cloudflare 3.0.0-beta.8 → 3.0.0

package/src/resources/zero-trust/access/applications/applications.ts

@@ -8,6 +8,7 @@ import * as ApplicationsAPI from "./applications";
 import * as CAsAPI from "./cas";
 import * as PoliciesAPI from "./policies";
 import * as UserPolicyChecksAPI from "./user-policy-checks";
+import { SinglePage } from "../../../../pagination";
 
 export class Applications extends APIResource {
   cas: CAsAPI.CAs = new CAsAPI.CAs(this._client);
@@ -19,7 +20,7 @@ export class Applications extends APIResource {
   /**
    * Adds a new application to Access.
    */
-  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessApps> {
+  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -41,7 +42,7 @@ export class Applications extends APIResource {
       this._client.post(`/${accountOrZone}/${accountOrZoneId}/access/apps`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessApps }>
+      }) as Core.APIPromise<{ result: ZeroTrustApps }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -52,7 +53,7 @@ export class Applications extends APIResource {
     appId: string | string,
     params: ApplicationUpdateParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps> {
+  ): Core.APIPromise<ZeroTrustApps> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -74,7 +75,7 @@ export class Applications extends APIResource {
       this._client.put(`/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessApps }>
+      }) as Core.APIPromise<{ result: ZeroTrustApps }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -84,12 +85,12 @@ export class Applications extends APIResource {
   list(
     params?: ApplicationListParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ApplicationListResponse | null>;
-  list(options?: Core.RequestOptions): Core.APIPromise<ApplicationListResponse | null>;
+  ): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
+  list(options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
   list(
     params: ApplicationListParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ApplicationListResponse | null> {
+  ): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps> {
     if (isRequestOptions(params)) {
       return this.list({}, params);
     }
@@ -110,11 +111,11 @@ export class Applications extends APIResource {
           accountOrZone: 'zones',
           accountOrZoneId: zone_id,
         };
-    return (
-      this._client.get(`/${accountOrZone}/${accountOrZoneId}/access/apps`, options) as Core.APIPromise<{
-        result: ApplicationListResponse | null;
-      }>
-    )._thenUnwrap((obj) => obj.result);
+    return this._client.getAPIList(
+      `/${accountOrZone}/${accountOrZoneId}/access/apps`,
+      ZeroTrustAppsSinglePage,
+      options,
+    );
   }
 
   /**
@@ -166,13 +167,13 @@ export class Applications extends APIResource {
     appId: string | string,
     params?: ApplicationGetParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps>;
-  get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
+  ): Core.APIPromise<ZeroTrustApps>;
+  get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
   get(
     appId: string | string,
     params: ApplicationGetParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps> {
+  ): Core.APIPromise<ZeroTrustApps> {
     if (isRequestOptions(params)) {
       return this.get(appId, {}, params);
     }
@@ -197,7 +198,7 @@ export class Applications extends APIResource {
       this._client.get(
         `/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`,
         options,
-      ) as Core.APIPromise<{ result: AccessApps }>
+      ) as Core.APIPromise<{ result: ZeroTrustApps }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -247,17 +248,19 @@ export class Applications extends APIResource {
   }
 }
 
-export type AccessApps =
-  | AccessApps.SelfHostedApplication
-  | AccessApps.SaaSApplication
-  | AccessApps.BrowserSSHApplication
-  | AccessApps.BrowserVncApplication
-  | AccessApps.AppLauncherApplication
-  | AccessApps.DeviceEnrollmentPermissionsApplication
-  | AccessApps.BrowserIsolationPermissionsApplication
-  | AccessApps.BookmarkApplication;
-
-export namespace AccessApps {
+export class ZeroTrustAppsSinglePage extends SinglePage<ZeroTrustApps> {}
+
+export type ZeroTrustApps =
+  | ZeroTrustApps.SelfHostedApplication
+  | ZeroTrustApps.SaaSApplication
+  | ZeroTrustApps.BrowserSSHApplication
+  | ZeroTrustApps.BrowserVncApplication
+  | ZeroTrustApps.AppLauncherApplication
+  | ZeroTrustApps.DeviceEnrollmentPermissionsApplication
+  | ZeroTrustApps.BrowserIsolationPermissionsApplication
+  | ZeroTrustApps.BookmarkApplication;
+
+export namespace ZeroTrustApps {
   export interface SelfHostedApplication {
     /**
      * The primary hostname and path that Access will secure. If the app is visible in
@@ -423,7 +426,7 @@ export namespace AccessApps {
       /**
        * Allowed HTTP request headers.
        */
-      allowed_headers?: Array<unknown>;
+      allowed_headers?: Array<string>;
 
