over the lifetime of a cluster.
      */
@@ -1771,7 +2133,7 @@ export interface ClusterPolicyLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.ClusterPolicyLibraryProviderConfig;
+    providerConfig: outputs.ClusterPolicyLibraryProviderConfig;
     pypi?: outputs.ClusterPolicyLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -1966,7 +2328,8 @@ export interface DataClassificationCatalogConfigAutoTagConfig {
      */
     autoTaggingMode: string;
     /**
-     * The Classification Tag (e.g., "class.name", "class.location")
+     * The Classification Tag. For built-in classes this is a system tag (e.g., "class.name",
+     * "class.location"); for custom classes it is a user-defined governance tag key
      */
     classificationTag: string;
 }
@@ -2545,8 +2908,77 @@ export interface DisableLegacyFeaturesSettingDisableLegacyFeatures {
     value: boolean;
 }
 export interface DisableLegacyFeaturesSettingProviderConfig {
+    /**
+     * @deprecated workspace_id is ignored for account-only resources.
+     */
     workspaceId: string;
 }
+export interface DisasterRecoveryFailoverGroupUnityCatalogAssets {
+    /**
+     * UC catalogs to replicate
+     */
+    catalogs: outputs.DisasterRecoveryFailoverGroupUnityCatalogAssetsCatalog[];
+    /**
+     * The workspace set whose workspaces will be used for data replication
+     * of all UC catalogs' underlying storage
+     */
+    dataReplicationWorkspaceSet: string;
+    /**
+     * Location mappings - storage URI per region for each location
+     */
+    locationMappings?: outputs.DisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMapping[];
+}
+export interface DisasterRecoveryFailoverGroupUnityCatalogAssetsCatalog {
+    /**
+     * (string) - Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+}
+export interface DisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMapping {
+    /**
+     * (string) - Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+    /**
+     * URI for each region. Each entry maps a region name to a storage URI
+     */
+    uriByRegions: outputs.DisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion[];
+}
+export interface DisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion {
+    /**
+     * The region name
+     */
+    region: string;
+    /**
+     * The storage URI for this region
+     */
+    uri: string;
+}
+export interface DisasterRecoveryFailoverGroupWorkspaceSet {
+    /**
+     * (string) - Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+    /**
+     * Whether to enable control plane DR (notebooks, jobs, clusters, etc.) for this set.
+     * Requires all workspaces in the set to be Mission Critical tier
+     */
+    replicateWorkspaceAssets: boolean;
+    /**
+     * Resource names of stable URLs associated with this workspace set.
+     * Format: accounts/{account_id}/stable-urls/{stable_url_id}.
+     * The referenced stable URLs must already exist (via CreateStableUrl)
+     */
+    stableUrlNames?: string[];
+    /**
+     * Workspace IDs in this set. The system derives and validates regions.
+     * EA: exactly 2 workspaces (one per region)
+     */
+    workspaceIds: string[];
+}
 export interface EndpointAzurePrivateEndpointInfo {
     /**
      * The name of the Private Endpoint in the Azure subscription
@@ -3071,8 +3503,13 @@ export interface FeatureEngineeringKafkaConfigAuthConfig {
 }
 export interface FeatureEngineeringKafkaConfigBackfillSource {
     /**
-     * The Delta table source containing the historic data to backfill.
-     * Only the delta table name is used for backfill, the entity columns and timeseries column are ignored as they are defined by the associated KafkaSource
+     * The full three-part name (catalog, schema, name) of the Delta table containing the historical data to backfill
+     */
+    deltaTableName?: string;
+    /**
+     * Deprecated: Use deltaTableName instead. Kept for backwards compatibility.
+     * The Delta table source containing the historical data to backfill.
+     * Only the delta table name is used for backfill, other fields are ignored
      */
     deltaTableSource?: outputs.FeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource;
 }
@@ -3329,6 +3766,12 @@ export interface GetAccountNetworkPoliciesItemEgressNetworkAccess {
      * (list of EgressNetworkPolicyNetworkAccessPolicyStorageDestination) - List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
      */
     allowedStorageDestinations?: outputs.GetAccountNetworkPoliciesItemEgressNetworkAccessAllowedStorageDestination[];
+    /**
+     * (list of EgressNetworkPolicyNetworkAccessPolicyInternetDestination) - List of internet destinations that serverless workloads are blocked from accessing.
+     * These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
+     * Currently supports DNS_NAME type only; IP_RANGE support is planned
+     */
+    blockedInternetDestinations?: outputs.GetAccountNetworkPoliciesItemEgressNetworkAccessBlockedInternetDestination[];
     /**
      * (EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcement) - Optional. When policyEnforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES
      */
@@ -3370,12 +3813,22 @@ export interface GetAccountNetworkPoliciesItemEgressNetworkAccessAllowedStorageD
      */
     storageDestinationType?: string;
 }
-export interface GetAccountNetworkPoliciesItemEgressNetworkAccessPolicyEnforcement {
+export interface GetAccountNetworkPoliciesItemEgressNetworkAccessBlockedInternetDestination {
     /**
-     * (list of string) - When empty, it means dry run for all products.
-     * When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    dryRunModeProductFilters?: string[];
+    destination?: string;
+    /**
+     * (string) - The type of internet destination. Currently only DNS_NAME is supported. Possible values are: `DNS_NAME`
+     */
+    internetDestinationType?: string;
+}
+export interface GetAccountNetworkPoliciesItemEgressNetworkAccessPolicyEnforcement {
+    /**
+     * (list of string) - When empty, it means dry run for all products.
+     * When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode
+     */
+    dryRunModeProductFilters?: string[];
     /**
      * (string) - The mode of policy enforcement. ENFORCED blocks traffic that violates policy,
      * while DRY_RUN only logs violations without blocking. When not specified,
@@ -3385,60 +3838,71 @@ export interface GetAccountNetworkPoliciesItemEgressNetworkAccessPolicyEnforceme
 }
 export interface GetAccountNetworkPoliciesItemIngress {
     /**
-     * (CustomerFacingIngressNetworkPolicyPublicAccess)
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccess;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicAccess) - The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
      */
     publicAccess?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccess;
 }
 export interface GetAccountNetworkPoliciesItemIngressDryRun {
     /**
-     * (CustomerFacingIngressNetworkPolicyPublicAccess)
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccess;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicAccess) - The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
      */
     publicAccess?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccess;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccess {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccess {
     /**
      * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule[];
+    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRule[];
     /**
      * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRule[];
+    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRule[];
     /**
      * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
      */
     restrictionMode: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRule {
     /**
      * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthentication;
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleAuthentication;
     /**
      * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestination;
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
      * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOrigin;
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOrigin;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthentication {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleAuthentication {
     /**
      * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthenticationIdentity[];
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity[];
     /**
      * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
     identityType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthenticationIdentity {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity {
     /**
      * (integer)
      */
@@ -3448,88 +3912,143 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule
      */
     principalType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestination {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi;
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
-    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi;
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOrigin {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAccountUi {
     /**
-     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     * (boolean) - Must be set to true
      */
-    allIpRanges?: boolean;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     * (boolean) - Must be set to true
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     * (boolean) - Must be set to true
      */
-    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges;
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
      */
-    ipRanges?: string[];
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (boolean) - Must be set to true
      */
-    ipRanges?: string[];
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRule {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRule {
     /**
      * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthentication;
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleAuthentication;
     /**
      * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestination;
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
      * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOrigin;
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOrigin;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthentication {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleAuthentication {
     /**
      * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthenticationIdentity[];
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity[];
     /**
      * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
     identityType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthenticationIdentity {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity {
     /**
      * (integer)
      */
@@ -3539,102 +4058,157 @@ export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleA
      */
     principalType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestination {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi;
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
-    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi;
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOrigin {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAccountUi {
     /**
-     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     * (boolean) - Must be set to true
      */
-    allIpRanges?: boolean;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     * (boolean) - Must be set to true
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     * (boolean) - Must be set to true
      */
-    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges;
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
      */
-    ipRanges?: string[];
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (boolean) - Must be set to true
      */
-    ipRanges?: string[];
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccess {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccess {
     /**
      * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRule[];
+    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule[];
     /**
      * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRule[];
+    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRule[];
     /**
      * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
      */
     restrictionMode: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRule {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRule {
     /**
      * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthentication;
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthentication;
     /**
      * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    destination?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestination;
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
      * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    origin?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOrigin;
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOrigin;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthentication {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthentication {
     /**
      * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    identities?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthenticationIdentity[];
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthenticationIdentity[];
     /**
      * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
     identityType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthenticationIdentity {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleAuthenticationIdentity {
     /**
      * (integer)
      */
@@ -3644,33 +4218,91 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthen
      */
     principalType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestination {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceApi;
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
-    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceUi;
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceApi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOrigin {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOrigin {
     /**
      * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
      */
@@ -3678,54 +4310,53 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOrigin
     /**
      * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginExcludedIpRanges;
+    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges;
     /**
      * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
      */
-    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginIncludedIpRanges;
+    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginExcludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges {
     /**
      * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
      */
     ipRanges?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges {
     /**
      * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
