cloudflare 3.0.0-beta.9 → 3.1.0

package/resources/zero-trust/access/applications/applications.d.ts

@@ -4,6 +4,7 @@ import * as ApplicationsAPI from 'cloudflare/resources/zero-trust/access/applica
 import * as CAsAPI from 'cloudflare/resources/zero-trust/access/applications/cas';
 import * as PoliciesAPI from 'cloudflare/resources/zero-trust/access/applications/policies';
 import * as UserPolicyChecksAPI from 'cloudflare/resources/zero-trust/access/applications/user-policy-checks';
+import { SinglePage } from 'cloudflare/pagination';
 export declare class Applications extends APIResource {
     cas: CAsAPI.CAs;
     userPolicyChecks: UserPolicyChecksAPI.UserPolicyChecks;
@@ -11,34 +12,47 @@ export declare class Applications extends APIResource {
     /**
      * Adds a new application to Access.
      */
-    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
+    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Updates an Access application.
      */
-    update(appId: string | string, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
+    update(appId: AppID, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Lists all Access applications in an account or zone.
      */
-    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationListResponse | null>;
-    list(options?: Core.RequestOptions): Core.APIPromise<ApplicationListResponse | null>;
+    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
+    list(options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
     /**
      * Deletes an application from Access.
      */
-    delete(appId: string | string, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
-    delete(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppID, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
     /**
      * Fetches information about an Access application.
      */
-    get(appId: string | string, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
-    get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
+    get(appId: AppID, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
+    get(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Revokes all tokens issued for an application.
      */
-    revokeTokens(appId: string | string, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
-    revokeTokens(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppID, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
 }
-export type AccessApps = AccessApps.SelfHostedApplication | AccessApps.SaaSApplication | AccessApps.BrowserSSHApplication | AccessApps.BrowserVncApplication | AccessApps.AppLauncherApplication | AccessApps.DeviceEnrollmentPermissionsApplication | AccessApps.BrowserIsolationPermissionsApplication | AccessApps.BookmarkApplication;
-export declare namespace AccessApps {
+export declare class ApplicationsSinglePage extends SinglePage<Application> {
+}
+export type AllowedHeadersh = string;
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdpsh = string;
+export type AllowedMethodsh = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH';
+export type AllowedOriginsh = string;
+/**
+ * Identifier
+ */
+export type AppID = string | string;
+export type Application = Application.SelfHostedApplication | Application.SaaSApplication | Application.BrowserSSHApplication | Application.BrowserVncApplication | Application.AppLauncherApplication | Application.DeviceEnrollmentPermissionsApplication | Application.BrowserIsolationPermissionsApplication | Application.BookmarkApplication;
+export declare namespace Application {
     interface SelfHostedApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -64,7 +78,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -78,7 +92,7 @@ export declare namespace AccessApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: SelfHostedApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -98,7 +112,7 @@ export declare namespace AccessApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -117,6 +131,11 @@ export declare namespace AccessApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -130,7 +149,7 @@ export declare namespace AccessApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -152,43 +171,6 @@ export declare namespace AccessApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<unknown>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<unknown>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * UUID
@@ -198,7 +180,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -216,7 +198,7 @@ export declare namespace AccessApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * The image URL for the logo shown in the App Launcher dashboard.
          */
@@ -225,7 +207,7 @@ export declare namespace AccessApps {
          * The name of the application.
          */
         name?: string;
-        saas_app?: SaaSApplication.AccessSamlSaasApp | SaaSApplication.AccessOidcSaasApp;
+        saas_app?: ApplicationsAPI.SAMLSaaSApp | SaaSApplication.AccessOIDCSaaSApp;
         /**
          * The tags you want assigned to an application. Tags are used to filter
          * applications in the App Launcher dashboard.
