cloudflare 2.8.0 → 3.0.0-beta.1

package/resources/zero-trust/access/applications/policies.d.ts

@@ -0,0 +1,2805 @@
+import * as Core from 'cloudflare/core';
+import { APIResource } from 'cloudflare/resource';
+import * as PoliciesAPI from 'cloudflare/resources/zero-trust/access/applications/policies';
+export declare class Policies extends APIResource {
+    /**
+     * Create a new Access policy for an application.
+     */
+    create(uuid: string, params: PolicyCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessPolicies>;
+    /**
+     * Update a configured Access policy.
+     */
+    update(uuid1: string, uuid: string, params: PolicyUpdateParams, options?: Core.RequestOptions): Core.APIPromise<AccessPolicies>;
+    /**
+     * Lists Access policies configured for an application.
+     */
+    list(uuid: string, params?: PolicyListParams, options?: Core.RequestOptions): Core.APIPromise<PolicyListResponse | null>;
+    list(uuid: string, options?: Core.RequestOptions): Core.APIPromise<PolicyListResponse | null>;
+    /**
+     * Delete an Access policy.
+     */
+    delete(uuid1: string, uuid: string, params?: PolicyDeleteParams, options?: Core.RequestOptions): Core.APIPromise<PolicyDeleteResponse>;
+    delete(uuid1: string, uuid: string, options?: Core.RequestOptions): Core.APIPromise<PolicyDeleteResponse>;
+    /**
+     * Fetches a single Access policy.
+     */
+    get(uuid1: string, uuid: string, params?: PolicyGetParams, options?: Core.RequestOptions): Core.APIPromise<AccessPolicies>;
+    get(uuid1: string, uuid: string, options?: Core.RequestOptions): Core.APIPromise<AccessPolicies>;
+}
+export interface AccessPolicies {
+    /**
+     * UUID
+     */
+    id?: string;
+    /**
+     * Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<AccessPolicies.ApprovalGroup>;
+    /**
+     * Requires the user to request access from an administrator at the start of each
+     * session.
+     */
+    approval_required?: boolean;
+    created_at?: string;
+    /**
+     * The action Access will take if a user matches this policy.
+     */
+    decision?: 'allow' | 'deny' | 'non_identity' | 'bypass';
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<AccessPolicies.AccessEmailRule | AccessPolicies.AccessEmailListRule | AccessPolicies.AccessDomainRule | AccessPolicies.AccessEveryoneRule | AccessPolicies.AccessIPRule | AccessPolicies.AccessIPListRule | AccessPolicies.AccessCertificateRule | AccessPolicies.AccessAccessGroupRule | AccessPolicies.AccessAzureGroupRule | AccessPolicies.AccessGitHubOrganizationRule | AccessPolicies.AccessGsuiteGroupRule | AccessPolicies.AccessOktaGroupRule | AccessPolicies.AccessSamlGroupRule | AccessPolicies.AccessServiceTokenRule | AccessPolicies.AccessAnyValidServiceTokenRule | AccessPolicies.AccessExternalEvaluationRule | AccessPolicies.AccessCountryRule | AccessPolicies.AccessAuthenticationMethodRule | AccessPolicies.AccessDevicePostureRule>;
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<AccessPolicies.AccessEmailRule | AccessPolicies.AccessEmailListRule | AccessPolicies.AccessDomainRule | AccessPolicies.AccessEveryoneRule | AccessPolicies.AccessIPRule | AccessPolicies.AccessIPListRule | AccessPolicies.AccessCertificateRule | AccessPolicies.AccessAccessGroupRule | AccessPolicies.AccessAzureGroupRule | AccessPolicies.AccessGitHubOrganizationRule | AccessPolicies.AccessGsuiteGroupRule | AccessPolicies.AccessOktaGroupRule | AccessPolicies.AccessSamlGroupRule | AccessPolicies.AccessServiceTokenRule | AccessPolicies.AccessAnyValidServiceTokenRule | AccessPolicies.AccessExternalEvaluationRule | AccessPolicies.AccessCountryRule | AccessPolicies.AccessAuthenticationMethodRule | AccessPolicies.AccessDevicePostureRule>;
+    /**
+     * Require this application to be served in an isolated browser for users matching
+     * this policy. 'Client Web Isolation' must be on for the account in order to use
+     * this feature.
+     */
+    isolation_required?: boolean;
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
+    /**
+     * The order of execution for this policy. Must be unique for each policy.
+     */
+    precedence?: number;
+    /**
+     * A custom message that will appear on the purpose justification screen.
+     */
+    purpose_justification_prompt?: string;
+    /**
+     * Require users to enter a justification when they log in to the application.
+     */
+    purpose_justification_required?: boolean;
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<AccessPolicies.AccessEmailRule | AccessPolicies.AccessEmailListRule | AccessPolicies.AccessDomainRule | AccessPolicies.AccessEveryoneRule | AccessPolicies.AccessIPRule | AccessPolicies.AccessIPListRule | AccessPolicies.AccessCertificateRule | AccessPolicies.AccessAccessGroupRule | AccessPolicies.AccessAzureGroupRule | AccessPolicies.AccessGitHubOrganizationRule | AccessPolicies.AccessGsuiteGroupRule | AccessPolicies.AccessOktaGroupRule | AccessPolicies.AccessSamlGroupRule | AccessPolicies.AccessServiceTokenRule | AccessPolicies.AccessAnyValidServiceTokenRule | AccessPolicies.AccessExternalEvaluationRule | AccessPolicies.AccessCountryRule | AccessPolicies.AccessAuthenticationMethodRule | AccessPolicies.AccessDevicePostureRule>;
+    /**
+     * The amount of time that tokens issued for the application will be valid. Must be
+     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+     * m, h.
