cloudflare 2.9.1 → 3.0.0-beta.1

package/resources/zero-trust/access/groups.d.ts

@@ -0,0 +1,2924 @@
+import * as Core from 'cloudflare/core';
+import { APIResource } from 'cloudflare/resource';
+import * as GroupsAPI from 'cloudflare/resources/zero-trust/access/groups';
+export declare class Groups extends APIResource {
+    /**
+     * Creates a new Access group.
+     */
+    create(params: GroupCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
+    /**
+     * Updates a configured Access group.
+     */
+    update(uuid: string, params: GroupUpdateParams, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
+    /**
+     * Lists all Access groups.
+     */
+    list(params?: GroupListParams, options?: Core.RequestOptions): Core.APIPromise<GroupListResponse | null>;
+    list(options?: Core.RequestOptions): Core.APIPromise<GroupListResponse | null>;
+    /**
+     * Deletes an Access group.
+     */
+    delete(uuid: string, params?: GroupDeleteParams, options?: Core.RequestOptions): Core.APIPromise<GroupDeleteResponse>;
+    delete(uuid: string, options?: Core.RequestOptions): Core.APIPromise<GroupDeleteResponse>;
+    /**
+     * Fetches a single Access group.
+     */
+    get(uuid: string, params?: GroupGetParams, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
+    get(uuid: string, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
+}
+export interface AccessGroups {
+    /**
+     * UUID
+     */
+    id?: string;
+    created_at?: string;
+    /**
+     * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<AccessGroups.AccessEmailRule | AccessGroups.AccessEmailListRule | AccessGroups.AccessDomainRule | AccessGroups.AccessEveryoneRule | AccessGroups.AccessIPRule | AccessGroups.AccessIPListRule | AccessGroups.AccessCertificateRule | AccessGroups.AccessAccessGroupRule | AccessGroups.AccessAzureGroupRule | AccessGroups.AccessGitHubOrganizationRule | AccessGroups.AccessGsuiteGroupRule | AccessGroups.AccessOktaGroupRule | AccessGroups.AccessSamlGroupRule | AccessGroups.AccessServiceTokenRule | AccessGroups.AccessAnyValidServiceTokenRule | AccessGroups.AccessExternalEvaluationRule | AccessGroups.AccessCountryRule | AccessGroups.AccessAuthenticationMethodRule | AccessGroups.AccessDevicePostureRule>;
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<AccessGroups.AccessEmailRule | AccessGroups.AccessEmailListRule | AccessGroups.AccessDomainRule | AccessGroups.AccessEveryoneRule | AccessGroups.AccessIPRule | AccessGroups.AccessIPListRule | AccessGroups.AccessCertificateRule | AccessGroups.AccessAccessGroupRule | AccessGroups.AccessAzureGroupRule | AccessGroups.AccessGitHubOrganizationRule | AccessGroups.AccessGsuiteGroupRule | AccessGroups.AccessOktaGroupRule | AccessGroups.AccessSamlGroupRule | AccessGroups.AccessServiceTokenRule | AccessGroups.AccessAnyValidServiceTokenRule | AccessGroups.AccessExternalEvaluationRule | AccessGroups.AccessCountryRule | AccessGroups.AccessAuthenticationMethodRule | AccessGroups.AccessDevicePostureRule>;
+    /**
+     * Rules evaluated with an AND logical operator. To match a policy, a user must
+     * meet all of the Require rules.
+     */
+    is_default?: Array<AccessGroups.AccessEmailRule | AccessGroups.AccessEmailListRule | AccessGroups.AccessDomainRule | AccessGroups.AccessEveryoneRule | AccessGroups.AccessIPRule | AccessGroups.AccessIPListRule | AccessGroups.AccessCertificateRule | AccessGroups.AccessAccessGroupRule | AccessGroups.AccessAzureGroupRule | AccessGroups.AccessGitHubOrganizationRule | AccessGroups.AccessGsuiteGroupRule | AccessGroups.AccessOktaGroupRule | AccessGroups.AccessSamlGroupRule | AccessGroups.AccessServiceTokenRule | AccessGroups.AccessAnyValidServiceTokenRule | AccessGroups.AccessExternalEvaluationRule | AccessGroups.AccessCountryRule | AccessGroups.AccessAuthenticationMethodRule | AccessGroups.AccessDevicePostureRule>;
+    /**
+     * The name of the Access group.