@@ -238,75 +220,7 @@ export declare namespace AccessApps {
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            created_at?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-            updated_at?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -325,6 +239,7 @@ export declare namespace AccessApps {
              */
             client_secret?: string;
             created_at?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -348,6 +263,35 @@ export declare namespace AccessApps {
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
             updated_at?: string;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -374,7 +318,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -388,7 +332,7 @@ export declare namespace AccessApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserSSHApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -408,7 +352,7 @@ export declare namespace AccessApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -427,6 +371,11 @@ export declare namespace AccessApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -440,7 +389,7 @@ export declare namespace AccessApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -462,43 +411,6 @@ export declare namespace AccessApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<unknown>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<unknown>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -524,7 +436,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -538,7 +450,7 @@ export declare namespace AccessApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserVncApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -558,7 +470,7 @@ export declare namespace AccessApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -577,6 +489,11 @@ export declare namespace AccessApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -590,7 +507,7 @@ export declare namespace AccessApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -612,43 +529,6 @@ export declare namespace AccessApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<unknown>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<unknown>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * The application type.
@@ -662,7 +542,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -703,7 +583,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -744,7 +624,7 @@ export declare namespace AccessApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -777,7 +657,10 @@ export declare namespace AccessApps {
          * UUID
          */
         id?: string;
-        app_launcher_visible?: unknown;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
         /**
          * Audience tag.
          */
@@ -786,7 +669,7 @@ export declare namespace AccessApps {
         /**
          * The URL or domain of the bookmark.
          */
-        domain?: unknown;
+        domain?: string;
         /**
          * The image URL for the logo shown in the App Launcher dashboard.
          */
@@ -807,540 +690,1412 @@ export declare namespace AccessApps {
         updated_at?: string;
     }
 }
-export type ApplicationListResponse = Array<AccessApps>;
-export interface ApplicationDeleteResponse {
-    /**
-     * UUID
-     */
-    id?: string;
-}
-export type ApplicationRevokeTokensResponse = unknown;
-export interface ApplicationCreateParams {
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: When set to true, users can authenticate to this application using
-     * their WARP session. When set to false this application will always require
-     * direct IdP authentication. This setting always overrides the organization
-     * setting for WARP authentication.
-     */
-    allow_authenticate_via_warp?: boolean;
-    /**
-     * Body param: The identity providers your users can select when connecting to this
-     * application. Defaults to all IdPs configured in your account.
-     */
-    allowed_idps?: Array<string>;
-    /**
-     * Body param:
-     */
-    app_launcher_visible?: unknown;
+export interface CORSHeaders {
     /**
-     * Body param: When set to `true`, users skip the identity provider selection step
-     * during login. You must specify only one identity provider in allowed_idps.
+     * Allows all HTTP request headers.
      */
-    auto_redirect_to_identity?: boolean;
+    allow_all_headers?: boolean;
     /**
-     * Body param:
+     * Allows all HTTP request methods.
      */
-    cors_headers?: ApplicationCreateParams.CorsHeaders;
+    allow_all_methods?: boolean;
     /**
-     * Body param: The custom error message shown to a user when they are denied access
-     * to the application.
+     * Allows all origins.
      */
-    custom_deny_message?: string;
+    allow_all_origins?: boolean;
     /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing identity-based rules.
+     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+     * client certificates) with requests.
      */
-    custom_deny_url?: string;
+    allow_credentials?: boolean;
     /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing non-identity rules.
+     * Allowed HTTP request headers.
      */
-    custom_non_identity_deny_url?: string;
+    allowed_headers?: Array<AllowedHeadersh>;
     /**
-     * Body param: The custom pages that will be displayed when applicable for this
-     * application
+     * Allowed HTTP request methods.
      */
-    custom_pages?: Array<string>;
+    allowed_methods?: Array<AllowedMethodsh>;
     /**
-     * Body param: The URL or domain of the bookmark.
+     * Allowed origins.
      */
-    domain?: unknown;
+    allowed_origins?: Array<AllowedOriginsh>;
     /**
-     * Body param: Enables the binding cookie, which increases security against
-     * compromised authorization tokens and CSRF attacks.