      */
     ipRanges?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRule {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRule {
     /**
      * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthentication;
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthentication;
     /**
      * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    destination?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestination;
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
      * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    origin?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOrigin;
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOrigin;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthentication {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthentication {
     /**
      * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    identities?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthenticationIdentity[];
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthenticationIdentity[];
     /**
      * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
     identityType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthenticationIdentity {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleAuthenticationIdentity {
     /**
      * (integer)
      */
@@ -3735,33 +4366,1432 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthent
      */
     principalType?: string;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestination {
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceApi;
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOrigin {
+    /**
+     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     */
+    allIpRanges?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     */
+    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     */
+    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges;
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccess {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRule[];
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRule[];
+    /**
+     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     */
+    restrictionMode: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOrigin;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessAllowRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOrigin;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPoliciesItemIngressPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccess {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    allowRules?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRule[];
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    denyRules?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRule[];
+    /**
+     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     */
+    restrictionMode: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOrigin;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOrigin {
+    /**
+     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     */
+    allIpRanges?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     */
+    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginExcludedIpRanges;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     */
+    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginIncludedIpRanges;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginExcludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessAllowRuleOriginIncludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOrigin;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
     workspaceUi?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceApi {
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOrigin {
+    /**
+     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     */
+    allIpRanges?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     */
+    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginExcludedIpRanges;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     */
+    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginIncludedIpRanges;
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginExcludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginIncludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPolicyEgress {
+    /**
+     * (EgressNetworkPolicyNetworkAccessPolicy) - The access policy enforced for egress traffic to the internet
+     */
+    networkAccess?: outputs.GetAccountNetworkPolicyEgressNetworkAccess;
+}
+export interface GetAccountNetworkPolicyEgressNetworkAccess {
+    /**
+     * (list of EgressNetworkPolicyNetworkAccessPolicyInternetDestination) - List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
+     */
+    allowedInternetDestinations?: outputs.GetAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestination[];
+    /**
+     * (list of EgressNetworkPolicyNetworkAccessPolicyStorageDestination) - List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
+     */
+    allowedStorageDestinations?: outputs.GetAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestination[];
+    /**
+     * (list of EgressNetworkPolicyNetworkAccessPolicyInternetDestination) - List of internet destinations that serverless workloads are blocked from accessing.
+     * These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
+     * Currently supports DNS_NAME type only; IP_RANGE support is planned
+     */
+    blockedInternetDestinations?: outputs.GetAccountNetworkPolicyEgressNetworkAccessBlockedInternetDestination[];
+    /**
+     * (EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcement) - Optional. When policyEnforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES
+     */
+    policyEnforcement?: outputs.GetAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement;
+    /**
+     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     */
+    restrictionMode: string;
+}
+export interface GetAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestination {
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: string;
+    /**
+     * (string) - The type of internet destination. Currently only DNS_NAME is supported. Possible values are: `DNS_NAME`
+     */
+    internetDestinationType?: string;
+}
+export interface GetAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestination {
+    /**
+     * (string) - The Azure storage account name
+     */
+    azureStorageAccount?: string;
+    /**
+     * (string) - The Azure storage service type (blob, dfs, etc.)
+     */
+    azureStorageService?: string;
+    /**
+     * (string)
+     */
+    bucketName?: string;
+    /**
+     * (string)
+     */
+    region?: string;
+    /**
+     * (string) - The type of storage destination. Possible values are: `AWS_S3`, `AZURE_STORAGE`, `GOOGLE_CLOUD_STORAGE`
+     */
+    storageDestinationType?: string;
+}
+export interface GetAccountNetworkPolicyEgressNetworkAccessBlockedInternetDestination {
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: string;
+    /**
+     * (string) - The type of internet destination. Currently only DNS_NAME is supported. Possible values are: `DNS_NAME`
+     */
+    internetDestinationType?: string;
+}
+export interface GetAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement {
+    /**
+     * (list of string) - When empty, it means dry run for all products.
+     * When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode
+     */
+    dryRunModeProductFilters?: string[];
+    /**
+     * (string) - The mode of policy enforcement. ENFORCED blocks traffic that violates policy,
+     * while DRY_RUN only logs violations without blocking. When not specified,
+     * defaults to ENFORCED. Possible values are: `DRY_RUN`, `ENFORCED`
+     */
+    enforcementMode?: string;
+}
+export interface GetAccountNetworkPolicyIngress {
+    /**
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.GetAccountNetworkPolicyIngressPrivateAccess;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicAccess) - The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
+     */
+    publicAccess?: outputs.GetAccountNetworkPolicyIngressPublicAccess;
+}
+export interface GetAccountNetworkPolicyIngressDryRun {
+    /**
+     * (CustomerFacingIngressNetworkPolicyPrivateAccess) - The network policy restrictions for private access to the workspace.
+     * Configures how registered private endpoints are allowed or denied access
+     */
+    privateAccess?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccess;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicAccess) - The network policy restrictions for public access to the workspace.
+     * Configures how public internet traffic is allowed or denied access
+     */
+    publicAccess?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccess;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccess {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    allowRules?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRule[];
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    denyRules?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRule[];
+    /**
+     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     */
+    restrictionMode: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessAllowRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccess {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    allowRules?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRule[];
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     */
+    denyRules?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRule[];
+    /**
+     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     */
+    restrictionMode: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOrigin;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOrigin {
+    /**
+     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     */
+    allIpRanges?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     */
+    excludedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges;
+    /**
+     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     */
+    includedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges {
+    /**
+     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     */
+    ipRanges?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRule {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     */
+    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentication;
+    /**
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     */
+    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination;
+    /**
+     * (string) - The label for this ingress rule
+     */
+    label?: string;
+    /**
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     */
+    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOrigin;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentication {
+    /**
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     */
+    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthenticationIdentity[];
+    /**
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     */
+    identityType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthenticationIdentity {
+    /**
+     * (integer)
+     */
+    principalId?: number;
+    /**
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     */
+    principalType?: string;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi;
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     */
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOrigin {
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOrigin {
     /**
      * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
      */
@@ -3769,240 +5799,213 @@ export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOrigin
     /**
      * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginExcludedIpRanges;
+    excludedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges;
     /**
      * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
      */
-    includedIpRanges?: outputs.GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginIncludedIpRanges;
+    includedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges;
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginExcludedIpRanges {
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges {
     /**
      * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
      */
     ipRanges?: string[];
 }
-export interface GetAccountNetworkPoliciesItemIngressPublicAccessDenyRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges {
     /**
      * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
      */
     ipRanges?: string[];
 }
-export interface GetAccountNetworkPolicyEgress {
-    /**
-     * (EgressNetworkPolicyNetworkAccessPolicy) - The access policy enforced for egress traffic to the internet
-     */
-    networkAccess?: outputs.GetAccountNetworkPolicyEgressNetworkAccess;
-}
-export interface GetAccountNetworkPolicyEgressNetworkAccess {
+export interface GetAccountNetworkPolicyIngressPrivateAccess {
     /**
-     * (list of EgressNetworkPolicyNetworkAccessPolicyInternetDestination) - List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
-     */
-    allowedInternetDestinations?: outputs.GetAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestination[];
-    /**
-     * (list of EgressNetworkPolicyNetworkAccessPolicyStorageDestination) - List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    allowedStorageDestinations?: outputs.GetAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestination[];
+    allowRules?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRule[];
     /**
-     * (EgressNetworkPolicyNetworkAccessPolicyPolicyEnforcement) - Optional. When policyEnforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES
+     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
      */
-    policyEnforcement?: outputs.GetAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement;
+    denyRules?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRule[];
     /**
      * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
      */
     restrictionMode: string;
 }
-export interface GetAccountNetworkPolicyEgressNetworkAccessAllowedInternetDestination {
-    /**
-     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
-     */
-    destination?: string;
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRule {
     /**
-     * (string) - The type of internet destination. Currently only DNS_NAME is supported. Possible values are: `DNS_NAME`
+     * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    internetDestinationType?: string;
-}
-export interface GetAccountNetworkPolicyEgressNetworkAccessAllowedStorageDestination {
+    authentication?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleAuthentication;
     /**
-     * (string) - The Azure storage account name
+     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    azureStorageAccount?: string;
+    destination?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestination;
     /**
-     * (string) - The Azure storage service type (blob, dfs, etc.)