+     */
+    name?: string;
+    /**
+     * Rules evaluated with an AND logical operator. To match a policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<AccessGroups.AccessEmailRule | AccessGroups.AccessEmailListRule | AccessGroups.AccessDomainRule | AccessGroups.AccessEveryoneRule | AccessGroups.AccessIPRule | AccessGroups.AccessIPListRule | AccessGroups.AccessCertificateRule | AccessGroups.AccessAccessGroupRule | AccessGroups.AccessAzureGroupRule | AccessGroups.AccessGitHubOrganizationRule | AccessGroups.AccessGsuiteGroupRule | AccessGroups.AccessOktaGroupRule | AccessGroups.AccessSamlGroupRule | AccessGroups.AccessServiceTokenRule | AccessGroups.AccessAnyValidServiceTokenRule | AccessGroups.AccessExternalEvaluationRule | AccessGroups.AccessCountryRule | AccessGroups.AccessAuthenticationMethodRule | AccessGroups.AccessDevicePostureRule>;
+    updated_at?: string;
+}
+export declare namespace AccessGroups {
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export type GroupListResponse = Array<AccessGroups>;
+export interface GroupDeleteResponse {
+    /**
+     * UUID
+     */
+    id?: string;
+}
+export interface GroupCreateParams {
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<GroupCreateParams.AccessEmailRule | GroupCreateParams.AccessEmailListRule | GroupCreateParams.AccessDomainRule | GroupCreateParams.AccessEveryoneRule | GroupCreateParams.AccessIPRule | GroupCreateParams.AccessIPListRule | GroupCreateParams.AccessCertificateRule | GroupCreateParams.AccessAccessGroupRule | GroupCreateParams.AccessAzureGroupRule | GroupCreateParams.AccessGitHubOrganizationRule | GroupCreateParams.AccessGsuiteGroupRule | GroupCreateParams.AccessOktaGroupRule | GroupCreateParams.AccessSamlGroupRule | GroupCreateParams.AccessServiceTokenRule | GroupCreateParams.AccessAnyValidServiceTokenRule | GroupCreateParams.AccessExternalEvaluationRule | GroupCreateParams.AccessCountryRule | GroupCreateParams.AccessAuthenticationMethodRule | GroupCreateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The name of the Access group.
+     */
+    name: string;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+    /**
+     * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
+     * user cannot meet any of the Exclude rules.
+     */
+    exclude?: Array<GroupCreateParams.AccessEmailRule | GroupCreateParams.AccessEmailListRule | GroupCreateParams.AccessDomainRule | GroupCreateParams.AccessEveryoneRule | GroupCreateParams.AccessIPRule | GroupCreateParams.AccessIPListRule | GroupCreateParams.AccessCertificateRule | GroupCreateParams.AccessAccessGroupRule | GroupCreateParams.AccessAzureGroupRule | GroupCreateParams.AccessGitHubOrganizationRule | GroupCreateParams.AccessGsuiteGroupRule | GroupCreateParams.AccessOktaGroupRule | GroupCreateParams.AccessSamlGroupRule | GroupCreateParams.AccessServiceTokenRule | GroupCreateParams.AccessAnyValidServiceTokenRule | GroupCreateParams.AccessExternalEvaluationRule | GroupCreateParams.AccessCountryRule | GroupCreateParams.AccessAuthenticationMethodRule | GroupCreateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: Whether this is the default group
+     */
+    is_default?: boolean;
+    /**
+     * Body param: Rules evaluated with an AND logical operator. To match a policy, a
+     * user must meet all of the Require rules.