       /**
        * Allowed HTTP request methods.
@@ -435,7 +438,7 @@ export namespace AccessApps {
       /**
        * Allowed origins.
        */
-      allowed_origins?: Array<unknown>;
+      allowed_origins?: Array<string>;
 
       /**
        * The maximum number of seconds the results of a preflight request can be cached.
@@ -552,6 +555,15 @@ export namespace AccessApps {
        */
       public_key?: string;
 
+      /**
+       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+       * user identities into attribute assertions in the SAML response. The expression
+       * can transform id, email, name, and groups values. It can also transform fields
+       * listed in the saml_attributes or oidc_fields of the identity provider used to
+       * authenticate. The output of this expression must be a JSON object.
+       */
+      saml_attribute_transform_jsonata?: string;
+
       /**
        * A globally unique name for an identity or service provider.
        */
@@ -812,7 +824,7 @@ export namespace AccessApps {
       /**
        * Allowed HTTP request headers.
        */
-      allowed_headers?: Array<unknown>;
+      allowed_headers?: Array<string>;
 
       /**
        * Allowed HTTP request methods.
@@ -824,7 +836,7 @@ export namespace AccessApps {
       /**
        * Allowed origins.
        */
-      allowed_origins?: Array<unknown>;
+      allowed_origins?: Array<string>;
 
       /**
        * The maximum number of seconds the results of a preflight request can be cached.
@@ -998,7 +1010,7 @@ export namespace AccessApps {
       /**
        * Allowed HTTP request headers.
        */
-      allowed_headers?: Array<unknown>;
+      allowed_headers?: Array<string>;
 
       /**
        * Allowed HTTP request methods.
@@ -1010,7 +1022,7 @@ export namespace AccessApps {
       /**
        * Allowed origins.
        */
-      allowed_origins?: Array<unknown>;
+      allowed_origins?: Array<string>;
 
       /**
        * The maximum number of seconds the results of a preflight request can be cached.
@@ -1178,7 +1190,10 @@ export namespace AccessApps {
      */
     id?: string;
 
-    app_launcher_visible?: unknown;
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
 
     /**
      * Audience tag.
@@ -1190,7 +1205,7 @@ export namespace AccessApps {
     /**
      * The URL or domain of the bookmark.
      */
-    domain?: unknown;
+    domain?: string;
 
     /**
      * The image URL for the logo shown in the App Launcher dashboard.
@@ -1217,8 +1232,6 @@ export namespace AccessApps {
   }
 }
 
-export type ApplicationListResponse = Array<AccessApps>;
-
 export interface ApplicationDeleteResponse {
   /**
    * UUID
@@ -1228,653 +1241,1901 @@ export interface ApplicationDeleteResponse {
 
 export type ApplicationRevokeTokensResponse = unknown;
 