+     * (string) - The label for this ingress rule
      */
-    azureStorageService?: string;
+    label?: string;
     /**
-     * (string)
+     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    bucketName?: string;
+    origin?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleAuthentication {
     /**
-     * (string)
+     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    region?: string;
+    identities?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleAuthenticationIdentity[];
     /**
-     * (string) - The type of storage destination. Possible values are: `AWS_S3`, `AZURE_STORAGE`, `GOOGLE_CLOUD_STORAGE`
+     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
-    storageDestinationType?: string;
+    identityType?: string;
 }
-export interface GetAccountNetworkPolicyEgressNetworkAccessPolicyEnforcement {
-    /**
-     * (list of string) - When empty, it means dry run for all products.
-     * When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode
-     */
-    dryRunModeProductFilters?: string[];
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleAuthenticationIdentity {
     /**
-     * (string) - The mode of policy enforcement. ENFORCED blocks traffic that violates policy,
-     * while DRY_RUN only logs violations without blocking. When not specified,
-     * defaults to ENFORCED. Possible values are: `DRY_RUN`, `ENFORCED`
+     * (integer)
      */
-    enforcementMode?: string;
-}
-export interface GetAccountNetworkPolicyIngress {
+    principalId?: number;
     /**
-     * (CustomerFacingIngressNetworkPolicyPublicAccess)
+     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
      */
-    publicAccess?: outputs.GetAccountNetworkPolicyIngressPublicAccess;
+    principalType?: string;
 }
-export interface GetAccountNetworkPolicyIngressDryRun {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestination {
     /**
-     * (CustomerFacingIngressNetworkPolicyPublicAccess)
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
      */
-    publicAccess?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccess;
-}
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccess {
+    accountApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi;
     /**
-     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
      */
-    allowRules?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRule[];
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne;
     /**
-     * (list of CustomerFacingIngressNetworkPolicyPublicIngressRule)
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
      */
-    denyRules?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRule[];
+    accountUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi;
     /**
-     * (string) - The restriction mode that controls how serverless workloads can access the internet. Possible values are: `FULL_ACCESS`, `RESTRICTED_ACCESS`
+     * (boolean) - Must be set to true
      */
-    restrictionMode: string;
-}
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRule {
+    allDestinations?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyAuthentication)
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
      */
-    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentication;
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAppsRuntime;
     /**
-     * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
      */
-    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination;
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationLakebaseRuntime;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    label?: string;
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
-    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOrigin;
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthentication {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountApi {
     /**
-     * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
      */
-    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthenticationIdentity[];
+    scopeQualifier?: string;
     /**
-     * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
+     * (list of string)
      */
-    identityType?: string;
+    scopes?: string[];
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleAuthenticationIdentity {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountDatabricksOne {
     /**
-     * (integer)
+     * (boolean) - Must be set to true
      */
-    principalId?: number;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAccountUi {
     /**
-     * (string) - Possible values are: `PRINCIPAL_TYPE_SERVICE_PRINCIPAL`, `PRINCIPAL_TYPE_USER`
+     * (boolean) - Must be set to true
      */
-    principalType?: string;
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestination {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationAppsRuntime {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationLakebaseRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
+     * (boolean) - Must be set to true
      */
-    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceApi {
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
      */
-    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi;
-}
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceApi {
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleDestinationWorkspaceUi {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOrigin {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOrigin {
     /**
-     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     * (boolean)
      */
-    allIpRanges?: boolean;
+    allPrivateAccess?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     * (boolean)
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges;
+    allRegisteredEndpoints?: boolean;
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     * (boolean)
      */
-    includedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges;
-}
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginExcludedIpRanges {
+    azureWorkspacePrivateLink?: boolean;
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
      */
-    ipRanges?: string[];
+    endpoints?: outputs.GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessAllowRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPolicyIngressPrivateAccessAllowRuleOriginEndpoints {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (list of string)
      */
-    ipRanges?: string[];
+    endpointIds?: string[];
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRule {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRule {
     /**
      * (CustomerFacingIngressNetworkPolicyAuthentication)
      */
-    authentication?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentication;
+    authentication?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleAuthentication;
     /**
      * (string) - The internet destination to which access will be allowed. Format dependent on the destination type
      */
-    destination?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination;
+    destination?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
      * (CustomerFacingIngressNetworkPolicyPublicRequestOrigin)
      */
-    origin?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOrigin;
+    origin?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthentication {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleAuthentication {
     /**
      * (list of CustomerFacingIngressNetworkPolicyAuthenticationIdentity) - Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES
      */
-    identities?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthenticationIdentity[];
+    identities?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticationIdentity[];
     /**
      * (string) - Possible values are: `IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS`, `IDENTITY_TYPE_ALL_USERS`, `IDENTITY_TYPE_SELECTED_IDENTITIES`
      */
     identityType?: string;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthenticationIdentity {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleAuthenticationIdentity {
     /**
      * (integer)
      */
@@ -4012,57 +6015,113 @@ export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleAuthent
      */
     principalType?: string;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestination {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi;
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
-    workspaceUi?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi;
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceUi;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceApi {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
     scopes?: string[];
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleDestinationWorkspaceUi {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountDatabricksOne {
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOrigin {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAccountUi {
     /**
-     * (boolean) - Matches all IPv4 and IPv6 ranges (both public and private)
+     * (boolean) - Must be set to true
      */
-    allIpRanges?: boolean;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationAppsRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Excluded means: all public IP ranges except this one
+     * (boolean) - Must be set to true
      */
-    excludedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges;
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationLakebaseRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyIpRanges) - Will not allow IP ranges with private IPs
+     * (boolean) - Must be set to true
      */
-    includedIpRanges?: outputs.GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges;
+    allDestinations?: boolean;
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginExcludedIpRanges {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceApi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
      */
-    ipRanges?: string[];
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
 }
-export interface GetAccountNetworkPolicyIngressDryRunPublicAccessDenyRuleOriginIncludedIpRanges {
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleDestinationWorkspaceUi {
     /**
-     * (list of string) - We only support IPv4 and IPv4 CIDR notation for now
+     * (boolean) - Must be set to true
      */
-    ipRanges?: string[];
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOrigin {
+    /**
+     * (boolean)
+     */
+    allPrivateAccess?: boolean;
+    /**
+     * (boolean)
+     */
+    allRegisteredEndpoints?: boolean;
+    /**
+     * (boolean)
+     */
+    azureWorkspacePrivateLink?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyEndpoints)
+     */
+    endpoints?: outputs.GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints;
+}
+export interface GetAccountNetworkPolicyIngressPrivateAccessDenyRuleOriginEndpoints {
+    /**
+     * (list of string)
+     */
+    endpointIds?: string[];
 }
 export interface GetAccountNetworkPolicyIngressPublicAccess {
     /**
@@ -4088,8 +6147,7 @@ export interface GetAccountNetworkPolicyIngressPublicAccessAllowRule {
      */
     destination?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
@@ -4118,20 +6176,78 @@ export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleAuthenticati
     principalType?: string;
 }
 export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
-    workspaceApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceApi;
+    workspaceApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
+     */
+    workspaceUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceUi;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationLakebaseRuntime {
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (boolean) - Must be set to true
      */
-    workspaceUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceUi;
+    allDestinations?: boolean;
 }
 export interface GetAccountNetworkPolicyIngressPublicAccessAllowRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
@@ -4179,8 +6295,7 @@ export interface GetAccountNetworkPolicyIngressPublicAccessDenyRule {
      */
     destination?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestination;
     /**
-     * (string) - User-provided name for this ingress rule. Helps identify which rule
-     * caused a request to be denied or dry-run denied
+     * (string) - The label for this ingress rule
      */
     label?: string;
     /**
@@ -4209,20 +6324,78 @@ export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleAuthenticatio
     principalType?: string;
 }
 export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestination {
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountApiDestination)
+     */
+    accountApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountDatabricksOneDestination)
+     */
+    accountDatabricksOne?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAccountUiDestination)
+     */
+    accountUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi;
     /**
      * (boolean) - Must be set to true
      */
     allDestinations?: boolean;
+    /**
+     * (CustomerFacingIngressNetworkPolicyAppsRuntimeDestination)
+     */
+    appsRuntime?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAppsRuntime;
+    /**
+     * (CustomerFacingIngressNetworkPolicyLakebaseRuntimeDestination)
+     */
+    lakebaseRuntime?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationLakebaseRuntime;
     /**
      * (CustomerFacingIngressNetworkPolicyWorkspaceApiDestination)
      */
     workspaceApi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceApi;
     /**
-     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination) - Workspace destinations
+     * (CustomerFacingIngressNetworkPolicyWorkspaceUiDestination)
      */
     workspaceUi?: outputs.GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceUi;
 }
+export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
+    /**
+     * (list of string)
+     */
+    scopes?: string[];
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountDatabricksOne {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAccountUi {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationAppsRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
+export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationLakebaseRuntime {
+    /**
+     * (boolean) - Must be set to true
+     */
+    allDestinations?: boolean;
+}
 export interface GetAccountNetworkPolicyIngressPublicAccessDenyRuleDestinationWorkspaceApi {
+    /**
+     * (string) - Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier. Possible values are: `API_SCOPE_QUALIFIER_ALL`, `API_SCOPE_QUALIFIER_READ`
+     */
+    scopeQualifier?: string;
     /**
      * (list of string)
      */
@@ -4973,6 +7146,7 @@ export interface GetAppApp {
     servicePrincipalName: string;
     space?: string;
     telemetryExportDestinations?: outputs.GetAppAppTelemetryExportDestination[];
+    thumbnailUrl: string;
     /**
      * The update time of the app.