+     * The maximum number of seconds the results of a preflight request can be cached.
      */
-    enable_binding_cookie?: boolean;
-    /**
-     * Body param: Enables the HttpOnly cookie attribute, which increases security
-     * against XSS attacks.
+    max_age?: number;
+}
+/**
+ * The custom pages selected for application.
+ */
+export type CustomPagesh = string;
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormat = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormat = 'id' | 'email';
+export interface SaaSAppSource {
+    /**
+     * The name of the IdP attribute.
      */
-    http_only_cookie_attribute?: boolean;
+    name?: string;
     /**
-     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     * A mapping from IdP ID to attribute name.
      */
-    logo_url?: string;
+    name_by_idp?: Record<string, string>;
+}
+export interface SAMLSaaSApp {
     /**
-     * Body param: The name of the application.
+     * Optional identifier indicating the authentication protocol used for the saas
+     * app. Required for OIDC. Default if unset is "saml"
      */
-    name?: string;
+    auth_type?: 'saml' | 'oidc';
     /**
-     * Body param: Enables cookie paths to scope an application's JWT to the
-     * application path. If disabled, the JWT will scope to the hostname by default
+     * The service provider's endpoint that is responsible for receiving and parsing a
+     * SAML assertion.
      */
-    path_cookie_attribute?: boolean;
+    consumer_service_url?: string;
+    created_at?: string;
+    custom_attributes?: SAMLSaaSApp.CustomAttributes;
     /**
-     * Body param:
+     * The URL that the user will be redirected to after a successful login for IDP
+     * initiated logins.
      */
-    saas_app?: ApplicationCreateParams.AccessSamlSaasApp | ApplicationCreateParams.AccessOidcSaasApp;
+    default_relay_state?: string;
     /**
-     * Body param: Sets the SameSite cookie setting, which provides increased security
-     * against CSRF attacks.
+     * The unique identifier for your SaaS application.
      */
-    same_site_cookie_attribute?: string;
+    idp_entity_id?: string;
     /**
-     * Body param: List of domains that Access will secure.
+     * The format of the name identifier sent to the SaaS application.
      */
-    self_hosted_domains?: Array<string>;
+    name_id_format?: SaaSAppNameIDFormat;
     /**
-     * Body param: Returns a 401 status code when the request is blocked by a Service
-     * Auth policy.
+     * A [JSONata](https://jsonata.org/) expression that transforms an application's
+     * user identities into a NameID value for its SAML assertion. This expression
+     * should evaluate to a singular string. The output of this expression can override
+     * the `name_id_format` setting.
      */
-    service_auth_401_redirect?: boolean;
+    name_id_transform_jsonata?: string;
     /**
-     * Body param: The amount of time that tokens issued for this application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * The Access public certificate that will be used to verify your identity.
      */
-    session_duration?: string;
+    public_key?: string;
     /**
-     * Body param: Enables automatic authentication through cloudflared.
+     * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+     * user identities into attribute assertions in the SAML response. The expression
+     * can transform id, email, name, and groups values. It can also transform fields
+     * listed in the saml_attributes or oidc_fields of the identity provider used to
+     * authenticate. The output of this expression must be a JSON object.
      */
-    skip_interstitial?: boolean;
+    saml_attribute_transform_jsonata?: string;
     /**
-     * Body param: The tags you want assigned to an application. Tags are used to
-     * filter applications in the App Launcher dashboard.
+     * A globally unique name for an identity or service provider.
      */
-    tags?: Array<string>;
+    sp_entity_id?: string;
     /**
-     * Body param: The application type.
+     * The endpoint where your SaaS application will send login requests.
      */
-    type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    sso_endpoint?: string;
+    updated_at?: string;
 }
-export declare namespace ApplicationCreateParams {
-    interface CorsHeaders {
+export declare namespace SAMLSaaSApp {
+    interface CustomAttributes {
         /**
-         * Allows all HTTP request headers.
+         * The SAML FriendlyName of the attribute.
