cloudflare 3.0.0-beta.9 → 3.1.0

package/src/resources/zero-trust/access/applications/applications.ts

@@ -8,6 +8,7 @@ import * as ApplicationsAPI from "./applications";
 import * as CAsAPI from "./cas";
 import * as PoliciesAPI from "./policies";
 import * as UserPolicyChecksAPI from "./user-policy-checks";
+import { SinglePage } from "../../../../pagination";
 
 export class Applications extends APIResource {
   cas: CAsAPI.CAs = new CAsAPI.CAs(this._client);
@@ -19,7 +20,7 @@ export class Applications extends APIResource {
   /**
    * Adds a new application to Access.
    */
-  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessApps> {
+  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<Application> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -41,7 +42,7 @@ export class Applications extends APIResource {
       this._client.post(`/${accountOrZone}/${accountOrZoneId}/access/apps`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessApps }>
+      }) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -49,10 +50,10 @@ export class Applications extends APIResource {
    * Updates an Access application.
    */
   update(
-    appId: string | string,
+    appId: AppID,
     params: ApplicationUpdateParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps> {
+  ): Core.APIPromise<Application> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -74,7 +75,7 @@ export class Applications extends APIResource {
       this._client.put(`/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessApps }>
+      }) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -84,12 +85,12 @@ export class Applications extends APIResource {
   list(
     params?: ApplicationListParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ApplicationListResponse | null>;
-  list(options?: Core.RequestOptions): Core.APIPromise<ApplicationListResponse | null>;
+  ): Core.PagePromise<ApplicationsSinglePage, Application>;
+  list(options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
   list(
     params: ApplicationListParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ApplicationListResponse | null> {
+  ): Core.PagePromise<ApplicationsSinglePage, Application> {
     if (isRequestOptions(params)) {
       return this.list({}, params);
     }
@@ -110,24 +111,24 @@ export class Applications extends APIResource {
           accountOrZone: 'zones',
           accountOrZoneId: zone_id,
         };
-    return (
-      this._client.get(`/${accountOrZone}/${accountOrZoneId}/access/apps`, options) as Core.APIPromise<{
-        result: ApplicationListResponse | null;
-      }>
-    )._thenUnwrap((obj) => obj.result);
+    return this._client.getAPIList(
+      `/${accountOrZone}/${accountOrZoneId}/access/apps`,
+      ApplicationsSinglePage,
+      options,
+    );
   }
 
   /**
    * Deletes an application from Access.
    */
   delete(
-    appId: string | string,
+    appId: AppID,
     params?: ApplicationDeleteParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationDeleteResponse>;
-  delete(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+  delete(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
   delete(
-    appId: string | string,
+    appId: AppID,
     params: ApplicationDeleteParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationDeleteResponse> {
@@ -163,16 +164,16 @@ export class Applications extends APIResource {
    * Fetches information about an Access application.
    */
   get(
-    appId: string | string,
+    appId: AppID,
     params?: ApplicationGetParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps>;
-  get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<AccessApps>;
+  ): Core.APIPromise<Application>;
+  get(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<Application>;
   get(
-    appId: string | string,
+    appId: AppID,
     params: ApplicationGetParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessApps> {
+  ): Core.APIPromise<Application> {
     if (isRequestOptions(params)) {
       return this.get(appId, {}, params);
     }
@@ -197,7 +198,7 @@ export class Applications extends APIResource {
       this._client.get(
         `/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`,
         options,
-      ) as Core.APIPromise<{ result: AccessApps }>
+      ) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -205,16 +206,16 @@ export class Applications extends APIResource {
    * Revokes all tokens issued for an application.
    */
   revokeTokens(
-    appId: string | string,
+    appId: AppID,
     params?: ApplicationRevokeTokensParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
   revokeTokens(
-    appId: string | string,
+    appId: AppID,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
   revokeTokens(
-    appId: string | string,
+    appId: AppID,
     params: ApplicationRevokeTokensParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null> {
@@ -247,17 +248,44 @@ export class Applications extends APIResource {
   }
 }
 