-export interface ApplicationCreateParams {
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
-
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
-
-  /**
-   * Body param: When set to true, users can authenticate to this application using
-   * their WARP session. When set to false this application will always require
-   * direct IdP authentication. This setting always overrides the organization
-   * setting for WARP authentication.
-   */
-  allow_authenticate_via_warp?: boolean;
-
-  /**
-   * Body param: The identity providers your users can select when connecting to this
-   * application. Defaults to all IdPs configured in your account.
-   */
-  allowed_idps?: Array<string>;
-
-  /**
-   * Body param:
-   */
-  app_launcher_visible?: unknown;
-
-  /**
-   * Body param: When set to `true`, users skip the identity provider selection step
-   * during login. You must specify only one identity provider in allowed_idps.
-   */
-  auto_redirect_to_identity?: boolean;
-
-  /**
-   * Body param:
-   */
-  cors_headers?: ApplicationCreateParams.CorsHeaders;
-
-  /**
-   * Body param: The custom error message shown to a user when they are denied access
-   * to the application.
-   */
-  custom_deny_message?: string;
-
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing identity-based rules.
-   */
-  custom_deny_url?: string;
-
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing non-identity rules.
-   */
-  custom_non_identity_deny_url?: string;
-
-  /**
-   * Body param: The custom pages that will be displayed when applicable for this
-   * application
-   */
-  custom_pages?: Array<string>;
-
-  /**
-   * Body param: The URL or domain of the bookmark.
-   */
-  domain?: unknown;
-
-  /**
-   * Body param: Enables the binding cookie, which increases security against
-   * compromised authorization tokens and CSRF attacks.
-   */
-  enable_binding_cookie?: boolean;
-
-  /**
-   * Body param: Enables the HttpOnly cookie attribute, which increases security
-   * against XSS attacks.
-   */
-  http_only_cookie_attribute?: boolean;
-
-  /**
-   * Body param: The image URL for the logo shown in the App Launcher dashboard.
-   */
-  logo_url?: string;
-
-  /**
-   * Body param: The name of the application.
-   */
-  name?: string;
-
-  /**
-   * Body param: Enables cookie paths to scope an application's JWT to the
-   * application path. If disabled, the JWT will scope to the hostname by default
-   */
-  path_cookie_attribute?: boolean;
-
-  /**
-   * Body param:
-   */
-  saas_app?: ApplicationCreateParams.AccessSamlSaasApp | ApplicationCreateParams.AccessOidcSaasApp;
-
-  /**
-   * Body param: Sets the SameSite cookie setting, which provides increased security
-   * against CSRF attacks.
-   */
-  same_site_cookie_attribute?: string;
-
-  /**
-   * Body param: List of domains that Access will secure.
-   */
-  self_hosted_domains?: Array<string>;
-
-  /**
-   * Body param: Returns a 401 status code when the request is blocked by a Service
-   * Auth policy.
-   */
-  service_auth_401_redirect?: boolean;
-
-  /**
-   * Body param: The amount of time that tokens issued for this application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
-   */
-  session_duration?: string;
-
-  /**
-   * Body param: Enables automatic authentication through cloudflared.
-   */
-  skip_interstitial?: boolean;
-
-  /**
-   * Body param: The tags you want assigned to an application. Tags are used to
-   * filter applications in the App Launcher dashboard.
-   */
-  tags?: Array<string>;
-
-  /**
-   * Body param: The application type.
-   */
-  type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
-}
+export type ApplicationCreateParams =
+  | ApplicationCreateParams.SelfHostedApplication
+  | ApplicationCreateParams.SaaSApplication
+  | ApplicationCreateParams.BrowserSSHApplication
+  | ApplicationCreateParams.BrowserVncApplication
+  | ApplicationCreateParams.AppLauncherApplication
+  | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication
+  | ApplicationCreateParams.BrowserIsolationPermissionsApplication
+  | ApplicationCreateParams.BookmarkApplication;
 
 export namespace ApplicationCreateParams {
-  export interface CorsHeaders {
-    /**
-     * Allows all HTTP request headers.
-     */
-    allow_all_headers?: boolean;
-
-    /**
-     * Allows all HTTP request methods.
-     */
-    allow_all_methods?: boolean;
-
+  export interface SelfHostedApplication {
     /**
-     * Allows all origins.
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
      */
-    allow_all_origins?: boolean;
+    domain: string;
 
     /**
-     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-     * client certificates) with requests.
+     * Body param: The application type.
      */
-    allow_credentials?: boolean;
+    type: string;
 
     /**
-     * Allowed HTTP request headers.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    allowed_headers?: Array<unknown>;
+    account_id?: string;
 
     /**
-     * Allowed HTTP request methods.
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    allowed_methods?: Array<
-      'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-    >;
+    zone_id?: string;
 
     /**
-     * Allowed origins.
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
      */
-    allowed_origins?: Array<unknown>;
+    allow_authenticate_via_warp?: boolean;
 
     /**
-     * The maximum number of seconds the results of a preflight request can be cached.
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    max_age?: number;
-  }
+    allowed_idps?: Array<string>;
 
-  export interface AccessSamlSaasApp {
     /**
-     * Optional identifier indicating the authentication protocol used for the saas
-     * app. Required for OIDC. Default if unset is "saml"
+     * Body param: Displays the application in the App Launcher.
      */
-    auth_type?: 'saml' | 'oidc';
+    app_launcher_visible?: boolean;
 