          */
-        allow_all_headers?: boolean;
+        friendly_name?: string;
         /**
-         * Allows all HTTP request methods.
+         * The name of the attribute.
          */
-        allow_all_methods?: boolean;
+        name?: string;
         /**
-         * Allows all origins.
+         * A globally unique name for an identity or service provider.
          */
-        allow_all_origins?: boolean;
+        name_format?: ApplicationsAPI.SaaSAppNameFormat;
         /**
-         * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-         * client certificates) with requests.
+         * If the attribute is required when building a SAML assertion.
          */
-        allow_credentials?: boolean;
+        required?: boolean;
+        source?: ApplicationsAPI.SaaSAppSource;
+    }
+}
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomainsh = string;
+export interface ApplicationDeleteResponse {
+    /**
+     * UUID
+     */
+    id?: string;
+}
+export type ApplicationRevokeTokensResponse = unknown;
+export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVncApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.BookmarkApplication;
+export declare namespace ApplicationCreateParams {
+    interface SelfHostedApplication {
         /**
-         * Allowed HTTP request headers.
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
          */
-        allowed_headers?: Array<unknown>;
+        domain: string;
         /**
-         * Allowed HTTP request methods.
+         * Body param: The application type.
          */
-        allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+        type: string;
         /**
-         * Allowed origins.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        allowed_origins?: Array<unknown>;
+        account_id?: string;
         /**
-         * The maximum number of seconds the results of a preflight request can be cached.
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        max_age?: number;
-    }
-    interface AccessSamlSaasApp {
+        zone_id?: string;
         /**
-         * Optional identifier indicating the authentication protocol used for the saas
-         * app. Required for OIDC. Default if unset is "saml"
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
          */
-        auth_type?: 'saml' | 'oidc';
+        allow_authenticate_via_warp?: boolean;
         /**
-         * The service provider's endpoint that is responsible for receiving and parsing a
-         * SAML assertion.
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        consumer_service_url?: string;
-        custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
-         * The URL that the user will be redirected to after a successful login for IDP
-         * initiated logins.
+         * Body param: Displays the application in the App Launcher.
          */
-        default_relay_state?: string;
+        app_launcher_visible?: boolean;
         /**
-         * The unique identifier for your SaaS application.
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
          */
-        idp_entity_id?: string;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The format of the name identifier sent to the SaaS application.
+         * Body param:
          */
-        name_id_format?: 'id' | 'email';
+        cors_headers?: CORSHeaders;
         /**
-         * A [JSONata](https://jsonata.org/) expression that transforms an application's
-         * user identities into a NameID value for its SAML assertion. This expression
-         * should evaluate to a singular string. The output of this expression can override
-         * the `name_id_format` setting.
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
          */
-        name_id_transform_jsonata?: string;
+        custom_deny_message?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
          */
-        public_key?: string;
+        custom_deny_url?: string;
         /**
-         * A globally unique name for an identity or service provider.
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
          */
-        sp_entity_id?: string;
+        custom_non_identity_deny_url?: string;
         /**
-         * The endpoint where your SaaS application will send login requests.
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
          */
-        sso_endpoint?: string;
-    }
-    namespace AccessSamlSaasApp {
-        interface CustomAttributes {
-            /**
-             * The name of the attribute.
-             */
-            name?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-            source?: CustomAttributes.Source;
-        }
-        namespace CustomAttributes {
-            interface Source {
-                /**
-                 * The name of the IdP attribute.
-                 */
-                name?: string;
-            }
-        }
-    }
-    interface AccessOidcSaasApp {
+        custom_pages?: Array<CustomPagesh>;
         /**
-         * The URL where this applications tile redirects users
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
          */
-        app_launcher_url?: string;
+        enable_binding_cookie?: boolean;
         /**
-         * Identifier of the authentication protocol used for the saas app. Required for
-         * OIDC.