-export type AccessApps =
-  | AccessApps.SelfHostedApplication
-  | AccessApps.SaaSApplication
-  | AccessApps.BrowserSSHApplication
-  | AccessApps.BrowserVncApplication
-  | AccessApps.AppLauncherApplication
-  | AccessApps.DeviceEnrollmentPermissionsApplication
-  | AccessApps.BrowserIsolationPermissionsApplication
-  | AccessApps.BookmarkApplication;
-
-export namespace AccessApps {
+export class ApplicationsSinglePage extends SinglePage<Application> {}
+
+export type AllowedHeadersh = string;
+
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdpsh = string;
+
+export type AllowedMethodsh =
+  | 'GET'
+  | 'POST'
+  | 'HEAD'
+  | 'PUT'
+  | 'DELETE'
+  | 'CONNECT'
+  | 'OPTIONS'
+  | 'TRACE'
+  | 'PATCH';
+
+export type AllowedOriginsh = string;
+
+/**
+ * Identifier
+ */
+export type AppID = string | string;
+
+export type Application =
+  | Application.SelfHostedApplication
+  | Application.SaaSApplication
+  | Application.BrowserSSHApplication
+  | Application.BrowserVncApplication
+  | Application.AppLauncherApplication
+  | Application.DeviceEnrollmentPermissionsApplication
+  | Application.BrowserIsolationPermissionsApplication
+  | Application.BookmarkApplication;
+
+export namespace Application {
   export interface SelfHostedApplication {
     /**
      * The primary hostname and path that Access will secure. If the app is visible in
@@ -287,7 +315,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Displays the application in the App Launcher.
@@ -305,7 +333,7 @@ export namespace AccessApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: SelfHostedApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -330,7 +358,7 @@ export namespace AccessApps {
     /**
      * The custom pages that will be displayed when applicable for this application
      */
-    custom_pages?: Array<string>;
+    custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -354,6 +382,12 @@ export namespace AccessApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -369,7 +403,7 @@ export namespace AccessApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -397,53 +431,6 @@ export namespace AccessApps {
     updated_at?: string;
   }
 
-  export namespace SelfHostedApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<unknown>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<unknown>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface SaaSApplication {
     /**
      * UUID
@@ -454,7 +441,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Displays the application in the App Launcher.
@@ -477,7 +464,7 @@ export namespace AccessApps {
     /**
      * The custom pages that will be displayed when applicable for this application
      */
-    custom_pages?: Array<string>;
+    custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
 
     /**
      * The image URL for the logo shown in the App Launcher dashboard.
@@ -489,7 +476,7 @@ export namespace AccessApps {
      */
     name?: string;
 
-    saas_app?: SaaSApplication.AccessSamlSaasApp | SaaSApplication.AccessOidcSaasApp;
+    saas_app?: ApplicationsAPI.SAMLSaaSApp | SaaSApplication.AccessOIDCSaaSApp;
 
     /**
      * The tags you want assigned to an application. Tags are used to filter
@@ -506,94 +493,7 @@ export namespace AccessApps {
   }
 
   export namespace SaaSApplication {
-    export interface AccessSamlSaasApp {
-      /**
-       * Optional identifier indicating the authentication protocol used for the saas
-       * app. Required for OIDC. Default if unset is "saml"
-       */
-      auth_type?: 'saml' | 'oidc';
-
-      /**
-       * The service provider's endpoint that is responsible for receiving and parsing a
-       * SAML assertion.
-       */
-      consumer_service_url?: string;
-
-      created_at?: string;
-
-      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-
-      /**
-       * The URL that the user will be redirected to after a successful login for IDP
-       * initiated logins.
-       */
-      default_relay_state?: string;
-
-      /**
-       * The unique identifier for your SaaS application.
-       */
-      idp_entity_id?: string;
-
-      /**
-       * The format of the name identifier sent to the SaaS application.
-       */
-      name_id_format?: 'id' | 'email';
-
-      /**
-       * A [JSONata](https://jsonata.org/) expression that transforms an application's
-       * user identities into a NameID value for its SAML assertion. This expression
-       * should evaluate to a singular string. The output of this expression can override
-       * the `name_id_format` setting.
-       */
-      name_id_transform_jsonata?: string;
-
-      /**
-       * The Access public certificate that will be used to verify your identity.
-       */
-      public_key?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      sp_entity_id?: string;
-
-      /**
-       * The endpoint where your SaaS application will send login requests.
-       */
-      sso_endpoint?: string;
-
-      updated_at?: string;
-    }
-
-    export namespace AccessSamlSaasApp {
-      export interface CustomAttributes {
-        /**
-         * The name of the attribute.
-         */
-        name?: string;
-
-        /**
-         * A globally unique name for an identity or service provider.
-         */
-        name_format?:
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-
-        source?: CustomAttributes.Source;
-      }
-
-      export namespace CustomAttributes {
-        export interface Source {
-          /**
-           * The name of the IdP attribute.
-           */
-          name?: string;
-        }
-      }
-    }
-
-    export interface AccessOidcSaasApp {
+    export interface AccessOIDCSaaSApp {
       /**
        * The URL where this applications tile redirects users
        */
@@ -617,6 +517,8 @@ export namespace AccessApps {
 