     /**
-     * The service provider's endpoint that is responsible for receiving and parsing a
-     * SAML assertion.
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
      */
-    consumer_service_url?: string;
-
-    custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * The URL that the user will be redirected to after a successful login for IDP
-     * initiated logins.
+     * Body param:
      */
-    default_relay_state?: string;
+    cors_headers?: ApplicationCreateParams.SelfHostedApplication.CorsHeaders;
 
     /**
-     * The unique identifier for your SaaS application.
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
      */
-    idp_entity_id?: string;
+    custom_deny_message?: string;
 
     /**
-     * The format of the name identifier sent to the SaaS application.
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
      */
-    name_id_format?: 'id' | 'email';
+    custom_deny_url?: string;
 
     /**
-     * A [JSONata](https://jsonata.org/) expression that transforms an application's
-     * user identities into a NameID value for its SAML assertion. This expression
-     * should evaluate to a singular string. The output of this expression can override
-     * the `name_id_format` setting.
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
      */
-    name_id_transform_jsonata?: string;
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
      */
-    public_key?: string;
+    custom_pages?: Array<string>;
 
     /**
-     * A globally unique name for an identity or service provider.
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
      */
-    sp_entity_id?: string;
+    enable_binding_cookie?: boolean;
 
     /**
-     * The endpoint where your SaaS application will send login requests.
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
      */
-    sso_endpoint?: string;
-  }
-
-  export namespace AccessSamlSaasApp {
-    export interface CustomAttributes {
-      /**
-       * The name of the attribute.
-       */
-      name?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      name_format?:
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-
-      source?: CustomAttributes.Source;
-    }
-
-    export namespace CustomAttributes {
-      export interface Source {
-        /**
-         * The name of the IdP attribute.
-         */
-        name?: string;
-      }
-    }
-  }
+    http_only_cookie_attribute?: boolean;
 
-  export interface AccessOidcSaasApp {
     /**
-     * The URL where this applications tile redirects users
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
      */
-    app_launcher_url?: string;
+    logo_url?: string;
 
     /**
-     * Identifier of the authentication protocol used for the saas app. Required for
-     * OIDC.
+     * Body param: The name of the application.
      */
-    auth_type?: 'saml' | 'oidc';
+    name?: string;
 
     /**
-     * The application client id
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
      */
-    client_id?: string;
+    path_cookie_attribute?: boolean;
 
     /**
-     * The application client secret, only returned on POST request.
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
      */
-    client_secret?: string;
+    same_site_cookie_attribute?: string;
 
     /**
-     * The OIDC flows supported by this application
+     * Body param: List of domains that Access will secure.
      */
-    grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+    self_hosted_domains?: Array<string>;
 
     /**
-     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
      */
-    group_filter_regex?: string;
+    service_auth_401_redirect?: boolean;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
      */
-    public_key?: string;
+    session_duration?: string;
 
     /**
-     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-     * tokens
+     * Body param: Enables automatic authentication through cloudflared.
      */
-    redirect_uris?: Array<string>;
+    skip_interstitial?: boolean;
 
     /**
-     * Define the user information shared with access
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    tags?: Array<string>;
   }
-}
-
-export interface ApplicationUpdateParams {
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
-
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
-
-  /**
-   * Body param: When set to true, users can authenticate to this application using
-   * their WARP session. When set to false this application will always require
-   * direct IdP authentication. This setting always overrides the organization
-   * setting for WARP authentication.
-   */
-  allow_authenticate_via_warp?: boolean;
-
-  /**
-   * Body param: The identity providers your users can select when connecting to this
-   * application. Defaults to all IdPs configured in your account.
-   */
-  allowed_idps?: Array<string>;
-
-  /**
-   * Body param:
-   */
-  app_launcher_visible?: unknown;
-
-  /**
-   * Body param: When set to `true`, users skip the identity provider selection step
-   * during login. You must specify only one identity provider in allowed_idps.
-   */
-  auto_redirect_to_identity?: boolean;
-
-  /**
-   * Body param:
-   */
-  cors_headers?: ApplicationUpdateParams.CorsHeaders;
-
-  /**
-   * Body param: The custom error message shown to a user when they are denied access
-   * to the application.
-   */
-  custom_deny_message?: string;
-
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing identity-based rules.
-   */
-  custom_deny_url?: string;
-
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing non-identity rules.
-   */
-  custom_non_identity_deny_url?: string;
-
-  /**
-   * Body param: The custom pages that will be displayed when applicable for this
-   * application
-   */
-  custom_pages?: Array<string>;
-
-  /**
-   * Body param: The URL or domain of the bookmark.
-   */
-  domain?: unknown;
-
-  /**
-   * Body param: Enables the binding cookie, which increases security against
-   * compromised authorization tokens and CSRF attacks.
-   */
-  enable_binding_cookie?: boolean;
-
-  /**
-   * Body param: Enables the HttpOnly cookie attribute, which increases security
-   * against XSS attacks.
-   */
-  http_only_cookie_attribute?: boolean;
-
-  /**
-   * Body param: The image URL for the logo shown in the App Launcher dashboard.
-   */
-  logo_url?: string;
-
-  /**
-   * Body param: The name of the application.
-   */
-  name?: string;
-
-  /**
-   * Body param: Enables cookie paths to scope an application's JWT to the
-   * application path. If disabled, the JWT will scope to the hostname by default
-   */
-  path_cookie_attribute?: boolean;
 