+     */
+    session_duration?: string;
+    updated_at?: string;
+}
+export declare namespace AccessPolicies {
+    /**
+     * A group of email addresses that can approve a temporary authentication request.
+     */
+    interface ApprovalGroup {
+        /**
+         * The number of approvals needed to obtain access.
+         */
+        approvals_needed: number;
+        /**
+         * A list of emails that can approve the access request.
+         */
+        email_addresses?: Array<unknown>;
+        /**
+         * The UUID of an re-usable email list.
+         */
+        email_list_uuid?: string;
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export type PolicyListResponse = Array<AccessPolicies>;
+export interface PolicyDeleteResponse {
+    /**
+     * UUID
+     */
+    id?: string;
+}
+export interface PolicyCreateParams {
+    /**
+     * Body param: The action Access will take if a user matches this policy.
+     */
+    decision: 'allow' | 'deny' | 'non_identity' | 'bypass';
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The name of the Access policy.
+     */
+    name: string;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+    /**
+     * Body param: Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PolicyCreateParams.ApprovalGroup>;
+    /**
+     * Body param: Requires the user to request access from an administrator at the
+     * start of each session.
+     */
+    approval_required?: boolean;
+    /**
+     * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+     * user cannot meet any of the Exclude rules.
+     */
+    exclude?: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: Require this application to be served in an isolated browser for
+     * users matching this policy. 'Client Web Isolation' must be on for the account in
+     * order to use this feature.
+     */
+    isolation_required?: boolean;
+    /**
+     * Body param: The order of execution for this policy. Must be unique for each
+     * policy.
+     */
+    precedence?: number;
+    /**
+     * Body param: A custom message that will appear on the purpose justification
+     * screen.
+     */
+    purpose_justification_prompt?: string;
+    /**
+     * Body param: Require users to enter a justification when they log in to the
+     * application.
+     */
+    purpose_justification_required?: boolean;
+    /**
+     * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+     * user must meet all of the Require rules.
+     */
+    require?: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The amount of time that tokens issued for the application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+}
+export declare namespace PolicyCreateParams {
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * A group of email addresses that can approve a temporary authentication request.
+     */
+    interface ApprovalGroup {
+        /**
+         * The number of approvals needed to obtain access.
+         */
+        approvals_needed: number;
+        /**
+         * A list of emails that can approve the access request.
+         */
+        email_addresses?: Array<unknown>;
+        /**
+         * The UUID of an re-usable email list.
+         */
+        email_list_uuid?: string;
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export interface PolicyUpdateParams {
+    /**
+     * Body param: The action Access will take if a user matches this policy.
+     */
+    decision: 'allow' | 'deny' | 'non_identity' | 'bypass';
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The name of the Access policy.
+     */
+    name: string;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+    /**
+     * Body param: Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PolicyUpdateParams.ApprovalGroup>;
+    /**
+     * Body param: Requires the user to request access from an administrator at the
+     * start of each session.
+     */
+    approval_required?: boolean;
+    /**
+     * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+     * user cannot meet any of the Exclude rules.
+     */
+    exclude?: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: Require this application to be served in an isolated browser for
+     * users matching this policy. 'Client Web Isolation' must be on for the account in
+     * order to use this feature.
+     */
+    isolation_required?: boolean;
+    /**
+     * Body param: The order of execution for this policy. Must be unique for each
+     * policy.
+     */
+    precedence?: number;
+    /**
+     * Body param: A custom message that will appear on the purpose justification
+     * screen.
+     */
+    purpose_justification_prompt?: string;
+    /**
+     * Body param: Require users to enter a justification when they log in to the
+     * application.
+     */
+    purpose_justification_required?: boolean;
+    /**
+     * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+     * user must meet all of the Require rules.
+     */
+    require?: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The amount of time that tokens issued for the application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+}
+export declare namespace PolicyUpdateParams {
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * A group of email addresses that can approve a temporary authentication request.
+     */
+    interface ApprovalGroup {
+        /**
+         * The number of approvals needed to obtain access.
+         */
+        approvals_needed: number;
+        /**
+         * A list of emails that can approve the access request.
+         */
+        email_addresses?: Array<unknown>;
+        /**
+         * The UUID of an re-usable email list.
+         */
+        email_list_uuid?: string;
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export interface PolicyListParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export interface PolicyDeleteParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export interface PolicyGetParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export declare namespace Policies {
+    export import AccessPolicies = PoliciesAPI.AccessPolicies;
+    export import PolicyListResponse = PoliciesAPI.PolicyListResponse;
+    export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
+    export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
+    export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
+    export import PolicyListParams = PoliciesAPI.PolicyListParams;
+    export import PolicyDeleteParams = PoliciesAPI.PolicyDeleteParams;
+    export import PolicyGetParams = PoliciesAPI.PolicyGetParams;
+}
+//# sourceMappingURL=policies.d.ts.map