       created_at?: string;
 
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
       /**
        * The OIDC flows supported by this application
        */
@@ -645,6 +547,41 @@ export namespace AccessApps {
 
       updated_at?: string;
     }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
   }
 
   export interface BrowserSSHApplication {
@@ -676,7 +613,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Displays the application in the App Launcher.
@@ -694,7 +631,7 @@ export namespace AccessApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: BrowserSSHApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -719,7 +656,7 @@ export namespace AccessApps {
     /**
      * The custom pages that will be displayed when applicable for this application
      */
-    custom_pages?: Array<string>;
+    custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -743,6 +680,12 @@ export namespace AccessApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -758,7 +701,7 @@ export namespace AccessApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -786,53 +729,6 @@ export namespace AccessApps {
     updated_at?: string;
   }
 
-  export namespace BrowserSSHApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<unknown>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<unknown>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface BrowserVncApplication {
     /**
      * The primary hostname and path that Access will secure. If the app is visible in
@@ -862,7 +758,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Displays the application in the App Launcher.
@@ -880,7 +776,7 @@ export namespace AccessApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: BrowserVncApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -905,7 +801,7 @@ export namespace AccessApps {
     /**
      * The custom pages that will be displayed when applicable for this application
      */
-    custom_pages?: Array<string>;
+    custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -929,6 +825,12 @@ export namespace AccessApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -944,7 +846,7 @@ export namespace AccessApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -972,53 +874,6 @@ export namespace AccessApps {
     updated_at?: string;
   }
 
-  export namespace BrowserVncApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<unknown>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<unknown>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface AppLauncherApplication {
     /**
      * The application type.
@@ -1034,7 +889,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Audience tag.
@@ -1085,7 +940,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Audience tag.
@@ -1136,7 +991,7 @@ export namespace AccessApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
 
     /**
      * Audience tag.
@@ -1178,7 +1033,10 @@ export namespace AccessApps {
      */
     id?: string;
 
-    app_launcher_visible?: unknown;
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
 
     /**
      * Audience tag.
@@ -1190,7 +1048,7 @@ export namespace AccessApps {
     /**
      * The URL or domain of the bookmark.
      */
-    domain?: unknown;
+    domain?: string;
 
     /**
      * The image URL for the logo shown in the App Launcher dashboard.
@@ -1217,664 +1075,1722 @@ export namespace AccessApps {
   }
 }
 
-export type ApplicationListResponse = Array<AccessApps>;
-
-export interface ApplicationDeleteResponse {
+export interface CORSHeaders {
   /**
-   * UUID
+   * Allows all HTTP request headers.
    */
-  id?: string;
-}
+  allow_all_headers?: boolean;
 
-export type ApplicationRevokeTokensResponse = unknown;
-
-export interface ApplicationCreateParams {
   /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
+   * Allows all HTTP request methods.
    */
-  account_id?: string;
+  allow_all_methods?: boolean;
 
   /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
+   * Allows all origins.
    */
-  zone_id?: string;
+  allow_all_origins?: boolean;
 
   /**
-   * Body param: When set to true, users can authenticate to this application using
-   * their WARP session. When set to false this application will always require
-   * direct IdP authentication. This setting always overrides the organization
-   * setting for WARP authentication.
+   * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+   * client certificates) with requests.
    */
-  allow_authenticate_via_warp?: boolean;
+  allow_credentials?: boolean;
 