      */
@@ -5837,6 +8011,7 @@ export interface GetAppsApp {
     servicePrincipalName: string;
     space?: string;
     telemetryExportDestinations?: outputs.GetAppsAppTelemetryExportDestination[];
+    thumbnailUrl: string;
     /**
      * The update time of the app.
      */
@@ -6805,6 +8980,7 @@ export interface GetClusterClusterInfoExecutorNodeAwsAttributes {
 export interface GetClusterClusterInfoGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -6915,7 +9091,7 @@ export interface GetClusterClusterInfoSpec {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.GetClusterClusterInfoSpecProviderConfig;
+    providerConfig: outputs.GetClusterClusterInfoSpecProviderConfig;
     remoteDiskThroughput?: number;
     /**
      * The type of runtime of the cluster
@@ -7019,6 +9195,7 @@ export interface GetClusterClusterInfoSpecDriverNodeTypeFlexibility {
 export interface GetClusterClusterInfoSpecGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -7075,7 +9252,7 @@ export interface GetClusterClusterInfoSpecLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.GetClusterClusterInfoSpecLibraryProviderConfig;
+    providerConfig: outputs.GetClusterClusterInfoSpecLibraryProviderConfig;
     pypi?: outputs.GetClusterClusterInfoSpecLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -7288,7 +9465,8 @@ export interface GetDataClassificationCatalogConfigAutoTagConfig {
      */
     autoTaggingMode: string;
     /**
-     * (string) - The Classification Tag (e.g., "class.name", "class.location")
+     * (string) - The Classification Tag. For built-in classes this is a system tag (e.g., "class.name",
+     * "class.location"); for custom classes it is a user-defined governance tag key
      */
     classificationTag: string;
 }
@@ -8726,6 +10904,204 @@ export interface GetDirectoryProviderConfig {
      */
     workspaceId: string;
 }
+export interface GetDisasterRecoveryFailoverGroupUnityCatalogAssets {
+    /**
+     * (list of UcCatalog) - UC catalogs to replicate
+     */
+    catalogs: outputs.GetDisasterRecoveryFailoverGroupUnityCatalogAssetsCatalog[];
+    /**
+     * (string) - The workspace set whose workspaces will be used for data replication
+     * of all UC catalogs' underlying storage
+     */
+    dataReplicationWorkspaceSet: string;
+    /**
+     * (list of LocationMapping) - Location mappings - storage URI per region for each location
+     */
+    locationMappings?: outputs.GetDisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMapping[];
+}
+export interface GetDisasterRecoveryFailoverGroupUnityCatalogAssetsCatalog {
+    /**
+     * Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+}
+export interface GetDisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMapping {
+    /**
+     * Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+    /**
+     * (list of LocationMappingEntry) - URI for each region. Each entry maps a region name to a storage URI
+     */
+    uriByRegions: outputs.GetDisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion[];
+}
+export interface GetDisasterRecoveryFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion {
+    /**
+     * (string) - The region name
+     */
+    region: string;
+    /**
+     * (string) - The storage URI for this region
+     */
+    uri: string;
+}
+export interface GetDisasterRecoveryFailoverGroupWorkspaceSet {
+    /**
+     * Fully qualified resource name in the format
+     * accounts/{account_id}/failover-groups/{failover_group_id}
+     */
+    name: string;
+    /**
+     * (boolean) - Whether to enable control plane DR (notebooks, jobs, clusters, etc.) for this set.
+     * Requires all workspaces in the set to be Mission Critical tier
+     */
+    replicateWorkspaceAssets: boolean;
+    /**
+     * (list of string) - Resource names of stable URLs associated with this workspace set.
+     * Format: accounts/{account_id}/stable-urls/{stable_url_id}.
+     * The referenced stable URLs must already exist (via CreateStableUrl)
+     */
+    stableUrlNames?: string[];
+    /**
+     * (list of string) - Workspace IDs in this set. The system derives and validates regions.
+     * EA: exactly 2 workspaces (one per region)
+     */
+    workspaceIds: string[];
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroup {
+    /**
+     * (string) - Time at which this failover group was created
+     */
+    createTime: string;
+    /**
+     * (string) - Current effective primary region. Replication flows FROM workspaces in this region.
+     * Changes after a successful failover
+     */
+    effectivePrimaryRegion: string;
+    /**
+     * (string) - Opaque version string for optimistic locking. Server-generated, returned in responses.
+     * Must be provided on Update requests to prevent concurrent modifications
+     */
+    etag: string;
+    /**
+     * (string) - Initial primary region. Used only in Create requests to set the starting
+     * primary region. Not returned in responses
+     */
+    initialPrimaryRegion: string;
+    /**
+     * (string) - Resource name for this workspace set
+     */
+    name: string;
+    /**
+     * (list of string) - List of all regions participating in this failover group
+     */
+    regions: string[];
+    /**
+     * (string) - The latest point in time to which data has been replicated
+     */
+    replicationPoint: string;
+    /**
+     * (string) - Aggregate state of the failover group. Possible values are: `ACTIVE`, `CREATING`, `CREATION_FAILED`, `DELETING`, `DELETION_FAILED`, `FAILING_OVER`, `FAILOVER_FAILED`, `INITIAL_REPLICATION`
+     */
+    state: string;
+    /**
+     * (UcReplicationConfig) - Unity Catalog replication configuration
+     */
+    unityCatalogAssets: outputs.GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssets;
+    /**
+     * (string) - Time at which this failover group was last modified
+     */
+    updateTime: string;
+    /**
+     * (list of WorkspaceSet) - Workspace sets, each containing workspaces that replicate to each other
+     */
+    workspaceSets: outputs.GetDisasterRecoveryFailoverGroupsFailoverGroupWorkspaceSet[];
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssets {
+    /**
+     * (list of UcCatalog) - UC catalogs to replicate
+     */
+    catalogs: outputs.GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsCatalog[];
+    /**
+     * (string) - The workspace set whose workspaces will be used for data replication
+     * of all UC catalogs' underlying storage
+     */
+    dataReplicationWorkspaceSet: string;
+    /**
+     * (list of LocationMapping) - Location mappings - storage URI per region for each location
+     */
+    locationMappings?: outputs.GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsLocationMapping[];
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsCatalog {
+    /**
+     * (string) - Resource name for this workspace set
+     */
+    name: string;
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsLocationMapping {
+    /**
+     * (string) - Resource name for this workspace set
+     */
+    name: string;
+    /**
+     * (list of LocationMappingEntry) - URI for each region. Each entry maps a region name to a storage URI
+     */
+    uriByRegions: outputs.GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion[];
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroupUnityCatalogAssetsLocationMappingUriByRegion {
+    /**
+     * (string) - The region name
+     */
+    region: string;
+    /**
+     * (string) - The storage URI for this region
+     */
+    uri: string;
+}
+export interface GetDisasterRecoveryFailoverGroupsFailoverGroupWorkspaceSet {
+    /**
+     * (string) - Resource name for this workspace set
+     */
+    name: string;
+    /**
+     * (boolean) - Whether to enable control plane DR (notebooks, jobs, clusters, etc.) for this set.