+     */
+    require?: Array<GroupCreateParams.AccessEmailRule | GroupCreateParams.AccessEmailListRule | GroupCreateParams.AccessDomainRule | GroupCreateParams.AccessEveryoneRule | GroupCreateParams.AccessIPRule | GroupCreateParams.AccessIPListRule | GroupCreateParams.AccessCertificateRule | GroupCreateParams.AccessAccessGroupRule | GroupCreateParams.AccessAzureGroupRule | GroupCreateParams.AccessGitHubOrganizationRule | GroupCreateParams.AccessGsuiteGroupRule | GroupCreateParams.AccessOktaGroupRule | GroupCreateParams.AccessSamlGroupRule | GroupCreateParams.AccessServiceTokenRule | GroupCreateParams.AccessAnyValidServiceTokenRule | GroupCreateParams.AccessExternalEvaluationRule | GroupCreateParams.AccessCountryRule | GroupCreateParams.AccessAuthenticationMethodRule | GroupCreateParams.AccessDevicePostureRule>;
+}
+export declare namespace GroupCreateParams {
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export interface GroupUpdateParams {
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<GroupUpdateParams.AccessEmailRule | GroupUpdateParams.AccessEmailListRule | GroupUpdateParams.AccessDomainRule | GroupUpdateParams.AccessEveryoneRule | GroupUpdateParams.AccessIPRule | GroupUpdateParams.AccessIPListRule | GroupUpdateParams.AccessCertificateRule | GroupUpdateParams.AccessAccessGroupRule | GroupUpdateParams.AccessAzureGroupRule | GroupUpdateParams.AccessGitHubOrganizationRule | GroupUpdateParams.AccessGsuiteGroupRule | GroupUpdateParams.AccessOktaGroupRule | GroupUpdateParams.AccessSamlGroupRule | GroupUpdateParams.AccessServiceTokenRule | GroupUpdateParams.AccessAnyValidServiceTokenRule | GroupUpdateParams.AccessExternalEvaluationRule | GroupUpdateParams.AccessCountryRule | GroupUpdateParams.AccessAuthenticationMethodRule | GroupUpdateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: The name of the Access group.
+     */
+    name: string;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+    /**
+     * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
+     * user cannot meet any of the Exclude rules.
+     */
+    exclude?: Array<GroupUpdateParams.AccessEmailRule | GroupUpdateParams.AccessEmailListRule | GroupUpdateParams.AccessDomainRule | GroupUpdateParams.AccessEveryoneRule | GroupUpdateParams.AccessIPRule | GroupUpdateParams.AccessIPListRule | GroupUpdateParams.AccessCertificateRule | GroupUpdateParams.AccessAccessGroupRule | GroupUpdateParams.AccessAzureGroupRule | GroupUpdateParams.AccessGitHubOrganizationRule | GroupUpdateParams.AccessGsuiteGroupRule | GroupUpdateParams.AccessOktaGroupRule | GroupUpdateParams.AccessSamlGroupRule | GroupUpdateParams.AccessServiceTokenRule | GroupUpdateParams.AccessAnyValidServiceTokenRule | GroupUpdateParams.AccessExternalEvaluationRule | GroupUpdateParams.AccessCountryRule | GroupUpdateParams.AccessAuthenticationMethodRule | GroupUpdateParams.AccessDevicePostureRule>;
+    /**
+     * Body param: Whether this is the default group
+     */
+    is_default?: boolean;
+    /**
+     * Body param: Rules evaluated with an AND logical operator. To match a policy, a
+     * user must meet all of the Require rules.