   /**
-   * Body param: The identity providers your users can select when connecting to this
-   * application. Defaults to all IdPs configured in your account.
+   * Allowed HTTP request headers.
    */
-  allowed_idps?: Array<string>;
+  allowed_headers?: Array<AllowedHeadersh>;
 
   /**
-   * Body param:
+   * Allowed HTTP request methods.
    */
-  app_launcher_visible?: unknown;
+  allowed_methods?: Array<AllowedMethodsh>;
 
   /**
-   * Body param: When set to `true`, users skip the identity provider selection step
-   * during login. You must specify only one identity provider in allowed_idps.
+   * Allowed origins.
    */
-  auto_redirect_to_identity?: boolean;
+  allowed_origins?: Array<AllowedOriginsh>;
 
   /**
-   * Body param:
+   * The maximum number of seconds the results of a preflight request can be cached.
    */
-  cors_headers?: ApplicationCreateParams.CorsHeaders;
+  max_age?: number;
+}
 
-  /**
-   * Body param: The custom error message shown to a user when they are denied access
-   * to the application.
-   */
-  custom_deny_message?: string;
+/**
+ * The custom pages selected for application.
+ */
+export type CustomPagesh = string;
 
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing identity-based rules.
-   */
-  custom_deny_url?: string;
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormat =
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
 
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing non-identity rules.
-   */
-  custom_non_identity_deny_url?: string;
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormat = 'id' | 'email';
 
+export interface SaaSAppSource {
   /**
-   * Body param: The custom pages that will be displayed when applicable for this
-   * application
+   * The name of the IdP attribute.
    */
-  custom_pages?: Array<string>;
+  name?: string;
 
   /**
-   * Body param: The URL or domain of the bookmark.
+   * A mapping from IdP ID to attribute name.
    */
-  domain?: unknown;
+  name_by_idp?: Record<string, string>;
+}
 
+export interface SAMLSaaSApp {
   /**
-   * Body param: Enables the binding cookie, which increases security against
-   * compromised authorization tokens and CSRF attacks.
+   * Optional identifier indicating the authentication protocol used for the saas
+   * app. Required for OIDC. Default if unset is "saml"
    */
-  enable_binding_cookie?: boolean;
+  auth_type?: 'saml' | 'oidc';
 
   /**
-   * Body param: Enables the HttpOnly cookie attribute, which increases security
-   * against XSS attacks.
+   * The service provider's endpoint that is responsible for receiving and parsing a
+   * SAML assertion.
    */
-  http_only_cookie_attribute?: boolean;
+  consumer_service_url?: string;
 
-  /**
-   * Body param: The image URL for the logo shown in the App Launcher dashboard.
-   */
-  logo_url?: string;
+  created_at?: string;
 
-  /**
-   * Body param: The name of the application.
-   */
-  name?: string;
+  custom_attributes?: SAMLSaaSApp.CustomAttributes;
 
   /**
-   * Body param: Enables cookie paths to scope an application's JWT to the
-   * application path. If disabled, the JWT will scope to the hostname by default
+   * The URL that the user will be redirected to after a successful login for IDP
+   * initiated logins.
    */
-  path_cookie_attribute?: boolean;
+  default_relay_state?: string;
 
   /**
-   * Body param:
+   * The unique identifier for your SaaS application.
    */
-  saas_app?: ApplicationCreateParams.AccessSamlSaasApp | ApplicationCreateParams.AccessOidcSaasApp;
+  idp_entity_id?: string;
 
   /**
-   * Body param: Sets the SameSite cookie setting, which provides increased security
-   * against CSRF attacks.
+   * The format of the name identifier sent to the SaaS application.
    */
-  same_site_cookie_attribute?: string;
+  name_id_format?: SaaSAppNameIDFormat;
 
   /**
-   * Body param: List of domains that Access will secure.
+   * A [JSONata](https://jsonata.org/) expression that transforms an application's
+   * user identities into a NameID value for its SAML assertion. This expression
+   * should evaluate to a singular string. The output of this expression can override
+   * the `name_id_format` setting.
    */
-  self_hosted_domains?: Array<string>;
+  name_id_transform_jsonata?: string;
 
   /**
-   * Body param: Returns a 401 status code when the request is blocked by a Service
-   * Auth policy.
+   * The Access public certificate that will be used to verify your identity.
    */
-  service_auth_401_redirect?: boolean;
+  public_key?: string;
 