+     * Requires all workspaces in the set to be Mission Critical tier
+     */
+    replicateWorkspaceAssets: boolean;
+    /**
+     * (list of string) - Resource names of stable URLs associated with this workspace set.
+     * Format: accounts/{account_id}/stable-urls/{stable_url_id}.
+     * The referenced stable URLs must already exist (via CreateStableUrl)
+     */
+    stableUrlNames?: string[];
+    /**
+     * (list of string) - Workspace IDs in this set. The system derives and validates regions.
+     * EA: exactly 2 workspaces (one per region)
+     */
+    workspaceIds: string[];
+}
+export interface GetDisasterRecoveryStableUrlsStableUrl {
+    /**
+     * (string) - The workspace this stable URL is initially bound to. Used only in Create
+     * requests to associate the stable URL with a workspace. Not returned in
+     * responses. Mirrors FailoverGroup.initial_primary_region semantics
+     */
+    initialWorkspaceId: string;
+    /**
+     * (string) - Fully qualified resource name.
+     * Format: accounts/{account_id}/stable-urls/{stable_url_id}
+     */
+    name: string;
+    /**
+     * (string) - The stable URL endpoint. Generated by the backend on creation and
+     * immutable thereafter. For non-Private-Link workspaces this is
+     * `https://<spog_host>/?c=<connection_id>`. For Private-Link workspaces
+     * this is the per-connection hostname
+     */
+    url: string;
+}
 export interface GetEndpointAzurePrivateEndpointInfo {
     /**
      * (string) - The name of the Private Endpoint in the Azure subscription
@@ -10090,8 +12466,13 @@ export interface GetFeatureEngineeringKafkaConfigAuthConfig {
 }
 export interface GetFeatureEngineeringKafkaConfigBackfillSource {
     /**
-     * (DeltaTableSource) - The Delta table source containing the historic data to backfill.
-     * Only the delta table name is used for backfill, the entity columns and timeseries column are ignored as they are defined by the associated KafkaSource
+     * (string) - The full three-part name (catalog, schema, name) of the Delta table containing the historical data to backfill
+     */
+    deltaTableName?: string;
+    /**
+     * (DeltaTableSource, deprecated) - Deprecated: Use deltaTableName instead. Kept for backwards compatibility.
+     * The Delta table source containing the historical data to backfill.
+     * Only the delta table name is used for backfill, other fields are ignored
      */
     deltaTableSource?: outputs.GetFeatureEngineeringKafkaConfigBackfillSourceDeltaTableSource;
 }
@@ -10211,8 +12592,13 @@ export interface GetFeatureEngineeringKafkaConfigsKafkaConfigAuthConfig {
 }
 export interface GetFeatureEngineeringKafkaConfigsKafkaConfigBackfillSource {
     /**
-     * (DeltaTableSource) - The Delta table source containing the historic data to backfill.
-     * Only the delta table name is used for backfill, the entity columns and timeseries column are ignored as they are defined by the associated KafkaSource
+     * (string) - The full three-part name (catalog, schema, name) of the Delta table containing the historical data to backfill
+     */
+    deltaTableName?: string;
+    /**
+     * (DeltaTableSource, deprecated) - Deprecated: Use deltaTableName instead. Kept for backwards compatibility.
+     * The Delta table source containing the historical data to backfill.
+     * Only the delta table name is used for backfill, other fields are ignored
      */
     deltaTableSource?: outputs.GetFeatureEngineeringKafkaConfigsKafkaConfigBackfillSourceDeltaTableSource;
 }
@@ -11063,7 +13449,7 @@ export interface GetJobJobSettingsSettingsLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.GetJobJobSettingsSettingsLibraryProviderConfig;
+    providerConfig: outputs.GetJobJobSettingsSettingsLibraryProviderConfig;
     pypi?: outputs.GetJobJobSettingsSettingsLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -11463,7 +13849,7 @@ export interface GetJobJobSettingsSettingsTaskForEachTaskTaskLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.GetJobJobSettingsSettingsTaskForEachTaskTaskLibraryProviderConfig;
+    providerConfig: outputs.GetJobJobSettingsSettingsTaskForEachTaskTaskLibraryProviderConfig;
     pypi?: outputs.GetJobJobSettingsSettingsTaskForEachTaskTaskLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -11787,7 +14173,7 @@ export interface GetJobJobSettingsSettingsTaskLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.GetJobJobSettingsSettingsTaskLibraryProviderConfig;
+    providerConfig: outputs.GetJobJobSettingsSettingsTaskLibraryProviderConfig;
     pypi?: outputs.GetJobJobSettingsSettingsTaskLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -12544,7 +14930,9 @@ export interface GetMlflowModelsProviderConfig {
 }
 export interface GetMwsCredentialsProviderConfig {
     /**
-     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     * Ignored. This data source always operates against the account configured on the provider.
+     *
+     * @deprecated workspace_id is ignored for account-only resources.
      */
     workspaceId: string;
 }
@@ -12681,7 +15069,9 @@ export interface GetMwsNetworkConnectivityConfigEgressConfigTargetRulesAzurePriv
 }
 export interface GetMwsWorkspacesProviderConfig {
     /**
-     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     * Ignored. This data source always operates against the account configured on the provider.
+     *
+     * @deprecated workspace_id is ignored for account-only resources.
      */
     workspaceId: string;
 }
@@ -14980,94 +17370,197 @@ export interface GetRfaAccessRequestDestinationsSecurable {
      */
     type?: string;
 }
-export interface GetSchemaProviderConfig {
+export interface GetSchemaProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSchemaSchemaInfo {
+    /**
+     * indicates whether the principal is limited to retrieving metadata for the schema through the BROWSE privilege.
+     */
+    browseOnly?: boolean;
+    /**
+     * the name of the catalog where the schema is.
+     */
+    catalogName?: string;
+    /**
+     * the type of the parent catalog.
+     */
+    catalogType?: string;
+    /**
+     * the comment attached to the volume
+     */
+    comment?: string;
+    /**
+     * time at which this schema was created, in epoch milliseconds.
+     */
+    createdAt?: number;
+    /**
+     * username of schema creator.
+     */
+    createdBy?: string;
+    /**
+     * information about actual state of predictive optimization.
+     */
+    effectivePredictiveOptimizationFlag?: outputs.GetSchemaSchemaInfoEffectivePredictiveOptimizationFlag;
+    /**
+     * whether predictive optimization should be enabled for this object and objects under it.
+     */
+    enablePredictiveOptimization?: string;
+    /**
+     * the two-level (fully qualified) name of the schema
+     */
+    fullName?: string;
+    /**
+     * the unique identifier of the metastore
+     */
+    metastoreId?: string;
+    /**
+     * a fully qualified name of databricks_schema: *`catalog`.`schema`*
+     */
+    name?: string;
+    /**
+     * the identifier of the user who owns the schema
+     */
+    owner?: string;
+    /**
+     * map of properties set on the schema
+     */
+    properties?: {
+        [key: string]: string;
+    };
+    /**
+     * the unique identifier of the schema
+     */
+    schemaId?: string;
+    /**
+     * the storage location on the cloud.
+     */
+    storageLocation?: string;
+    /**
+     * storage root URL for managed tables within schema.