-  /**
-   * Body param:
-   */
-  saas_app?: ApplicationUpdateParams.AccessSamlSaasApp | ApplicationUpdateParams.AccessOidcSaasApp;
+  export namespace SelfHostedApplication {
+    export interface CorsHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
 
-  /**
-   * Body param: Sets the SameSite cookie setting, which provides increased security
-   * against CSRF attacks.
-   */
-  same_site_cookie_attribute?: string;
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
 
-  /**
-   * Body param: List of domains that Access will secure.
-   */
-  self_hosted_domains?: Array<string>;
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
 
-  /**
-   * Body param: Returns a 401 status code when the request is blocked by a Service
-   * Auth policy.
-   */
-  service_auth_401_redirect?: boolean;
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
 
-  /**
-   * Body param: The amount of time that tokens issued for this application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
-   */
-  session_duration?: string;
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
 
-  /**
-   * Body param: Enables automatic authentication through cloudflared.
-   */
-  skip_interstitial?: boolean;
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
 
-  /**
-   * Body param: The tags you want assigned to an application. Tags are used to
-   * filter applications in the App Launcher dashboard.
-   */
-  tags?: Array<string>;
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
 
-  /**
-   * Body param: The application type.
-   */
-  type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
-}
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+  }
 
-export namespace ApplicationUpdateParams {
-  export interface CorsHeaders {
+  export interface SaaSApplication {
     /**
-     * Allows all HTTP request headers.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    allow_all_headers?: boolean;
+    account_id?: string;
 
     /**
-     * Allows all HTTP request methods.
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    allow_all_methods?: boolean;
+    zone_id?: string;
 
     /**
-     * Allows all origins.
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    allow_all_origins?: boolean;
+    allowed_idps?: Array<string>;
 
     /**
-     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-     * client certificates) with requests.
+     * Body param: Displays the application in the App Launcher.
      */
-    allow_credentials?: boolean;
+    app_launcher_visible?: boolean;
 
     /**
-     * Allowed HTTP request headers.
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
      */
-    allowed_headers?: Array<unknown>;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * Allowed HTTP request methods.
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
      */
-    allowed_methods?: Array<
-      'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-    >;
+    custom_pages?: Array<string>;
 
     /**
-     * Allowed origins.
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
      */
-    allowed_origins?: Array<unknown>;
+    logo_url?: string;
 
     /**
-     * The maximum number of seconds the results of a preflight request can be cached.
+     * Body param: The name of the application.
      */
-    max_age?: number;
-  }
+    name?: string;
 
-  export interface AccessSamlSaasApp {
     /**
-     * Optional identifier indicating the authentication protocol used for the saas
-     * app. Required for OIDC. Default if unset is "saml"
+     * Body param:
      */
-    auth_type?: 'saml' | 'oidc';
+    saas_app?:
+      | ApplicationCreateParams.SaaSApplication.AccessSamlSaasApp
+      | ApplicationCreateParams.SaaSApplication.AccessOidcSaasApp;
 