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
          */
-        auth_type?: 'saml' | 'oidc';
+        http_only_cookie_attribute?: boolean;
         /**
-         * The application client id
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        client_id?: string;
+        logo_url?: string;
         /**
-         * The application client secret, only returned on POST request.
+         * Body param: The name of the application.
          */
-        client_secret?: string;
+        name?: string;
         /**
-         * The OIDC flows supported by this application
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
          */
-        grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+        options_preflight_bypass?: boolean;
         /**
-         * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
          */
-        group_filter_regex?: string;
+        path_cookie_attribute?: boolean;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
          */
-        public_key?: string;
+        same_site_cookie_attribute?: string;
         /**
-         * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-         * tokens
+         * Body param: List of domains that Access will secure.
          */
-        redirect_uris?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
-         * Define the user information shared with access
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
          */
-        scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
-    }
-}
-export interface ApplicationUpdateParams {
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: When set to true, users can authenticate to this application using
-     * their WARP session. When set to false this application will always require
-     * direct IdP authentication. This setting always overrides the organization
-     * setting for WARP authentication.
-     */
-    allow_authenticate_via_warp?: boolean;
-    /**
-     * Body param: The identity providers your users can select when connecting to this
-     * application. Defaults to all IdPs configured in your account.
-     */
-    allowed_idps?: Array<string>;
-    /**
-     * Body param:
-     */
-    app_launcher_visible?: unknown;
-    /**
-     * Body param: When set to `true`, users skip the identity provider selection step
-     * during login. You must specify only one identity provider in allowed_idps.
-     */
-    auto_redirect_to_identity?: boolean;
-    /**
-     * Body param:
-     */
-    cors_headers?: ApplicationUpdateParams.CorsHeaders;
-    /**
-     * Body param: The custom error message shown to a user when they are denied access
-     * to the application.
-     */
-    custom_deny_message?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing identity-based rules.
-     */
-    custom_deny_url?: string;
-    /**
-     * Body param: The custom URL a user is redirected to when they are denied access
-     * to the application when failing non-identity rules.
-     */
-    custom_non_identity_deny_url?: string;
-    /**
-     * Body param: The custom pages that will be displayed when applicable for this
-     * application
-     */
-    custom_pages?: Array<string>;
-    /**
-     * Body param: The URL or domain of the bookmark.
-     */
-    domain?: unknown;
-    /**
-     * Body param: Enables the binding cookie, which increases security against
-     * compromised authorization tokens and CSRF attacks.
-     */
-    enable_binding_cookie?: boolean;
-    /**
-     * Body param: Enables the HttpOnly cookie attribute, which increases security
-     * against XSS attacks.
-     */
-    http_only_cookie_attribute?: boolean;
-    /**
-     * Body param: The image URL for the logo shown in the App Launcher dashboard.
-     */
-    logo_url?: string;
-    /**
-     * Body param: The name of the application.
-     */
-    name?: string;
-    /**
-     * Body param: Enables cookie paths to scope an application's JWT to the
-     * application path. If disabled, the JWT will scope to the hostname by default
-     */
-    path_cookie_attribute?: boolean;
-    /**
-     * Body param:
-     */
-    saas_app?: ApplicationUpdateParams.AccessSamlSaasApp | ApplicationUpdateParams.AccessOidcSaasApp;
-    /**
-     * Body param: Sets the SameSite cookie setting, which provides increased security
-     * against CSRF attacks.
-     */
-    same_site_cookie_attribute?: string;
-    /**
-     * Body param: List of domains that Access will secure.
-     */
-    self_hosted_domains?: Array<string>;
-    /**
-     * Body param: Returns a 401 status code when the request is blocked by a Service
-     * Auth policy.
-     */
-    service_auth_401_redirect?: boolean;
-    /**
-     * Body param: The amount of time that tokens issued for this application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
-     */
-    session_duration?: string;
-    /**
-     * Body param: Enables automatic authentication through cloudflared.
-     */
-    skip_interstitial?: boolean;
-    /**
-     * Body param: The tags you want assigned to an application. Tags are used to
-     * filter applications in the App Launcher dashboard.