   /**
-   * Body param: The amount of time that tokens issued for this application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
+   * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+   * user identities into attribute assertions in the SAML response. The expression
+   * can transform id, email, name, and groups values. It can also transform fields
+   * listed in the saml_attributes or oidc_fields of the identity provider used to
+   * authenticate. The output of this expression must be a JSON object.
    */
-  session_duration?: string;
+  saml_attribute_transform_jsonata?: string;
 
   /**
-   * Body param: Enables automatic authentication through cloudflared.
+   * A globally unique name for an identity or service provider.
    */
-  skip_interstitial?: boolean;
+  sp_entity_id?: string;
 
   /**
-   * Body param: The tags you want assigned to an application. Tags are used to
-   * filter applications in the App Launcher dashboard.
+   * The endpoint where your SaaS application will send login requests.
    */
-  tags?: Array<string>;
+  sso_endpoint?: string;
 
-  /**
-   * Body param: The application type.
-   */
-  type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+  updated_at?: string;
 }
 
-export namespace ApplicationCreateParams {
-  export interface CorsHeaders {
+export namespace SAMLSaaSApp {
+  export interface CustomAttributes {
     /**
-     * Allows all HTTP request headers.
+     * The SAML FriendlyName of the attribute.
      */
-    allow_all_headers?: boolean;
+    friendly_name?: string;
 
     /**
-     * Allows all HTTP request methods.
+     * The name of the attribute.
      */
-    allow_all_methods?: boolean;
+    name?: string;
 
     /**
-     * Allows all origins.
+     * A globally unique name for an identity or service provider.
      */
-    allow_all_origins?: boolean;
+    name_format?: ApplicationsAPI.SaaSAppNameFormat;
 
     /**
-     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-     * client certificates) with requests.
+     * If the attribute is required when building a SAML assertion.
      */
-    allow_credentials?: boolean;
+    required?: boolean;
+
+    source?: ApplicationsAPI.SaaSAppSource;
+  }
+}
+
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomainsh = string;
+
+export interface ApplicationDeleteResponse {
+  /**
+   * UUID
+   */
+  id?: string;
+}
+
+export type ApplicationRevokeTokensResponse = unknown;
 
+export type ApplicationCreateParams =
+  | ApplicationCreateParams.SelfHostedApplication
+  | ApplicationCreateParams.SaaSApplication
+  | ApplicationCreateParams.BrowserSSHApplication
+  | ApplicationCreateParams.BrowserVncApplication
+  | ApplicationCreateParams.AppLauncherApplication
+  | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication
+  | ApplicationCreateParams.BrowserIsolationPermissionsApplication
+  | ApplicationCreateParams.BookmarkApplication;
+
+export namespace ApplicationCreateParams {
+  export interface SelfHostedApplication {
     /**
-     * Allowed HTTP request headers.
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
      */
-    allowed_headers?: Array<unknown>;
+    domain: string;
 
     /**
-     * Allowed HTTP request methods.
+     * Body param: The application type.
      */
-    allowed_methods?: Array<
-      'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-    >;
+    type: string;
 
     /**
-     * Allowed origins.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    allowed_origins?: Array<unknown>;
+    account_id?: string;
 
     /**
-     * The maximum number of seconds the results of a preflight request can be cached.
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    max_age?: number;
-  }
+    zone_id?: string;
 
-  export interface AccessSamlSaasApp {
     /**
-     * Optional identifier indicating the authentication protocol used for the saas
-     * app. Required for OIDC. Default if unset is "saml"
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
      */
-    auth_type?: 'saml' | 'oidc';
+    allow_authenticate_via_warp?: boolean;
 
     /**
-     * The service provider's endpoint that is responsible for receiving and parsing a
-     * SAML assertion.
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    consumer_service_url?: string;
-
-    custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+    allowed_idps?: Array<AllowedIdpsh>;
 
     /**
-     * The URL that the user will be redirected to after a successful login for IDP
-     * initiated logins.
+     * Body param: Displays the application in the App Launcher.
      */
-    default_relay_state?: string;
+    app_launcher_visible?: boolean;
 
     /**
-     * The unique identifier for your SaaS application.
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
      */
-    idp_entity_id?: string;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * The format of the name identifier sent to the SaaS application.
+     * Body param:
      */
-    name_id_format?: 'id' | 'email';
+    cors_headers?: CORSHeaders;
 