+     */
+    require?: Array<GroupUpdateParams.AccessEmailRule | GroupUpdateParams.AccessEmailListRule | GroupUpdateParams.AccessDomainRule | GroupUpdateParams.AccessEveryoneRule | GroupUpdateParams.AccessIPRule | GroupUpdateParams.AccessIPListRule | GroupUpdateParams.AccessCertificateRule | GroupUpdateParams.AccessAccessGroupRule | GroupUpdateParams.AccessAzureGroupRule | GroupUpdateParams.AccessGitHubOrganizationRule | GroupUpdateParams.AccessGsuiteGroupRule | GroupUpdateParams.AccessOktaGroupRule | GroupUpdateParams.AccessSamlGroupRule | GroupUpdateParams.AccessServiceTokenRule | GroupUpdateParams.AccessAnyValidServiceTokenRule | GroupUpdateParams.AccessExternalEvaluationRule | GroupUpdateParams.AccessCountryRule | GroupUpdateParams.AccessAuthenticationMethodRule | GroupUpdateParams.AccessDevicePostureRule>;
+}
+export declare namespace GroupUpdateParams {
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+    /**
+     * Matches a specific email.
+     */
+    interface AccessEmailRule {
+        email: AccessEmailRule.Email;
+    }
+    namespace AccessEmailRule {
+        interface Email {
+            /**
+             * The email of the user.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an email address from a list.
+     */
+    interface AccessEmailListRule {
+        email_list: AccessEmailListRule.EmailList;
+    }
+    namespace AccessEmailListRule {
+        interface EmailList {
+            /**
+             * The ID of a previously created email list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Match an entire email domain.
+     */
+    interface AccessDomainRule {
+        email_domain: AccessDomainRule.EmailDomain;
+    }
+    namespace AccessDomainRule {
+        interface EmailDomain {
+            /**
+             * The email domain to match.
+             */
+            domain: string;
+        }
+    }
+    /**
+     * Matches everyone.
+     */
+    interface AccessEveryoneRule {
+        /**
+         * An empty object which matches on all users.
+         */
+        everyone: unknown;
+    }
+    /**
+     * Matches an IP address block.
+     */
+    interface AccessIPRule {
+        ip: AccessIPRule.IP;
+    }
+    namespace AccessIPRule {
+        interface IP {
+            /**
+             * An IPv4 or IPv6 CIDR block.
+             */
+            ip: string;
+        }
+    }
+    /**
+     * Matches an IP address from a list.
+     */
+    interface AccessIPListRule {
+        ip_list: AccessIPListRule.IPList;
+    }
+    namespace AccessIPListRule {
+        interface IPList {
+            /**
+             * The ID of a previously created IP list.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches any valid client certificate.
+     */
+    interface AccessCertificateRule {
+        certificate: unknown;
+    }
+    /**
+     * Matches an Access group.
+     */
+    interface AccessAccessGroupRule {
+        group: AccessAccessGroupRule.Group;
+    }
+    namespace AccessAccessGroupRule {
+        interface Group {
+            /**
+             * The ID of a previously created Access group.
+             */
+            id: string;
+        }
+    }
+    /**
+     * Matches an Azure group. Requires an Azure identity provider.
+     */
+    interface AccessAzureGroupRule {
+        azureAD: AccessAzureGroupRule.AzureAd;
+    }
+    namespace AccessAzureGroupRule {
+        interface AzureAd {
+            /**
+             * The ID of an Azure group.
+             */
+            id: string;
+            /**
+             * The ID of your Azure identity provider.
+             */
+            connection_id: string;
+        }
+    }
+    /**
+     * Matches a Github organization. Requires a Github identity provider.
+     */
+    interface AccessGitHubOrganizationRule {
+        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
+    }
+    namespace AccessGitHubOrganizationRule {
+        interface GitHubOrganization {
+            /**
+             * The ID of your Github identity provider.
+             */
+            connection_id: string;
+            /**
+             * The name of the organization.
+             */
+            name: string;
+        }
+    }
+    /**
+     * Matches a group in Google Workspace. Requires a Google Workspace identity
+     * provider.
+     */
+    interface AccessGsuiteGroupRule {
+        gsuite: AccessGsuiteGroupRule.Gsuite;
+    }
+    namespace AccessGsuiteGroupRule {
+        interface Gsuite {
+            /**
+             * The ID of your Google Workspace identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Google Workspace group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches an Okta group. Requires an Okta identity provider.