-     */
-    tags?: Array<string>;
-    /**
-     * Body param: The application type.
-     */
-    type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
-}
-export declare namespace ApplicationUpdateParams {
-    interface CorsHeaders {
+        service_auth_401_redirect?: boolean;
         /**
-         * Allows all HTTP request headers.
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
          */
-        allow_all_headers?: boolean;
+        session_duration?: string;
         /**
-         * Allows all HTTP request methods.
+         * Body param: Enables automatic authentication through cloudflared.
          */
-        allow_all_methods?: boolean;
+        skip_interstitial?: boolean;
         /**
-         * Allows all origins.
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        allow_all_origins?: boolean;
+        tags?: Array<string>;
+    }
+    interface SaaSApplication {
         /**
-         * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-         * client certificates) with requests.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        allow_credentials?: boolean;
+        account_id?: string;
         /**
-         * Allowed HTTP request headers.
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        allowed_headers?: Array<unknown>;
+        zone_id?: string;
         /**
-         * Allowed HTTP request methods.
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
-         * Allowed origins.
+         * Body param: Displays the application in the App Launcher.
          */
-        allowed_origins?: Array<unknown>;
+        app_launcher_visible?: boolean;
         /**
-         * The maximum number of seconds the results of a preflight request can be cached.
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
          */
-        max_age?: number;
-    }
-    interface AccessSamlSaasApp {
+        auto_redirect_to_identity?: boolean;
         /**
-         * Optional identifier indicating the authentication protocol used for the saas
-         * app. Required for OIDC. Default if unset is "saml"
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
          */
-        auth_type?: 'saml' | 'oidc';
+        custom_pages?: Array<CustomPagesh>;
         /**
-         * The service provider's endpoint that is responsible for receiving and parsing a
-         * SAML assertion.
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        consumer_service_url?: string;
-        custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+        logo_url?: string;
         /**
-         * The URL that the user will be redirected to after a successful login for IDP
-         * initiated logins.
+         * Body param: The name of the application.
          */
-        default_relay_state?: string;
+        name?: string;
         /**
-         * The unique identifier for your SaaS application.
+         * Body param:
          */
-        idp_entity_id?: string;
+        saas_app?: SAMLSaaSApp | ApplicationCreateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
-         * The format of the name identifier sent to the SaaS application.
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        name_id_format?: 'id' | 'email';
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
+    }
+    namespace SaaSApplication {
+        interface AccessOIDCSaaSApp {
+            /**
+             * The URL where this applications tile redirects users
+             */
+            app_launcher_url?: string;
+            /**
+             * Identifier of the authentication protocol used for the saas app. Required for
+             * OIDC.
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The application client id
+             */
+            client_id?: string;
+            /**
+             * The application client secret, only returned on POST request.
+             */
+            client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+            /**
+             * The OIDC flows supported by this application
+             */
+            grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+            /**
+             * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+             */
+            group_filter_regex?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
+            /**
+             * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+             * tokens
+             */
+            redirect_uris?: Array<string>;
+            /**
+             * Define the user information shared with access
+             */
+            scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
+    }
+    interface BrowserSSHApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: CORSHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    interface BrowserVncApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: CORSHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    interface AppLauncherApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface DeviceEnrollmentPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BrowserIsolationPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BookmarkApplication {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
+    }
+}
+export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVncApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.BookmarkApplication;
+export declare namespace ApplicationUpdateParams {
+    interface SelfHostedApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: CORSHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    interface SaaSApplication {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
         /**
-         * A [JSONata](https://jsonata.org/) expression that transforms an application's
-         * user identities into a NameID value for its SAML assertion. This expression
-         * should evaluate to a singular string. The output of this expression can override
-         * the `name_id_format` setting.
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        name_id_transform_jsonata?: string;
+        logo_url?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: The name of the application.
          */
-        public_key?: string;
+        name?: string;
         /**
-         * A globally unique name for an identity or service provider.