     /**
-     * A [JSONata](https://jsonata.org/) expression that transforms an application's
-     * user identities into a NameID value for its SAML assertion. This expression
-     * should evaluate to a singular string. The output of this expression can override
-     * the `name_id_format` setting.
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
      */
-    name_id_transform_jsonata?: string;
+    custom_deny_message?: string;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
      */
-    public_key?: string;
+    custom_deny_url?: string;
 
     /**
-     * A globally unique name for an identity or service provider.
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
      */
-    sp_entity_id?: string;
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The endpoint where your SaaS application will send login requests.
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
      */
-    sso_endpoint?: string;
-  }
+    custom_pages?: Array<CustomPagesh>;
 
-  export namespace AccessSamlSaasApp {
-    export interface CustomAttributes {
-      /**
-       * The name of the attribute.
-       */
-      name?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      name_format?:
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
 
-      source?: CustomAttributes.Source;
-    }
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
 
-    export namespace CustomAttributes {
-      export interface Source {
-        /**
-         * The name of the IdP attribute.
-         */
-        name?: string;
-      }
-    }
-  }
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
 
-  export interface AccessOidcSaasApp {
     /**
-     * The URL where this applications tile redirects users
+     * Body param: The name of the application.
      */
-    app_launcher_url?: string;
+    name?: string;
 
     /**
-     * Identifier of the authentication protocol used for the saas app. Required for
-     * OIDC.
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
      */
-    auth_type?: 'saml' | 'oidc';
+    options_preflight_bypass?: boolean;
 
     /**
-     * The application client id
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
      */
-    client_id?: string;
+    path_cookie_attribute?: boolean;
 
     /**
-     * The application client secret, only returned on POST request.
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
      */
-    client_secret?: string;
+    same_site_cookie_attribute?: string;
 
     /**
-     * The OIDC flows supported by this application
+     * Body param: List of domains that Access will secure.
      */
-    grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
 
     /**
-     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
      */
-    group_filter_regex?: string;
+    service_auth_401_redirect?: boolean;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
      */
-    public_key?: string;
+    session_duration?: string;
 
     /**
-     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-     * tokens
+     * Body param: Enables automatic authentication through cloudflared.
      */
-    redirect_uris?: Array<string>;
+    skip_interstitial?: boolean;
 
     /**
-     * Define the user information shared with access
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    tags?: Array<string>;
+  }
+
+  export interface SaaSApplication {
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param:
+     */
+    saas_app?: SAMLSaaSApp | ApplicationCreateParams.SaaSApplication.AccessOIDCSaaSApp;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
+
+  export namespace SaaSApplication {
+    export interface AccessOIDCSaaSApp {
+      /**
+       * The URL where this applications tile redirects users
+       */
+      app_launcher_url?: string;
+
+      /**
+       * Identifier of the authentication protocol used for the saas app. Required for
+       * OIDC.
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The application client id
+       */
+      client_id?: string;
+
+      /**
+       * The application client secret, only returned on POST request.
+       */
+      client_secret?: string;
+
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
+      /**
+       * The OIDC flows supported by this application
+       */
+      grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+
+      /**
+       * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+       */
+      group_filter_regex?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+       * tokens
+       */
+      redirect_uris?: Array<string>;
+
+      /**
+       * Define the user information shared with access
+       */
+      scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
+  }
+
+  export interface BrowserSSHApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: CORSHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export interface BrowserVncApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: CORSHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export interface AppLauncherApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface BrowserIsolationPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface BookmarkApplication {
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: The URL or domain of the bookmark.
+     */
+    domain?: string;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
   }
 }
 
