cloudflare 3.0.0-beta.1 → 3.0.0-beta.11

package/resources/zero-trust/access/applications/applications.d.ts

@@ -275,6 +275,14 @@ export declare namespace AccessApps {
              * The Access public certificate that will be used to verify your identity.
              */
             public_key?: string;
+            /**
+             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+             * user identities into attribute assertions in the SAML response. The expression
+             * can transform id, email, name, and groups values. It can also transform fields
+             * listed in the saml_attributes or oidc_fields of the identity provider used to
+             * authenticate. The output of this expression must be a JSON object.
+             */
+            saml_attribute_transform_jsonata?: string;
             /**
              * A globally unique name for an identity or service provider.
              */
@@ -815,532 +823,1548 @@ export interface ApplicationDeleteResponse {
     id?: string;
 }
 export type ApplicationRevokeTokensResponse = unknown;
-export interface ApplicationCreateParams {
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: When set to true, users can authenticate to this application using
-     * their WARP session. When set to false this application will always require
-     * direct IdP authentication. This setting always overrides the organization
-     * setting for WARP authentication.
-     */
-    allow_authenticate_via_warp?: boolean;
-    /**
-     * Body param: The identity providers your users can select when connecting to this
-     * application. Defaults to all IdPs configured in your account.
-     */
-    allowed_idps?: Array<string>;
-    /**
-     * Body param:
-     */
-    app_launcher_visible?: unknown;
-    /**
-     * Body param: When set to `true`, users skip the identity provider selection step
-     * during login. You must specify only one identity provider in allowed_idps.
-     */
-    auto_redirect_to_identity?: boolean;
-    /**
-     * Body param:
-     */
-    cors_headers?: ApplicationCreateParams.CorsHeaders;
-    /**
-     * Body param: The custom error message shown to a user when they are denied access
-     * to the application.
-     */
-    custom_deny_message?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing identity-based rules.
-     */
-    custom_deny_url?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing non-identity rules.
-     */
-    custom_non_identity_deny_url?: string;
-    /**
-     * Body param: The custom pages that will be displayed when applicable for this
-     * application
-     */
-    custom_pages?: Array<string>;
-    /**
-     * Body param: The URL or domain of the bookmark.
-     */
-    domain?: unknown;
-    /**
-     * Body param: Enables the binding cookie, which increases security against
-     * compromised authorization tokens and CSRF attacks.
-     */
-    enable_binding_cookie?: boolean;
-    /**
-     * Body param: Enables the HttpOnly cookie attribute, which increases security
-     * against XSS attacks.
-     */
-    http_only_cookie_attribute?: boolean;
-    /**
-     * Body param: The image URL for the logo shown in the App Launcher dashboard.
-     */
-    logo_url?: string;
-    /**
-     * Body param: The name of the application.
-     */
-    name?: string;
-    /**
-     * Body param: Enables cookie paths to scope an application's JWT to the
-     * application path. If disabled, the JWT will scope to the hostname by default
-     */
-    path_cookie_attribute?: boolean;
-    /**
-     * Body param:
-     */
-    saas_app?: ApplicationCreateParams.AccessSamlSaasApp | ApplicationCreateParams.AccessOidcSaasApp;
-    /**
-     * Body param: Sets the SameSite cookie setting, which provides increased security
-     * against CSRF attacks.
-     */
-    same_site_cookie_attribute?: string;
-    /**
-     * Body param: List of domains that Access will secure.
-     */
-    self_hosted_domains?: Array<string>;
-    /**
-     * Body param: Returns a 401 status code when the request is blocked by a Service
-     * Auth policy.
-     */
-    service_auth_401_redirect?: boolean;
-    /**
-     * Body param: The amount of time that tokens issued for this application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
-     */
-    session_duration?: string;
-    /**
-     * Body param: Enables automatic authentication through cloudflared.
-     */
-    skip_interstitial?: boolean;
-    /**
-     * Body param: The tags you want assigned to an application. Tags are used to
-     * filter applications in the App Launcher dashboard.