+     */
+    storageRoot?: string;
+    /**
+     * the timestamp of the last time changes were made to the schema
+     */
+    updatedAt?: number;
+    /**
+     * the identifier of the user who updated the schema last time
+     */
+    updatedBy?: string;
+}
+export interface GetSchemaSchemaInfoEffectivePredictiveOptimizationFlag {
+    inheritedFromName?: string;
+    inheritedFromType?: string;
+    value: string;
+}
+export interface GetSchemasProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSecretUcProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSecretUcsProviderConfig {
     /**
      * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
      */
     workspaceId: string;
 }
-export interface GetSchemaSchemaInfo {
+export interface GetSecretUcsSecret {
     /**
-     * indicates whether the principal is limited to retrieving metadata for the schema through the BROWSE privilege.
+     * (boolean) - Indicates whether the principal is limited to retrieving metadata for the associated object
+     * through the **BROWSE** privilege when **include_browse** is enabled in the request
      */
-    browseOnly?: boolean;
+    browseOnly: boolean;
     /**
-     * the name of the catalog where the schema is.
+     * The name of the catalog under which to list secrets. Both **catalog_name** and
+     * **schema_name** must be specified together
      */
-    catalogName?: string;
+    catalogName: string;
     /**
-     * the type of the parent catalog.
+     * (string) - User-provided free-form text description of the secret
      */
-    catalogType?: string;
+    comment: string;
     /**
-     * the comment attached to the volume
+     * (string) - The time at which this secret was created
      */
-    comment?: string;
+    createTime: string;
     /**
-     * time at which this schema was created, in epoch milliseconds.
+     * (string) - The principal that created the secret
      */
-    createdAt?: number;
+    createdBy: string;
     /**
-     * username of schema creator.
+     * (string) - The effective owner of the secret, which may differ from the directly-set **owner** due to
+     * inheritance
      */
-    createdBy?: string;
+    effectiveOwner: string;
     /**
-     * information about actual state of predictive optimization.
+     * (string) - The secret value. Only populated in responses when you have the **READ_SECRET**
+     * privilege and **include_value** is set to true in the request. The maximum size is 60 KiB
      */
-    effectivePredictiveOptimizationFlag?: outputs.GetSchemaSchemaInfoEffectivePredictiveOptimizationFlag;
+    effectiveValue: string;
     /**
-     * whether predictive optimization should be enabled for this object and objects under it.
+     * (string) - User-provided expiration time of the secret. This field indicates when the secret should no
+     * longer be used and may be displayed as a warning in the UI. It is purely informational and
+     * does not trigger any automatic actions or affect the secret's lifecycle
      */
-    enablePredictiveOptimization?: string;
+    expireTime: string;
     /**
-     * the two-level (fully qualified) name of the schema
+     * (string)
      */
-    fullName?: string;
+    externalSecretId: string;
     /**
-     * the unique identifier of the metastore
+     * (string) - The three-level (fully qualified) name of the secret, in the form of **catalog_name.schema_name.secret_name**
      */
-    metastoreId?: string;
+    fullName: string;
     /**
-     * a fully qualified name of databricks_schema: *`catalog`.`schema`*
+     * (string) - Unique identifier of the metastore hosting the secret
      */
-    name?: string;
+    metastoreId: string;
     /**
-     * the identifier of the user who owns the schema
+     * (string) - The name of the secret, relative to its parent schema
      */
-    owner?: string;
+    name: string;
     /**
-     * map of properties set on the schema
+     * (string) - The owner of the secret. Defaults to the creating principal on creation. Can be updated to
+     * transfer ownership of the secret to another principal
      */
-    properties?: {
-        [key: string]: string;
-    };
+    owner: string;
     /**
-     * the unique identifier of the schema
+     * Configure the provider for management through account provider.
      */
-    schemaId?: string;
+    providerConfig?: outputs.GetSecretUcsSecretProviderConfig;
     /**
-     * the storage location on the cloud.
+     * The name of the schema under which to list secrets. Both **catalog_name** and
+     * **schema_name** must be specified together
      */
-    storageLocation?: string;
+    schemaName: string;
     /**
-     * storage root URL for managed tables within schema.
+     * (string) - The time at which this secret was last updated
      */
-    storageRoot?: string;
+    updateTime: string;
     /**
-     * the timestamp of the last time changes were made to the schema
+     * (string) - The principal that last updated the secret
      */
-    updatedAt?: number;
+    updatedBy: string;
     /**
-     * the identifier of the user who updated the schema last time
+     * (string) - The secret value to store. This field is input-only and is not returned in responses — use
+     * the **effective_value** field (via GetSecret with **include_value** set to true) to read the
+     * secret value. The maximum size is 60 KiB (pre-encryption). Accepted content includes
+     * passwords, tokens, keys, and other sensitive credential data
      */
-    updatedBy?: string;
-}
-export interface GetSchemaSchemaInfoEffectivePredictiveOptimizationFlag {
-    inheritedFromName?: string;
-    inheritedFromType?: string;
     value: string;
 }
-export interface GetSchemasProviderConfig {
+export interface GetSecretUcsSecretProviderConfig {
     /**
      * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
      */
@@ -15669,6 +18162,223 @@ export interface GetStorageCredentialsProviderConfig {
      */
     workspaceId: string;
 }
+export interface GetSupervisorAgentProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSupervisorAgentToolApp {
+    /**
+     * Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolGenieSpace {
+    /**
+     * (string) - The ID of the genie space
+     */
+    id: string;
+}
+export interface GetSupervisorAgentToolKnowledgeAssistant {
+    /**
+     * (string) - The ID of the knowledge assistant
+     */
+    knowledgeAssistantId: string;
+    /**
+     * (string, deprecated) - Deprecated: use knowledgeAssistantId instead
+     */
+    servingEndpointName?: string;
+}
+export interface GetSupervisorAgentToolProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSupervisorAgentToolUcConnection {
+    /**
+     * Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolUcFunction {
+    /**
+     * Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolVolume {
+    /**
+     * Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolsProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSupervisorAgentToolsTool {
+    /**
+     * (App)
+     */
+    app: outputs.GetSupervisorAgentToolsToolApp;
+    /**
+     * (string) - Description of what this tool does (user-facing)
+     */
+    description: string;
+    /**
+     * (GenieSpace)
+     */
+    genieSpace: outputs.GetSupervisorAgentToolsToolGenieSpace;
+    /**
+     * (string) - The ID of the genie space
+     */
+    id: string;
+    /**
+     * (KnowledgeAssistant)
+     */
+    knowledgeAssistant: outputs.GetSupervisorAgentToolsToolKnowledgeAssistant;
+    /**
+     * (string) - Full uc volume name
+     */
+    name: string;
+    /**
+     * Configure the provider for management through account provider.
+     */
+    providerConfig?: outputs.GetSupervisorAgentToolsToolProviderConfig;
+    /**
+     * (string) - User specified id of the Tool
+     */
+    toolId: string;
+    /**
+     * (string) - Tool type. Must be one of: "genieSpace", "knowledgeAssistant", "ucFunction", "ucConnection", "app", "volume", "lakeviewDashboard", "servingEndpoint", "ucTable", "vectorSearchIndex", "catalog", "schema", "supervisorAgent", "webSearch"
+     */
+    toolType: string;
+    /**
+     * (UcConnection)
+     */
+    ucConnection: outputs.GetSupervisorAgentToolsToolUcConnection;
+    /**
+     * (UcFunction)
+     */
+    ucFunction: outputs.GetSupervisorAgentToolsToolUcFunction;
+    /**
+     * (Volume)
+     */
+    volume: outputs.GetSupervisorAgentToolsToolVolume;
+}
+export interface GetSupervisorAgentToolsToolApp {
+    /**
+     * (string) - Full uc volume name
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolsToolGenieSpace {
+    /**
+     * (string) - The ID of the genie space
+     */
+    id: string;
+}
+export interface GetSupervisorAgentToolsToolKnowledgeAssistant {
+    /**
+     * (string) - The ID of the knowledge assistant
+     */
+    knowledgeAssistantId: string;
+    /**
+     * (string, deprecated) - Deprecated: use knowledgeAssistantId instead
+     */
+    servingEndpointName?: string;
+}
+export interface GetSupervisorAgentToolsToolProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSupervisorAgentToolsToolUcConnection {
+    /**
+     * (string) - Full uc volume name
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolsToolUcFunction {
+    /**
+     * (string) - Full uc volume name
+     */
+    name: string;
+}
+export interface GetSupervisorAgentToolsToolVolume {
+    /**
+     * (string) - Full uc volume name
+     */
+    name: string;
+}
+export interface GetSupervisorAgentsProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface GetSupervisorAgentsSupervisorAgent {
+    /**
+     * (string) - Creation timestamp
+     */
+    createTime: string;
+    /**
+     * (string) - The creator of the Supervisor Agent
+     */
+    creator: string;
+    /**
+     * (string) - Description of what this agent can do (user-facing)
+     */
+    description: string;
+    /**
+     * (string) - The display name of the Supervisor Agent, unique at workspace level
+     */
+    displayName: string;
+    /**
+     * (string) - The name of the supervisor agent's serving endpoint
+     */
+    endpointName: string;
+    /**
+     * (string) - The MLflow experiment ID
+     */
+    experimentId: string;
+    /**
+     * (string, deprecated) - Deprecated: Use supervisorAgentId instead
+     */
+    id: string;
+    /**
+     * (string) - Optional natural-language instructions for the supervisor agent
+     */
+    instructions: string;
+    /**
+     * (string) - The resource name of the SupervisorAgent.