-export interface ApplicationUpdateParams {
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
+export type ApplicationUpdateParams =
+  | ApplicationUpdateParams.SelfHostedApplication
+  | ApplicationUpdateParams.SaaSApplication
+  | ApplicationUpdateParams.BrowserSSHApplication
+  | ApplicationUpdateParams.BrowserVncApplication
+  | ApplicationUpdateParams.AppLauncherApplication
+  | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication
+  | ApplicationUpdateParams.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateParams.BookmarkApplication;
+
+export namespace ApplicationUpdateParams {
+  export interface SelfHostedApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param:
+     */
+    cors_headers?: CORSHeaders;
+
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
+
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
+
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export interface SaaSApplication {
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
+
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param:
+     */
+    saas_app?: SAMLSaaSApp | ApplicationUpdateParams.SaaSApplication.AccessOIDCSaaSApp;
+
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
+
+  export namespace SaaSApplication {
+    export interface AccessOIDCSaaSApp {
+      /**
+       * The URL where this applications tile redirects users
+       */
+      app_launcher_url?: string;
+
+      /**
+       * Identifier of the authentication protocol used for the saas app. Required for
+       * OIDC.
+       */
+      auth_type?: 'saml' | 'oidc';
+
+      /**
+       * The application client id
+       */
+      client_id?: string;
+
+      /**
+       * The application client secret, only returned on POST request.
+       */
+      client_secret?: string;
+
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
+      /**
+       * The OIDC flows supported by this application
+       */
+      grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+
+      /**
+       * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+       */
+      group_filter_regex?: string;
+
+      /**
+       * The Access public certificate that will be used to verify your identity.
+       */
+      public_key?: string;
+
+      /**
+       * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
+       * tokens
+       */
+      redirect_uris?: Array<string>;
+
+      /**
+       * Define the user information shared with access
+       */
+      scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
+  }
+
+  export interface BrowserSSHApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
 
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
+    /**
+     * Body param: The application type.
+     */
+    type: string;
 
-  /**
-   * Body param: When set to true, users can authenticate to this application using
-   * their WARP session. When set to false this application will always require
-   * direct IdP authentication. This setting always overrides the organization
-   * setting for WARP authentication.
-   */
-  allow_authenticate_via_warp?: boolean;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
 
-  /**
-   * Body param: The identity providers your users can select when connecting to this
-   * application. Defaults to all IdPs configured in your account.
-   */
-  allowed_idps?: Array<string>;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
 
-  /**
-   * Body param:
-   */
-  app_launcher_visible?: unknown;
+    /**
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
+     */
+    allow_authenticate_via_warp?: boolean;
 
-  /**
-   * Body param: When set to `true`, users skip the identity provider selection step
-   * during login. You must specify only one identity provider in allowed_idps.
-   */
-  auto_redirect_to_identity?: boolean;
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
 
-  /**
-   * Body param:
-   */
-  cors_headers?: ApplicationUpdateParams.CorsHeaders;
+    /**
+     * Body param: Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
 
-  /**
-   * Body param: The custom error message shown to a user when they are denied access
-   * to the application.
-   */
-  custom_deny_message?: string;
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
 
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing identity-based rules.
-   */
-  custom_deny_url?: string;
+    /**
+     * Body param:
+     */
+    cors_headers?: CORSHeaders;
 
-  /**
-   * Body param: The custom URL a user is redirected to when they are denied access
-   * to the application when failing non-identity rules.
-   */
-  custom_non_identity_deny_url?: string;
+    /**
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
+     */
+    custom_deny_message?: string;
 
-  /**
-   * Body param: The custom pages that will be displayed when applicable for this
-   * application
-   */
-  custom_pages?: Array<string>;
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
 
-  /**
-   * Body param: The URL or domain of the bookmark.
-   */
-  domain?: unknown;
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
 
-  /**
-   * Body param: Enables the binding cookie, which increases security against
-   * compromised authorization tokens and CSRF attacks.
-   */
-  enable_binding_cookie?: boolean;
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<CustomPagesh>;
 
-  /**
-   * Body param: Enables the HttpOnly cookie attribute, which increases security
-   * against XSS attacks.
-   */
-  http_only_cookie_attribute?: boolean;
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
 
-  /**
-   * Body param: The image URL for the logo shown in the App Launcher dashboard.
-   */
-  logo_url?: string;
+    /**
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
+     */
+    http_only_cookie_attribute?: boolean;
 
-  /**
-   * Body param: The name of the application.
-   */
-  name?: string;
+    /**
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
 
-  /**
-   * Body param: Enables cookie paths to scope an application's JWT to the
-   * application path. If disabled, the JWT will scope to the hostname by default
-   */
-  path_cookie_attribute?: boolean;
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
 