-     */
-    tags?: Array<string>;
-    /**
-     * Body param: The application type.
-     */
-    type?: string;
-}
+export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVncApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.BookmarkApplication;
 export declare namespace ApplicationCreateParams {
-    interface CorsHeaders {
-        /**
-         * Allows all HTTP request headers.
-         */
-        allow_all_headers?: boolean;
-        /**
-         * Allows all HTTP request methods.
-         */
-        allow_all_methods?: boolean;
+    interface SelfHostedApplication {
         /**
-         * Allows all origins.
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
          */
-        allow_all_origins?: boolean;
+        domain: string;
         /**
-         * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-         * client certificates) with requests.
+         * Body param: The application type.
          */
-        allow_credentials?: boolean;
+        type: string;
         /**
-         * Allowed HTTP request headers.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        allowed_headers?: Array<unknown>;
+        account_id?: string;
         /**
-         * Allowed HTTP request methods.
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+        zone_id?: string;
         /**
-         * Allowed origins.
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
          */
-        allowed_origins?: Array<unknown>;
+        allow_authenticate_via_warp?: boolean;
         /**
-         * The maximum number of seconds the results of a preflight request can be cached.
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        max_age?: number;
-    }
-    interface AccessSamlSaasApp {
+        allowed_idps?: Array<string>;
         /**
-         * Optional identifier indicating the authentication protocol used for the saas
-         * app. Required for OIDC. Default if unset is "saml"
+         * Body param: Displays the application in the App Launcher.
          */
-        auth_type?: 'saml' | 'oidc';
+        app_launcher_visible?: boolean;
         /**
-         * The service provider's endpoint that is responsible for receiving and parsing a
-         * SAML assertion.
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
          */
-        consumer_service_url?: string;
-        custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The URL that the user will be redirected to after a successful login for IDP
-         * initiated logins.
+         * Body param:
          */
-        default_relay_state?: string;
+        cors_headers?: ApplicationCreateParams.SelfHostedApplication.CorsHeaders;
         /**
-         * The unique identifier for your SaaS application.
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
          */
-        idp_entity_id?: string;
+        custom_deny_message?: string;
         /**
-         * The format of the name identifier sent to the SaaS application.
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
          */
-        name_id_format?: 'id' | 'email';
+        custom_deny_url?: string;
         /**
-         * A [JSONata](https://jsonata.org/) expression that transforms an application's
-         * user identities into a NameID value for its SAML assertion. This expression
-         * should evaluate to a singular string. The output of this expression can override
-         * the `name_id_format` setting.
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
          */
-        name_id_transform_jsonata?: string;
+        custom_non_identity_deny_url?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
          */
-        public_key?: string;
+        custom_pages?: Array<string>;
         /**
-         * A globally unique name for an identity or service provider.
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
          */
-        sp_entity_id?: string;
+        enable_binding_cookie?: boolean;
         /**
-         * The endpoint where your SaaS application will send login requests.
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
          */
-        sso_endpoint?: string;
-    }
-    namespace AccessSamlSaasApp {
-        interface CustomAttributes {
-            /**
-             * The name of the attribute.
-             */
-            name?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-            source?: CustomAttributes.Source;
-        }
-        namespace CustomAttributes {
-            interface Source {
-                /**
-                 * The name of the IdP attribute.
-                 */
-                name?: string;
-            }
-        }
-    }
-    interface AccessOidcSaasApp {
+        http_only_cookie_attribute?: boolean;
         /**
-         * The URL where this applications tile redirects users
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        app_launcher_url?: string;
+        logo_url?: string;
         /**
-         * Identifier of the authentication protocol used for the saas app. Required for
-         * OIDC.
+         * Body param: The name of the application.
          */
-        auth_type?: 'saml' | 'oidc';
+        name?: string;
         /**
-         * The application client id
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
          */
-        client_id?: string;
+        path_cookie_attribute?: boolean;
         /**
-         * The application client secret, only returned on POST request.
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
          */
-        client_secret?: string;
+        same_site_cookie_attribute?: string;
         /**
-         * The OIDC flows supported by this application
+         * Body param: List of domains that Access will secure.