     /**
-     * The service provider's endpoint that is responsible for receiving and parsing a
-     * SAML assertion.
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    consumer_service_url?: string;
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
+
+  export namespace SaaSApplication {
+    export interface AccessSamlSaasApp {
+      /**
+       * Optional identifier indicating the authentication protocol used for the saas
+       * app. Required for OIDC. Default if unset is "saml"
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The service provider's endpoint that is responsible for receiving and parsing a
+       * SAML assertion.
+       */
+      consumer_service_url?: string;
+
+      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+
+      /**
+       * The URL that the user will be redirected to after a successful login for IDP
+       * initiated logins.
+       */
+      default_relay_state?: string;
+
+      /**
+       * The unique identifier for your SaaS application.
+       */
+      idp_entity_id?: string;
+
+      /**
+       * The format of the name identifier sent to the SaaS application.
+       */
+      name_id_format?: 'id' | 'email';
+
+      /**
+       * A [JSONata](https://jsonata.org/) expression that transforms an application's
+       * user identities into a NameID value for its SAML assertion. This expression
+       * should evaluate to a singular string. The output of this expression can override
+       * the `name_id_format` setting.
+       */
+      name_id_transform_jsonata?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+       * user identities into attribute assertions in the SAML response. The expression
+       * can transform id, email, name, and groups values. It can also transform fields
+       * listed in the saml_attributes or oidc_fields of the identity provider used to
+       * authenticate. The output of this expression must be a JSON object.
+       */
+      saml_attribute_transform_jsonata?: string;
+
+      /**
+       * A globally unique name for an identity or service provider.
+       */
+      sp_entity_id?: string;
+
+      /**
+       * The endpoint where your SaaS application will send login requests.
+       */
+      sso_endpoint?: string;
+    }
+
+    export namespace AccessSamlSaasApp {
+      export interface CustomAttributes {
+        /**
+         * The name of the attribute.
+         */
+        name?: string;
+
+        /**
+         * A globally unique name for an identity or service provider.
+         */
+        name_format?:
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+
+        source?: CustomAttributes.Source;
+      }
+
+      export namespace CustomAttributes {
+        export interface Source {
+          /**
+           * The name of the IdP attribute.
+           */
+          name?: string;
+        }
+      }
+    }
+
+    export interface AccessOidcSaasApp {
+      /**
+       * The URL where this applications tile redirects users
+       */
+      app_launcher_url?: string;
+
+      /**
+       * Identifier of the authentication protocol used for the saas app. Required for
+       * OIDC.
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The application client id
+       */
+      client_id?: string;
+
+      /**
+       * The application client secret, only returned on POST request.
+       */
+      client_secret?: string;
+
+      /**
+       * The OIDC flows supported by this application
+       */
+      grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+
+      /**
+       * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+       */
+      group_filter_regex?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+       * tokens
+       */
+      redirect_uris?: Array<string>;
+
+      /**
+       * Define the user information shared with access
+       */
+      scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    }
+  }
+
+  export interface BrowserSSHApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: ApplicationCreateParams.BrowserSSHApplication.CorsHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<string>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export namespace BrowserSSHApplication {
+    export interface CorsHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
+
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
+
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
+
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+  }
+
+  export interface BrowserVncApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: ApplicationCreateParams.BrowserVncApplication.CorsHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<string>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export namespace BrowserVncApplication {
+    export interface CorsHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
+
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
+
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
+
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+  }
+
+  export interface AppLauncherApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface BrowserIsolationPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface BookmarkApplication {
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: The URL or domain of the bookmark.
+     */
+    domain?: string;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
+}
+
+export type ApplicationUpdateParams =
+  | ApplicationUpdateParams.SelfHostedApplication
+  | ApplicationUpdateParams.SaaSApplication
+  | ApplicationUpdateParams.BrowserSSHApplication