+     */
+    interface AccessOktaGroupRule {
+        okta: AccessOktaGroupRule.Okta;
+    }
+    namespace AccessOktaGroupRule {
+        interface Okta {
+            /**
+             * The ID of your Okta identity provider.
+             */
+            connection_id: string;
+            /**
+             * The email of the Okta group.
+             */
+            email: string;
+        }
+    }
+    /**
+     * Matches a SAML group. Requires a SAML identity provider.
+     */
+    interface AccessSamlGroupRule {
+        saml: AccessSamlGroupRule.Saml;
+    }
+    namespace AccessSamlGroupRule {
+        interface Saml {
+            /**
+             * The name of the SAML attribute.
+             */
+            attribute_name: string;
+            /**
+             * The SAML attribute value to look for.
+             */
+            attribute_value: string;
+        }
+    }
+    /**
+     * Matches a specific Access Service Token
+     */
+    interface AccessServiceTokenRule {
+        service_token: AccessServiceTokenRule.ServiceToken;
+    }
+    namespace AccessServiceTokenRule {
+        interface ServiceToken {
+            /**
+             * The ID of a Service Token.
+             */
+            token_id: string;
+        }
+    }
+    /**
+     * Matches any valid Access Service Token
+     */
+    interface AccessAnyValidServiceTokenRule {
+        /**
+         * An empty object which matches on all service tokens.
+         */
+        any_valid_service_token: unknown;
+    }
+    /**
+     * Create Allow or Block policies which evaluate the user based on custom criteria.
+     */
+    interface AccessExternalEvaluationRule {
+        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
+    }
+    namespace AccessExternalEvaluationRule {
+        interface ExternalEvaluation {
+            /**
+             * The API endpoint containing your business logic.
+             */
+            evaluate_url: string;
+            /**
+             * The API endpoint containing the key that Access uses to verify that the response
+             * came from your API.
+             */
+            keys_url: string;
+        }
+    }
+    /**
+     * Matches a specific country
+     */
+    interface AccessCountryRule {
+        geo: AccessCountryRule.Geo;
+    }
+    namespace AccessCountryRule {
+        interface Geo {
+            /**
+             * The country code that should be matched.
+             */
+            country_code: string;
+        }
+    }
+    /**
+     * Enforce different MFA options
+     */
+    interface AccessAuthenticationMethodRule {
+        auth_method: AccessAuthenticationMethodRule.AuthMethod;
+    }
+    namespace AccessAuthenticationMethodRule {
+        interface AuthMethod {
+            /**
+             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
+             */
+            auth_method: string;
+        }
+    }
+    /**
+     * Enforces a device posture rule has run successfully
+     */
+    interface AccessDevicePostureRule {
+        device_posture: AccessDevicePostureRule.DevicePosture;
+    }
+    namespace AccessDevicePostureRule {
+        interface DevicePosture {
+            /**
+             * The ID of a device posture integration.
+             */
+            integration_uid: string;
+        }
+    }
+}
+export interface GroupListParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export interface GroupDeleteParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export interface GroupGetParams {
+    /**
+     * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
+     */
+    account_id?: string;
+    /**
+     * The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
+     */
+    zone_id?: string;
+}
+export declare namespace Groups {
+    export import AccessGroups = GroupsAPI.AccessGroups;
+    export import GroupListResponse = GroupsAPI.GroupListResponse;
+    export import GroupDeleteResponse = GroupsAPI.GroupDeleteResponse;
+    export import GroupCreateParams = GroupsAPI.GroupCreateParams;
+    export import GroupUpdateParams = GroupsAPI.GroupUpdateParams;
+    export import GroupListParams = GroupsAPI.GroupListParams;
+    export import GroupDeleteParams = GroupsAPI.GroupDeleteParams;
+    export import GroupGetParams = GroupsAPI.GroupGetParams;
+}
+//# sourceMappingURL=groups.d.ts.map