          */
-        grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+        self_hosted_domains?: Array<string>;
         /**
-         * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
          */
-        group_filter_regex?: string;
+        service_auth_401_redirect?: boolean;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
          */
-        public_key?: string;
+        session_duration?: string;
         /**
-         * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-         * tokens
+         * Body param: Enables automatic authentication through cloudflared.
          */
-        redirect_uris?: Array<string>;
+        skip_interstitial?: boolean;
         /**
-         * Define the user information shared with access
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        tags?: Array<string>;
     }
-}
-export interface ApplicationUpdateParams {
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: When set to true, users can authenticate to this application using
-     * their WARP session. When set to false this application will always require
-     * direct IdP authentication. This setting always overrides the organization
-     * setting for WARP authentication.
-     */
-    allow_authenticate_via_warp?: boolean;
-    /**
-     * Body param: The identity providers your users can select when connecting to this
-     * application. Defaults to all IdPs configured in your account.
-     */
-    allowed_idps?: Array<string>;
-    /**
-     * Body param:
-     */
-    app_launcher_visible?: unknown;
-    /**
-     * Body param: When set to `true`, users skip the identity provider selection step
-     * during login. You must specify only one identity provider in allowed_idps.
-     */
-    auto_redirect_to_identity?: boolean;
-    /**
-     * Body param:
-     */
-    cors_headers?: ApplicationUpdateParams.CorsHeaders;
-    /**
-     * Body param: The custom error message shown to a user when they are denied access
-     * to the application.
-     */
-    custom_deny_message?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing identity-based rules.
-     */
-    custom_deny_url?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing non-identity rules.
-     */
-    custom_non_identity_deny_url?: string;
-    /**
-     * Body param: The custom pages that will be displayed when applicable for this
-     * application
-     */
-    custom_pages?: Array<string>;
-    /**
-     * Body param: The URL or domain of the bookmark.
-     */
-    domain?: unknown;
-    /**
-     * Body param: Enables the binding cookie, which increases security against
-     * compromised authorization tokens and CSRF attacks.
-     */
-    enable_binding_cookie?: boolean;
-    /**
-     * Body param: Enables the HttpOnly cookie attribute, which increases security
-     * against XSS attacks.
-     */
-    http_only_cookie_attribute?: boolean;
-    /**
-     * Body param: The image URL for the logo shown in the App Launcher dashboard.
-     */
-    logo_url?: string;
-    /**
-     * Body param: The name of the application.
-     */
-    name?: string;
-    /**
-     * Body param: Enables cookie paths to scope an application's JWT to the
-     * application path. If disabled, the JWT will scope to the hostname by default
-     */
-    path_cookie_attribute?: boolean;
-    /**
-     * Body param:
-     */
-    saas_app?: ApplicationUpdateParams.AccessSamlSaasApp | ApplicationUpdateParams.AccessOidcSaasApp;
-    /**
-     * Body param: Sets the SameSite cookie setting, which provides increased security
-     * against CSRF attacks.
-     */
-    same_site_cookie_attribute?: string;
-    /**
-     * Body param: List of domains that Access will secure.
-     */
-    self_hosted_domains?: Array<string>;
-    /**
-     * Body param: Returns a 401 status code when the request is blocked by a Service
-     * Auth policy.
-     */
-    service_auth_401_redirect?: boolean;
-    /**
-     * Body param: The amount of time that tokens issued for this application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
-     */
-    session_duration?: string;
-    /**
-     * Body param: Enables automatic authentication through cloudflared.
-     */
-    skip_interstitial?: boolean;
-    /**
-     * Body param: The tags you want assigned to an application. Tags are used to
-     * filter applications in the App Launcher dashboard.
-     */
-    tags?: Array<string>;
-    /**
-     * Body param: The application type.
-     */
-    type?: string;
-}
-export declare namespace ApplicationUpdateParams {
-    interface CorsHeaders {
-        /**
-         * Allows all HTTP request headers.