+  | ApplicationUpdateParams.BrowserVncApplication
+  | ApplicationUpdateParams.AppLauncherApplication
+  | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication
+  | ApplicationUpdateParams.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateParams.BookmarkApplication;
+
+export namespace ApplicationUpdateParams {
+  export interface SelfHostedApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: ApplicationUpdateParams.SelfHostedApplication.CorsHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<string>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export namespace SelfHostedApplication {
+    export interface CorsHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
+
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
+
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
+
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+  }
+
+  export interface SaaSApplication {
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param:
+     */
+    saas_app?:
+      | ApplicationUpdateParams.SaaSApplication.AccessSamlSaasApp
+      | ApplicationUpdateParams.SaaSApplication.AccessOidcSaasApp;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
+
+  export namespace SaaSApplication {
+    export interface AccessSamlSaasApp {
+      /**
+       * Optional identifier indicating the authentication protocol used for the saas
+       * app. Required for OIDC. Default if unset is "saml"
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The service provider's endpoint that is responsible for receiving and parsing a
+       * SAML assertion.
+       */
+      consumer_service_url?: string;
+
+      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+
+      /**
+       * The URL that the user will be redirected to after a successful login for IDP
+       * initiated logins.
+       */
+      default_relay_state?: string;
+
+      /**
+       * The unique identifier for your SaaS application.
+       */
+      idp_entity_id?: string;
+
+      /**
+       * The format of the name identifier sent to the SaaS application.
+       */
+      name_id_format?: 'id' | 'email';
+
+      /**
+       * A [JSONata](https://jsonata.org/) expression that transforms an application's
+       * user identities into a NameID value for its SAML assertion. This expression
+       * should evaluate to a singular string. The output of this expression can override
+       * the `name_id_format` setting.
+       */
+      name_id_transform_jsonata?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+       * user identities into attribute assertions in the SAML response. The expression
+       * can transform id, email, name, and groups values. It can also transform fields
+       * listed in the saml_attributes or oidc_fields of the identity provider used to
+       * authenticate. The output of this expression must be a JSON object.
+       */
+      saml_attribute_transform_jsonata?: string;
+
+      /**
+       * A globally unique name for an identity or service provider.
+       */
+      sp_entity_id?: string;
+
+      /**
+       * The endpoint where your SaaS application will send login requests.
+       */
+      sso_endpoint?: string;
+    }
+
+    export namespace AccessSamlSaasApp {
+      export interface CustomAttributes {
+        /**
+         * The name of the attribute.
+         */
+        name?: string;
+
+        /**
+         * A globally unique name for an identity or service provider.
+         */
+        name_format?:
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+
+        source?: CustomAttributes.Source;
+      }
+
+      export namespace CustomAttributes {
+        export interface Source {
+          /**
+           * The name of the IdP attribute.
+           */
+          name?: string;
+        }
+      }
+    }
+
+    export interface AccessOidcSaasApp {
+      /**
+       * The URL where this applications tile redirects users
+       */
+      app_launcher_url?: string;
+
+      /**
+       * Identifier of the authentication protocol used for the saas app. Required for
+       * OIDC.
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The application client id
+       */
+      client_id?: string;
+
+      /**
+       * The application client secret, only returned on POST request.
+       */
+      client_secret?: string;
+
+      /**
+       * The OIDC flows supported by this application
+       */
+      grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+
+      /**
+       * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+       */
+      group_filter_regex?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+       * tokens
+       */
+      redirect_uris?: Array<string>;
+
+      /**
+       * Define the user information shared with access
+       */
+      scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    }
+  }
+
+  export interface BrowserSSHApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: ApplicationUpdateParams.BrowserSSHApplication.CorsHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<string>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export namespace BrowserSSHApplication {
+    export interface CorsHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
+
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
+
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
+
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+  }
+
+  export interface BrowserVncApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: ApplicationUpdateParams.BrowserVncApplication.CorsHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
 