+         * Body param:
          */
-        sp_entity_id?: string;
+        saas_app?: SAMLSaaSApp | ApplicationUpdateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
-         * The endpoint where your SaaS application will send login requests.
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        sso_endpoint?: string;
+        tags?: Array<string>;
+        /**
+         * Body param: The application type.
+         */
+        type?: string;
     }
-    namespace AccessSamlSaasApp {
-        interface CustomAttributes {
+    namespace SaaSApplication {
+        interface AccessOIDCSaaSApp {
+            /**
+             * The URL where this applications tile redirects users
+             */
+            app_launcher_url?: string;
+            /**
+             * Identifier of the authentication protocol used for the saas app. Required for
+             * OIDC.
+             */
+            auth_type?: 'saml' | 'oidc';
+            /**
+             * The application client id
+             */
+            client_id?: string;
+            /**
+             * The application client secret, only returned on POST request.
+             */
+            client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+            /**
+             * The OIDC flows supported by this application
+             */
+            grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+            /**
+             * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+             */
+            group_filter_regex?: string;
+            /**
+             * The Access public certificate that will be used to verify your identity.
+             */
+            public_key?: string;
             /**
-             * The name of the attribute.
+             * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+             * tokens
              */
-            name?: string;
+            redirect_uris?: Array<string>;
             /**
-             * A globally unique name for an identity or service provider.
+             * Define the user information shared with access
              */
-            name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-            source?: CustomAttributes.Source;
+            scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
         }
-        namespace CustomAttributes {
-            interface Source {
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
                 /**
-                 * The name of the IdP attribute.
+                 * The name of the claim.
                  */
                 name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
             }
         }
     }
-    interface AccessOidcSaasApp {
+    interface BrowserSSHApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: CORSHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    interface BrowserVncApplication {
+        /**
+         * Body param: The primary hostname and path that Access will secure. If the app is
+         * visible in the App Launcher dashboard, this is the domain that will be
+         * displayed.
+         */
+        domain: string;
+        /**
+         * Body param: The application type.
+         */
+        type: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: When set to true, users can authenticate to this application using
+         * their WARP session. When set to false this application will always require
+         * direct IdP authentication. This setting always overrides the organization
+         * setting for WARP authentication.
+         */
+        allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param:
+         */
+        cors_headers?: CORSHeaders;
+        /**
+         * Body param: The custom error message shown to a user when they are denied access
+         * to the application.
+         */
+        custom_deny_message?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<CustomPagesh>;
+        /**
+         * Body param: Enables the binding cookie, which increases security against
+         * compromised authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Body param: Enables the HttpOnly cookie attribute, which increases security
+         * against XSS attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
+        /**
+         * Body param: Enables cookie paths to scope an application's JWT to the
+         * application path. If disabled, the JWT will scope to the hostname by default
+         */
+        path_cookie_attribute?: boolean;
+        /**
+         * Body param: Sets the SameSite cookie setting, which provides increased security
+         * against CSRF attacks.
+         */
+        same_site_cookie_attribute?: string;
+        /**
+         * Body param: List of domains that Access will secure.
+         */
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
+        /**
+         * Body param: Returns a 401 status code when the request is blocked by a Service
+         * Auth policy.
+         */
+        service_auth_401_redirect?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Enables automatic authentication through cloudflared.
+         */
+        skip_interstitial?: boolean;
+        /**
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+    }
+    interface AppLauncherApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface DeviceEnrollmentPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BrowserIsolationPermissionsApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
-         * The URL where this applications tile redirects users
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
          */
-        app_launcher_url?: string;
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
+         */
+        session_duration?: string;
+    }
+    interface BookmarkApplication {
         /**
-         * Identifier of the authentication protocol used for the saas app. Required for
-         * OIDC.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        auth_type?: 'saml' | 'oidc';
+        account_id?: string;
         /**
-         * The application client id
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        client_id?: string;
+        zone_id?: string;
         /**
-         * The application client secret, only returned on POST request.