-         */
-        allow_all_headers?: boolean;
-        /**
-         * Allows all HTTP request methods.
-         */
-        allow_all_methods?: boolean;
-        /**
-         * Allows all origins.
-         */
-        allow_all_origins?: boolean;
-        /**
-         * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-         * client certificates) with requests.
-         */
-        allow_credentials?: boolean;
-        /**
-         * Allowed HTTP request headers.
-         */
-        allowed_headers?: Array<unknown>;
-        /**
-         * Allowed HTTP request methods.
-         */
-        allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+    namespace SelfHostedApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+    }
+    interface SaaSApplication {
         /**
-         * Allowed origins.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        allowed_origins?: Array<unknown>;
+        account_id?: string;
         /**
-         * The maximum number of seconds the results of a preflight request can be cached.
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        max_age?: number;
-    }
-    interface AccessSamlSaasApp {
+        zone_id?: string;
         /**
-         * Optional identifier indicating the authentication protocol used for the saas
-         * app. Required for OIDC. Default if unset is "saml"
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        auth_type?: 'saml' | 'oidc';
+        allowed_idps?: Array<string>;
         /**
-         * The service provider's endpoint that is responsible for receiving and parsing a
-         * SAML assertion.
+         * Body param: Displays the application in the App Launcher.
          */
-        consumer_service_url?: string;
-        custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+        app_launcher_visible?: boolean;
         /**
-         * The URL that the user will be redirected to after a successful login for IDP
-         * initiated logins.
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
          */
-        default_relay_state?: string;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The unique identifier for your SaaS application.
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
          */
-        idp_entity_id?: string;
+        custom_pages?: Array<string>;
         /**
-         * The format of the name identifier sent to the SaaS application.
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        name_id_format?: 'id' | 'email';
+        logo_url?: string;
         /**
-         * A [JSONata](https://jsonata.org/) expression that transforms an application's
-         * user identities into a NameID value for its SAML assertion. This expression
-         * should evaluate to a singular string. The output of this expression can override
-         * the `name_id_format` setting.
+         * Body param: The name of the application.
          */
-        name_id_transform_jsonata?: string;
+        name?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param:
          */
-        public_key?: string;
+        saas_app?: ApplicationCreateParams.SaaSApplication.AccessSamlSaasApp | ApplicationCreateParams.SaaSApplication.AccessOidcSaasApp;
         /**
-         * A globally unique name for an identity or service provider.
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        sp_entity_id?: string;
+        tags?: Array<string>;
         /**
-         * The endpoint where your SaaS application will send login requests.
+         * Body param: The application type.
          */
-        sso_endpoint?: string;
+        type?: string;
     }
-    namespace AccessSamlSaasApp {
-        interface CustomAttributes {
+    namespace SaaSApplication {
+        interface AccessSamlSaasApp {
+            /**
+             * Optional identifier indicating the authentication protocol used for the saas
+             * app. Required for OIDC. Default if unset is "saml"
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The service provider's endpoint that is responsible for receiving and parsing a
+             * SAML assertion.
+             */
+            consumer_service_url?: string;
+            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
             /**
-             * The name of the attribute.
+             * The URL that the user will be redirected to after a successful login for IDP
+             * initiated logins.
+             */
+            default_relay_state?: string;
+            /**
+             * The unique identifier for your SaaS application.
+             */
+            idp_entity_id?: string;
+            /**
+             * The format of the name identifier sent to the SaaS application.
+             */
+            name_id_format?: 'id' | 'email';
+            /**
+             * A [JSONata](https://jsonata.org/) expression that transforms an application's
+             * user identities into a NameID value for its SAML assertion. This expression
+             * should evaluate to a singular string. The output of this expression can override
+             * the `name_id_format` setting.
+             */
+            name_id_transform_jsonata?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
+            /**
+             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+             * user identities into attribute assertions in the SAML response. The expression
+             * can transform id, email, name, and groups values. It can also transform fields
+             * listed in the saml_attributes or oidc_fields of the identity provider used to
+             * authenticate. The output of this expression must be a JSON object.