+     * Format: supervisor-agents/{supervisor_agent_id}
+     */
+    name: string;
+    /**
+     * Configure the provider for management through account provider.
+     */
+    providerConfig?: outputs.GetSupervisorAgentsSupervisorAgentProviderConfig;
+    /**
+     * (string) - The universally unique identifier (UUID) of the Supervisor Agent
+     */
+    supervisorAgentId: string;
+}
+export interface GetSupervisorAgentsSupervisorAgentProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
 export interface GetTableProviderConfig {
     /**
      * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
@@ -16812,7 +19522,7 @@ export interface JobJobClusterNewCluster {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobJobClusterNewClusterProviderConfig;
+    providerConfig: outputs.JobJobClusterNewClusterProviderConfig;
     remoteDiskThroughput?: number;
     runtimeEngine?: string;
     singleUserName?: string;
@@ -16904,6 +19614,7 @@ export interface JobJobClusterNewClusterDriverNodeTypeFlexibility {
 export interface JobJobClusterNewClusterGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -16963,7 +19674,7 @@ export interface JobJobClusterNewClusterLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobJobClusterNewClusterLibraryProviderConfig;
+    providerConfig: outputs.JobJobClusterNewClusterLibraryProviderConfig;
     pypi?: outputs.JobJobClusterNewClusterLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -17014,7 +19725,7 @@ export interface JobLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobLibraryProviderConfig;
+    providerConfig: outputs.JobLibraryProviderConfig;
     pypi?: outputs.JobLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -17073,7 +19784,7 @@ export interface JobNewCluster {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobNewClusterProviderConfig;
+    providerConfig: outputs.JobNewClusterProviderConfig;
     remoteDiskThroughput?: number;
     runtimeEngine?: string;
     singleUserName?: string;
@@ -17165,6 +19876,7 @@ export interface JobNewClusterDriverNodeTypeFlexibility {
 export interface JobNewClusterGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -17224,7 +19936,7 @@ export interface JobNewClusterLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobNewClusterLibraryProviderConfig;
+    providerConfig: outputs.JobNewClusterLibraryProviderConfig;
     pypi?: outputs.JobNewClusterLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -18081,7 +20793,7 @@ export interface JobTaskForEachTaskTaskLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskForEachTaskTaskLibraryProviderConfig;
+    providerConfig: outputs.JobTaskForEachTaskTaskLibraryProviderConfig;
     pypi?: outputs.JobTaskForEachTaskTaskLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -18140,7 +20852,7 @@ export interface JobTaskForEachTaskTaskNewCluster {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskForEachTaskTaskNewClusterProviderConfig;
+    providerConfig: outputs.JobTaskForEachTaskTaskNewClusterProviderConfig;
     remoteDiskThroughput?: number;
     runtimeEngine?: string;
     singleUserName?: string;
@@ -18232,6 +20944,7 @@ export interface JobTaskForEachTaskTaskNewClusterDriverNodeTypeFlexibility {
 export interface JobTaskForEachTaskTaskNewClusterGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -18291,7 +21004,7 @@ export interface JobTaskForEachTaskTaskNewClusterLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskForEachTaskTaskNewClusterLibraryProviderConfig;
+    providerConfig: outputs.JobTaskForEachTaskTaskNewClusterLibraryProviderConfig;
     pypi?: outputs.JobTaskForEachTaskTaskNewClusterLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -18769,7 +21482,7 @@ export interface JobTaskLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskLibraryProviderConfig;
+    providerConfig: outputs.JobTaskLibraryProviderConfig;
     pypi?: outputs.JobTaskLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -18829,7 +21542,7 @@ export interface JobTaskNewCluster {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskNewClusterProviderConfig;
+    providerConfig: outputs.JobTaskNewClusterProviderConfig;
     remoteDiskThroughput?: number;
     runtimeEngine?: string;
     singleUserName?: string;
@@ -18921,6 +21634,7 @@ export interface JobTaskNewClusterDriverNodeTypeFlexibility {
 export interface JobTaskNewClusterGcpAttributes {
     availability?: string;
     bootDiskSize?: number;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -18980,7 +21694,7 @@ export interface JobTaskNewClusterLibrary {
     /**
      * Configure the provider for management through account provider. This block consists of the following fields:
      */
-    providerConfig?: outputs.JobTaskNewClusterLibraryProviderConfig;
+    providerConfig: outputs.JobTaskNewClusterLibraryProviderConfig;
     pypi?: outputs.JobTaskNewClusterLibraryPypi;
     requirements?: string;
     whl?: string;
@@ -20755,11 +23469,11 @@ export interface MwsNetworksGcpNetworkInfo {
      */
     networkProjectId: string;
     /**
-     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.113.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.pod_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.115.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     podIpRangeName?: string;
     /**
-     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.113.0/docs/guides/gcp-workspace#creating-a-vpc
+     * @deprecated gcp_network_info.service_ip_range_name is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.115.0/docs/guides/gcp-workspace#creating-a-vpc
      */
     serviceIpRangeName?: string;
     /**
@@ -20820,11 +23534,11 @@ export interface MwsWorkspacesExternalCustomerInfo {
 }
 export interface MwsWorkspacesGcpManagedNetworkConfig {
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.113.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_pod_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.115.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterPodIpRange?: string;
     /**
-     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.113.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
+     * @deprecated gcp_managed_network_config.gke_cluster_service_ip_range is deprecated and will be removed in a future release. For more information, review the documentation at https://registry.terraform.io/providers/databricks/databricks/1.115.0/docs/guides/gcp-workspace#creating-a-databricks-workspace
      */
     gkeClusterServiceIpRange?: string;
     subnetCidr: string;
@@ -21167,6 +23881,7 @@ export interface PipelineClusterClusterLogConfVolumes {
 }
 export interface PipelineClusterGcpAttributes {
     availability?: string;
+    confidentialComputeType?: string;
     firstOnDemand?: number;
     googleServiceAccount?: string;
     localSsdCount?: number;
@@ -21381,10 +24096,19 @@ export interface PipelineIngestionDefinitionObjectSchema {
     tableConfiguration?: outputs.PipelineIngestionDefinitionObjectSchemaTableConfiguration;
 }
 export interface PipelineIngestionDefinitionObjectSchemaConnectorOptions {
+    confluenceOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsConfluenceOptions;
     gdriveOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsGdriveOptions;
     googleAdsOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsGoogleAdsOptions;
+    jiraOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsJiraOptions;
+    metaAdsOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsMetaAdsOptions;
+    outlookOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsOutlookOptions;
     sharepointOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsSharepointOptions;
+    smartsheetOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsSmartsheetOptions;
     tiktokAdsOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsTiktokAdsOptions;
+    zendeskSupportOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsZendeskSupportOptions;
+}
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsConfluenceOptions {
+    includeConfluenceSpaces?: string[];
 }
 export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsGdriveOptions {
     entityType?: string;
@@ -21419,6 +24143,31 @@ export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsGoogleAd
     managerAccountId: string;
     syncStartDate?: string;
 }
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsJiraOptions {
+    includeJiraSpaces?: string[];
+}
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsMetaAdsOptions {
+    actionAttributionWindows?: string[];
+    actionBreakdowns?: string[];
+    actionReportTime?: string;
+    breakdowns?: string[];
+    customInsightsLookbackWindow?: number;
+    level?: string;
+    startDate?: string;
+    timeIncrement?: string;
+}