-    custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
 
     /**
-     * The URL that the user will be redirected to after a successful login for IDP
-     * initiated logins.
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
      */
-    default_relay_state?: string;
+    path_cookie_attribute?: boolean;
 
     /**
-     * The unique identifier for your SaaS application.
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
      */
-    idp_entity_id?: string;
+    same_site_cookie_attribute?: string;
 
     /**
-     * The format of the name identifier sent to the SaaS application.
+     * Body param: List of domains that Access will secure.
      */
-    name_id_format?: 'id' | 'email';
+    self_hosted_domains?: Array<string>;
 
     /**
-     * A [JSONata](https://jsonata.org/) expression that transforms an application's
-     * user identities into a NameID value for its SAML assertion. This expression
-     * should evaluate to a singular string. The output of this expression can override
-     * the `name_id_format` setting.
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
      */
-    name_id_transform_jsonata?: string;
+    service_auth_401_redirect?: boolean;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
      */
-    public_key?: string;
+    session_duration?: string;
 
     /**
-     * A globally unique name for an identity or service provider.
+     * Body param: Enables automatic authentication through cloudflared.
      */
-    sp_entity_id?: string;
+    skip_interstitial?: boolean;
 
     /**
-     * The endpoint where your SaaS application will send login requests.
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    sso_endpoint?: string;
+    tags?: Array<string>;
   }
 
-  export namespace AccessSamlSaasApp {
-    export interface CustomAttributes {
+  export namespace BrowserVncApplication {
+    export interface CorsHeaders {
       /**
-       * The name of the attribute.
+       * Allows all HTTP request headers.
        */
-      name?: string;
+      allow_all_headers?: boolean;
 
       /**
-       * A globally unique name for an identity or service provider.
+       * Allows all HTTP request methods.
        */
-      name_format?:
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+      allow_all_methods?: boolean;
 
-      source?: CustomAttributes.Source;
-    }
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
 
-    export namespace CustomAttributes {
-      export interface Source {
-        /**
-         * The name of the IdP attribute.
-         */
-        name?: string;
-      }
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<string>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<
+        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
+      >;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<string>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
     }
   }
 
-  export interface AccessOidcSaasApp {
+  export interface AppLauncherApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface BrowserIsolationPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<string>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
     /**
-     * The URL where this applications tile redirects users
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
      */
-    app_launcher_url?: string;
+    session_duration?: string;
+  }
 
+  export interface BookmarkApplication {
     /**
-     * Identifier of the authentication protocol used for the saas app. Required for
-     * OIDC.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    auth_type?: 'saml' | 'oidc';
+    account_id?: string;
 
     /**
-     * The application client id
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    client_id?: string;
+    zone_id?: string;
 
     /**
-     * The application client secret, only returned on POST request.
+     * Body param: Displays the application in the App Launcher.
      */
-    client_secret?: string;
+    app_launcher_visible?: boolean;
 
     /**
-     * The OIDC flows supported by this application
+     * Body param: The URL or domain of the bookmark.
      */
-    grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+    domain?: string;
 
     /**
-     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
      */
-    group_filter_regex?: string;
+    logo_url?: string;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The name of the application.
      */
-    public_key?: string;
+    name?: string;
 
     /**
-     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-     * tokens
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    redirect_uris?: Array<string>;
+    tags?: Array<string>;
 
     /**
-     * Define the user information shared with access
+     * Body param: The application type.
      */
-    scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    type?: string;
   }
 }
 
@@ -1927,10 +3188,10 @@ export interface ApplicationRevokeTokensParams {
 }
 
 export namespace Applications {
-  export import AccessApps = ApplicationsAPI.AccessApps;
-  export import ApplicationListResponse = ApplicationsAPI.ApplicationListResponse;
+  export import ZeroTrustApps = ApplicationsAPI.ZeroTrustApps;
   export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
   export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
+  export import ZeroTrustAppsSinglePage = ApplicationsAPI.ZeroTrustAppsSinglePage;
   export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
   export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
   export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -1938,11 +3199,11 @@ export namespace Applications {
   export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
   export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
   export import CAs = CAsAPI.CAs;
-  export import AccessCA = CAsAPI.AccessCA;
+  export import ZeroTrustCA = CAsAPI.ZeroTrustCA;
   export import CACreateResponse = CAsAPI.CACreateResponse;
-  export import CAListResponse = CAsAPI.CAListResponse;
   export import CADeleteResponse = CAsAPI.CADeleteResponse;
   export import CAGetResponse = CAsAPI.CAGetResponse;
+  export import ZeroTrustCAsSinglePage = CAsAPI.ZeroTrustCAsSinglePage;
   export import CACreateParams = CAsAPI.CACreateParams;
   export import CAListParams = CAsAPI.CAListParams;
   export import CADeleteParams = CAsAPI.CADeleteParams;
@@ -1951,9 +3212,9 @@ export namespace Applications {
   export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
   export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
   export import Policies = PoliciesAPI.Policies;
-  export import AccessPolicies = PoliciesAPI.AccessPolicies;
-  export import PolicyListResponse = PoliciesAPI.PolicyListResponse;
+  export import ZeroTrustPolicies = PoliciesAPI.ZeroTrustPolicies;
   export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
+  export import ZeroTrustPoliciesSinglePage = PoliciesAPI.ZeroTrustPoliciesSinglePage;
   export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
   export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
   export import PolicyListParams = PoliciesAPI.PolicyListParams;