              */
-            name?: string;
+            saml_attribute_transform_jsonata?: string;
             /**
              * A globally unique name for an identity or service provider.
              */
-            name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-            source?: CustomAttributes.Source;
+            sp_entity_id?: string;
+            /**
+             * The endpoint where your SaaS application will send login requests.
+             */
+            sso_endpoint?: string;
         }
-        namespace CustomAttributes {
-            interface Source {
+        namespace AccessSamlSaasApp {
+            interface CustomAttributes {
                 /**
-                 * The name of the IdP attribute.
+                 * The name of the attribute.
                  */
                 name?: string;
+                /**
+                 * A globally unique name for an identity or service provider.
+                 */
+                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+                source?: CustomAttributes.Source;
+            }
+            namespace CustomAttributes {
+                interface Source {
+                    /**
+                     * The name of the IdP attribute.
+                     */
+                    name?: string;
+                }
             }
         }
+        interface AccessOidcSaasApp {
+            /**
+             * The URL where this applications tile redirects users
+             */
+            app_launcher_url?: string;
+            /**
+             * Identifier of the authentication protocol used for the saas app. Required for
+             * OIDC.
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The application client id
+             */
+            client_id?: string;
+            /**
+             * The application client secret, only returned on POST request.
+             */
+            client_secret?: string;
+            /**
+             * The OIDC flows supported by this application
+             */
+            grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+            /**
+             * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+             */
+            group_filter_regex?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
+            /**
+             * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+             * tokens
+             */
+            redirect_uris?: Array<string>;
+            /**
+             * Define the user information shared with access
+             */
+            scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        }
+    }
+    interface BrowserSSHApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: ApplicationCreateParams.BrowserSSHApplication.CorsHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<string>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    namespace BrowserSSHApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
     }
-    interface AccessOidcSaasApp {
+    interface BrowserVncApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: ApplicationCreateParams.BrowserVncApplication.CorsHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
         /**
-         * The URL where this applications tile redirects users
+         * Body param: The name of the application.
          */
-        app_launcher_url?: string;
+        name?: string;
         /**
-         * Identifier of the authentication protocol used for the saas app. Required for
-         * OIDC.
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
          */
-        auth_type?: 'saml' | 'oidc';
+        path_cookie_attribute?: boolean;
         /**
-         * The application client id
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
          */
-        client_id?: string;
+        same_site_cookie_attribute?: string;
         /**
-         * The application client secret, only returned on POST request.
+         * Body param: List of domains that Access will secure.
          */
-        client_secret?: string;
+        self_hosted_domains?: Array<string>;
         /**
-         * The OIDC flows supported by this application
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
          */
-        grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+        service_auth_401_redirect?: boolean;
         /**
-         * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
          */
-        group_filter_regex?: string;
+        session_duration?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: Enables automatic authentication through cloudflared.
          */
-        public_key?: string;
+        skip_interstitial?: boolean;
         /**
-         * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-         * tokens
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        redirect_uris?: Array<string>;
+        tags?: Array<string>;
+    }
+    namespace BrowserVncApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+    }
+    interface AppLauncherApplication {
         /**
-         * Define the user information shared with access
+         * Body param: The application type.
          */
-        scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface DeviceEnrollmentPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BrowserIsolationPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BookmarkApplication {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param:
+         */
+        app_launcher_visible?: unknown;
+        /**
+         * Body param: The URL or domain of the bookmark.
+         */
+        domain?: unknown;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
+    }
+}
+export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVncApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.BookmarkApplication;
+export declare namespace ApplicationUpdateParams {
+    interface SelfHostedApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: ApplicationUpdateParams.SelfHostedApplication.CorsHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<string>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    namespace SelfHostedApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+    }
+    interface SaaSApplication {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param:
+         */
+        saas_app?: ApplicationUpdateParams.SaaSApplication.AccessSamlSaasApp | ApplicationUpdateParams.SaaSApplication.AccessOidcSaasApp;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
+    }
+    namespace SaaSApplication {
+        interface AccessSamlSaasApp {
+            /**
+             * Optional identifier indicating the authentication protocol used for the saas
+             * app. Required for OIDC. Default if unset is "saml"
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The service provider's endpoint that is responsible for receiving and parsing a
+             * SAML assertion.