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsOutlookOptions {
+    attachmentMode?: string;
+    bodyFormat?: string;
+    folderFilters?: string[];
+    includeFolders?: string[];
+    includeMailboxes?: string[];
+    includeSenders?: string[];
+    includeSubjects?: string[];
+    senderFilters?: string[];
+    startDate?: string;
+    subjectFilters?: string[];
+}
 export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsSharepointOptions {
     entityType?: string;
     fileIngestionOptions?: outputs.PipelineIngestionDefinitionObjectSchemaConnectorOptionsSharepointOptionsFileIngestionOptions;
@@ -21447,6 +24196,9 @@ export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsSharepoi
     modifiedBefore?: string;
     pathFilter?: string;
 }
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsSmartsheetOptions {
+    enforceSchema?: boolean;
+}
 export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsTiktokAdsOptions {
     dataLevel?: string;
     dimensions?: string[];
@@ -21456,6 +24208,9 @@ export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsTiktokAd
     reportType?: string;
     syncStartDate?: string;
 }
+export interface PipelineIngestionDefinitionObjectSchemaConnectorOptionsZendeskSupportOptions {
+    startDate?: string;
+}
 export interface PipelineIngestionDefinitionObjectSchemaTableConfiguration {
     autoFullRefreshPolicy?: outputs.PipelineIngestionDefinitionObjectSchemaTableConfigurationAutoFullRefreshPolicy;
     excludeColumns?: string[];
@@ -21499,10 +24254,19 @@ export interface PipelineIngestionDefinitionObjectTable {
     tableConfiguration?: outputs.PipelineIngestionDefinitionObjectTableTableConfiguration;
 }
 export interface PipelineIngestionDefinitionObjectTableConnectorOptions {
+    confluenceOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsConfluenceOptions;
     gdriveOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsGdriveOptions;
     googleAdsOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsGoogleAdsOptions;
+    jiraOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsJiraOptions;
+    metaAdsOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsMetaAdsOptions;
+    outlookOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsOutlookOptions;
     sharepointOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsSharepointOptions;
+    smartsheetOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsSmartsheetOptions;
     tiktokAdsOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsTiktokAdsOptions;
+    zendeskSupportOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsZendeskSupportOptions;
+}
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsConfluenceOptions {
+    includeConfluenceSpaces?: string[];
 }
 export interface PipelineIngestionDefinitionObjectTableConnectorOptionsGdriveOptions {
     entityType?: string;
@@ -21537,6 +24301,31 @@ export interface PipelineIngestionDefinitionObjectTableConnectorOptionsGoogleAds
     managerAccountId: string;
     syncStartDate?: string;
 }
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsJiraOptions {
+    includeJiraSpaces?: string[];
+}
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsMetaAdsOptions {
+    actionAttributionWindows?: string[];
+    actionBreakdowns?: string[];
+    actionReportTime?: string;
+    breakdowns?: string[];
+    customInsightsLookbackWindow?: number;
+    level?: string;
+    startDate?: string;
+    timeIncrement?: string;
+}
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsOutlookOptions {
+    attachmentMode?: string;
+    bodyFormat?: string;
+    folderFilters?: string[];
+    includeFolders?: string[];
+    includeMailboxes?: string[];
+    includeSenders?: string[];
+    includeSubjects?: string[];
+    senderFilters?: string[];
+    startDate?: string;
+    subjectFilters?: string[];
+}
 export interface PipelineIngestionDefinitionObjectTableConnectorOptionsSharepointOptions {
     entityType?: string;
     fileIngestionOptions?: outputs.PipelineIngestionDefinitionObjectTableConnectorOptionsSharepointOptionsFileIngestionOptions;
@@ -21565,6 +24354,9 @@ export interface PipelineIngestionDefinitionObjectTableConnectorOptionsSharepoin
     modifiedBefore?: string;
     pathFilter?: string;
 }
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsSmartsheetOptions {
+    enforceSchema?: boolean;
+}
 export interface PipelineIngestionDefinitionObjectTableConnectorOptionsTiktokAdsOptions {
     dataLevel?: string;
     dimensions?: string[];
@@ -21574,6 +24366,9 @@ export interface PipelineIngestionDefinitionObjectTableConnectorOptionsTiktokAds
     reportType?: string;
     syncStartDate?: string;
 }
+export interface PipelineIngestionDefinitionObjectTableConnectorOptionsZendeskSupportOptions {
+    startDate?: string;
+}
 export interface PipelineIngestionDefinitionObjectTableTableConfiguration {
     autoFullRefreshPolicy?: outputs.PipelineIngestionDefinitionObjectTableTableConfigurationAutoFullRefreshPolicy;
     excludeColumns?: string[];
@@ -21611,6 +24406,7 @@ export interface PipelineIngestionDefinitionSourceConfiguration {
      * The name of default catalog in Unity Catalog. *Change of this parameter forces recreation of the pipeline if you switch from `storage` to `catalog` or vice versa.  If pipeline was already created with `catalog` set, the value could be changed.* (Conflicts with `storage`).
      */
     catalog?: outputs.PipelineIngestionDefinitionSourceConfigurationCatalog;
+    googleAdsConfig?: outputs.PipelineIngestionDefinitionSourceConfigurationGoogleAdsConfig;
 }
 export interface PipelineIngestionDefinitionSourceConfigurationCatalog {
     postgres?: outputs.PipelineIngestionDefinitionSourceConfigurationCatalogPostgres;
@@ -21623,6 +24419,9 @@ export interface PipelineIngestionDefinitionSourceConfigurationCatalogPostgresSl
     publicationName?: string;
     slotName?: string;
 }
+export interface PipelineIngestionDefinitionSourceConfigurationGoogleAdsConfig {
+    managerAccountId?: string;
+}
 export interface PipelineIngestionDefinitionTableConfiguration {
     autoFullRefreshPolicy?: outputs.PipelineIngestionDefinitionTableConfigurationAutoFullRefreshPolicy;
     excludeColumns?: string[];
@@ -22985,6 +25784,12 @@ export interface SecretScopeProviderConfig {
      */
     workspaceId: string;
 }
+export interface SecretUcProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
 export interface ServicePrincipalFederationPolicyOidcPolicy {
     /**
      * The allowed token audiences, as specified in the 'aud' claim of federated tokens.
@@ -23531,6 +26336,60 @@ export interface StorageCredentialProviderConfig {
      */
     workspaceId: string;
 }
+export interface SupervisorAgentProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface SupervisorAgentToolApp {
+    /**
+     * App name
+     */
+    name: string;
+}
+export interface SupervisorAgentToolGenieSpace {
+    /**
+     * (string, deprecated) - Deprecated: Use toolId instead
+     */
+    id: string;
+}
+export interface SupervisorAgentToolKnowledgeAssistant {
+    /**
+     * The ID of the knowledge assistant
+     */
+    knowledgeAssistantId: string;
+    /**
+     * Deprecated: use knowledgeAssistantId instead
+     */
+    servingEndpointName?: string;
+}
+export interface SupervisorAgentToolProviderConfig {
+    /**
+     * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
+     */
+    workspaceId: string;
+}
+export interface SupervisorAgentToolUcConnection {
+    /**
+     * (string) - Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface SupervisorAgentToolUcFunction {
+    /**
+     * (string) - Full resource name:
+     * supervisor-agents/{supervisor_agent_id}/tools/{tool_id}
+     */
+    name: string;
+}
+export interface SupervisorAgentToolVolume {
+    /**
+     * Full uc volume name
+     */
+    name: string;
+}
 export interface SystemSchemaProviderConfig {
     /**
      * Workspace ID which the resource belongs to. This workspace must be part of the account which the provider is configured with.
@@ -23594,13 +26453,18 @@ export interface VectorSearchEndpointProviderConfig {
     workspaceId: string;
 }
 export interface VectorSearchEndpointScalingInfo {
-    requestedMinQps?: number;
+    requestedTargetQps?: number;
     /**
      * Current state of the endpoint. Currently following values are supported: `PROVISIONING`, `ONLINE`, and `OFFLINE`.
      */
     state?: string;
 }
 export interface VectorSearchIndexDeltaSyncIndexSpec {
+    columnsToIndices?: string[];
+    /**
+     * list of columns to sync. If not specified, all columns are syncronized.
+     */
+    columnsToSyncs?: string[];
     /**
      * array of objects representing columns that contain the embedding source.  Each entry consists of:
      */