+         * Body param: Displays the application in the App Launcher.
          */
-        client_secret?: string;
+        app_launcher_visible?: boolean;
         /**
-         * The OIDC flows supported by this application
+         * Body param: The URL or domain of the bookmark.
          */
-        grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+        domain?: string;
         /**
-         * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+         * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
-        group_filter_regex?: string;
+        logo_url?: string;
         /**
-         * The Access public certificate that will be used to verify your identity.
+         * Body param: The name of the application.
          */
-        public_key?: string;
+        name?: string;
         /**
-         * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-         * tokens
+         * Body param: The tags you want assigned to an application. Tags are used to
+         * filter applications in the App Launcher dashboard.
          */
-        redirect_uris?: Array<string>;
+        tags?: Array<string>;
         /**
-         * Define the user information shared with access
+         * Body param: The application type.
          */
-        scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+        type?: string;
     }
 }
 export interface ApplicationListParams {
@@ -1384,10 +2139,22 @@ export interface ApplicationRevokeTokensParams {
     zone_id?: string;
 }
 export declare namespace Applications {
-    export import AccessApps = ApplicationsAPI.AccessApps;
-    export import ApplicationListResponse = ApplicationsAPI.ApplicationListResponse;
+    export import AllowedHeadersh = ApplicationsAPI.AllowedHeadersh;
+    export import AllowedIdpsh = ApplicationsAPI.AllowedIdpsh;
+    export import AllowedMethodsh = ApplicationsAPI.AllowedMethodsh;
+    export import AllowedOriginsh = ApplicationsAPI.AllowedOriginsh;
+    export import AppID = ApplicationsAPI.AppID;
+    export import Application = ApplicationsAPI.Application;
+    export import CORSHeaders = ApplicationsAPI.CORSHeaders;
+    export import CustomPagesh = ApplicationsAPI.CustomPagesh;
+    export import SaaSAppNameFormat = ApplicationsAPI.SaaSAppNameFormat;
+    export import SaaSAppNameIDFormat = ApplicationsAPI.SaaSAppNameIDFormat;
+    export import SaaSAppSource = ApplicationsAPI.SaaSAppSource;
+    export import SAMLSaaSApp = ApplicationsAPI.SAMLSaaSApp;
+    export import SelfHostedDomainsh = ApplicationsAPI.SelfHostedDomainsh;
     export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
     export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
+    export import ApplicationsSinglePage = ApplicationsAPI.ApplicationsSinglePage;
     export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
     export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
     export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -1395,22 +2162,24 @@ export declare namespace Applications {
     export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
     export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
     export import CAs = CAsAPI.CAs;
-    export import AccessCA = CAsAPI.AccessCA;
+    export import CA = CAsAPI.CA;
     export import CACreateResponse = CAsAPI.CACreateResponse;
-    export import CAListResponse = CAsAPI.CAListResponse;
     export import CADeleteResponse = CAsAPI.CADeleteResponse;
     export import CAGetResponse = CAsAPI.CAGetResponse;
+    export import CAsSinglePage = CAsAPI.CAsSinglePage;
     export import CACreateParams = CAsAPI.CACreateParams;
     export import CAListParams = CAsAPI.CAListParams;
     export import CADeleteParams = CAsAPI.CADeleteParams;
     export import CAGetParams = CAsAPI.CAGetParams;
     export import UserPolicyChecks = UserPolicyChecksAPI.UserPolicyChecks;
+    export import UserPolicyCheckGeo = UserPolicyChecksAPI.UserPolicyCheckGeo;
     export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
     export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
     export import Policies = PoliciesAPI.Policies;
-    export import AccessPolicies = PoliciesAPI.AccessPolicies;
-    export import PolicyListResponse = PoliciesAPI.PolicyListResponse;
+    export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+    export import Policy = PoliciesAPI.Policy;
     export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
+    export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
     export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
     export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
     export import PolicyListParams = PoliciesAPI.PolicyListParams;