+             */
+            consumer_service_url?: string;
+            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+            /**
+             * The URL that the user will be redirected to after a successful login for IDP
+             * initiated logins.
+             */
+            default_relay_state?: string;
+            /**
+             * The unique identifier for your SaaS application.
+             */
+            idp_entity_id?: string;
+            /**
+             * The format of the name identifier sent to the SaaS application.
+             */
+            name_id_format?: 'id' | 'email';
+            /**
+             * A [JSONata](https://jsonata.org/) expression that transforms an application's
+             * user identities into a NameID value for its SAML assertion. This expression
+             * should evaluate to a singular string. The output of this expression can override
+             * the `name_id_format` setting.
+             */
+            name_id_transform_jsonata?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
+            /**
+             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+             * user identities into attribute assertions in the SAML response. The expression
+             * can transform id, email, name, and groups values. It can also transform fields
+             * listed in the saml_attributes or oidc_fields of the identity provider used to
+             * authenticate. The output of this expression must be a JSON object.
+             */
+            saml_attribute_transform_jsonata?: string;
+            /**
+             * A globally unique name for an identity or service provider.
+             */
+            sp_entity_id?: string;
+            /**
+             * The endpoint where your SaaS application will send login requests.
+             */
+            sso_endpoint?: string;
+        }
+        namespace AccessSamlSaasApp {
+            interface CustomAttributes {
+                /**
+                 * The name of the attribute.
+                 */
+                name?: string;
+                /**
+                 * A globally unique name for an identity or service provider.
+                 */
+                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+                source?: CustomAttributes.Source;
+            }
+            namespace CustomAttributes {
+                interface Source {
+                    /**
+                     * The name of the IdP attribute.
+                     */
+                    name?: string;
+                }
+            }
+        }
+        interface AccessOidcSaasApp {
+            /**
+             * The URL where this applications tile redirects users
+             */
+            app_launcher_url?: string;
+            /**
+             * Identifier of the authentication protocol used for the saas app. Required for
+             * OIDC.
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The application client id
+             */
+            client_id?: string;
+            /**
+             * The application client secret, only returned on POST request.
+             */
+            client_secret?: string;
+            /**
+             * The OIDC flows supported by this application
+             */
+            grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+            /**
+             * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+             */
+            group_filter_regex?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
+            /**
+             * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+             * tokens
+             */
+            redirect_uris?: Array<string>;
+            /**
+             * Define the user information shared with access
+             */
+            scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        }
+    }
+    interface BrowserSSHApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: ApplicationUpdateParams.BrowserSSHApplication.CorsHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<string>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    namespace BrowserSSHApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+    }
+    interface BrowserVncApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: ApplicationUpdateParams.BrowserVncApplication.CorsHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<string>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    namespace BrowserVncApplication {
+        interface CorsHeaders {
+            /**
+             * Allows all HTTP request headers.
+             */
+            allow_all_headers?: boolean;
+            /**
+             * Allows all HTTP request methods.
+             */
+            allow_all_methods?: boolean;
+            /**
+             * Allows all origins.
+             */
+            allow_all_origins?: boolean;
+            /**
+             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+             * client certificates) with requests.
+             */
+            allow_credentials?: boolean;
+            /**
+             * Allowed HTTP request headers.
+             */
+            allowed_headers?: Array<unknown>;
+            /**
+             * Allowed HTTP request methods.
+             */
+            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+            /**
+             * Allowed origins.
+             */
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+    }
+    interface AppLauncherApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface DeviceEnrollmentPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BrowserIsolationPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<string>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BookmarkApplication {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param:
+         */
+        app_launcher_visible?: unknown;
+        /**
+         * Body param: The URL or domain of the bookmark.
+         */
+        domain?: unknown;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
     }
 }
 export interface ApplicationListParams {