-  /**
-   * Body param:
-   */
-  saas_app?: ApplicationUpdateParams.AccessSamlSaasApp | ApplicationUpdateParams.AccessOidcSaasApp;
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
 
-  /**
-   * Body param: Sets the SameSite cookie setting, which provides increased security
-   * against CSRF attacks.
-   */
-  same_site_cookie_attribute?: string;
+    /**
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
+     */
+    path_cookie_attribute?: boolean;
 
-  /**
-   * Body param: List of domains that Access will secure.
-   */
-  self_hosted_domains?: Array<string>;
+    /**
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
 
-  /**
-   * Body param: Returns a 401 status code when the request is blocked by a Service
-   * Auth policy.
-   */
-  service_auth_401_redirect?: boolean;
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
 
-  /**
-   * Body param: The amount of time that tokens issued for this application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
-   */
-  session_duration?: string;
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
 
-  /**
-   * Body param: Enables automatic authentication through cloudflared.
-   */
-  skip_interstitial?: boolean;
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
 
-  /**
-   * Body param: The tags you want assigned to an application. Tags are used to
-   * filter applications in the App Launcher dashboard.
-   */
-  tags?: Array<string>;
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
 
-  /**
-   * Body param: The application type.
-   */
-  type?: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
-}
+    /**
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+  }
+
+  export interface BrowserVncApplication {
+    /**
+     * Body param: The primary hostname and path that Access will secure. If the app is
+     * visible in the App Launcher dashboard, this is the domain that will be
+     * displayed.
+     */
+    domain: string;
+
+    /**
+     * Body param: The application type.
+     */
+    type: string;
 
-export namespace ApplicationUpdateParams {
-  export interface CorsHeaders {
     /**
-     * Allows all HTTP request headers.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    allow_all_headers?: boolean;
+    account_id?: string;
 
     /**
-     * Allows all HTTP request methods.
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    allow_all_methods?: boolean;
+    zone_id?: string;
 
     /**
-     * Allows all origins.
+     * Body param: When set to true, users can authenticate to this application using
+     * their WARP session. When set to false this application will always require
+     * direct IdP authentication. This setting always overrides the organization
+     * setting for WARP authentication.
      */
-    allow_all_origins?: boolean;
+    allow_authenticate_via_warp?: boolean;
 
     /**
-     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-     * client certificates) with requests.
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    allow_credentials?: boolean;
+    allowed_idps?: Array<AllowedIdpsh>;
 
     /**
-     * Allowed HTTP request headers.
+     * Body param: Displays the application in the App Launcher.
      */
-    allowed_headers?: Array<unknown>;
+    app_launcher_visible?: boolean;
 
     /**
-     * Allowed HTTP request methods.
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
      */
-    allowed_methods?: Array<
-      'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-    >;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * Allowed origins.
+     * Body param:
      */
-    allowed_origins?: Array<unknown>;
+    cors_headers?: CORSHeaders;
 
     /**
-     * The maximum number of seconds the results of a preflight request can be cached.
+     * Body param: The custom error message shown to a user when they are denied access
+     * to the application.
      */
-    max_age?: number;
-  }
+    custom_deny_message?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
 
-  export interface AccessSamlSaasApp {
     /**
-     * Optional identifier indicating the authentication protocol used for the saas
-     * app. Required for OIDC. Default if unset is "saml"
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
      */
-    auth_type?: 'saml' | 'oidc';
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The service provider's endpoint that is responsible for receiving and parsing a
-     * SAML assertion.
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
      */
-    consumer_service_url?: string;
+    custom_pages?: Array<CustomPagesh>;
 
-    custom_attributes?: AccessSamlSaasApp.CustomAttributes;
+    /**
+     * Body param: Enables the binding cookie, which increases security against
+     * compromised authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
 
     /**
-     * The URL that the user will be redirected to after a successful login for IDP
-     * initiated logins.
+     * Body param: Enables the HttpOnly cookie attribute, which increases security
+     * against XSS attacks.
      */
-    default_relay_state?: string;
+    http_only_cookie_attribute?: boolean;
 
     /**
-     * The unique identifier for your SaaS application.
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
      */
-    idp_entity_id?: string;
+    logo_url?: string;
 
     /**
-     * The format of the name identifier sent to the SaaS application.
+     * Body param: The name of the application.
      */
-    name_id_format?: 'id' | 'email';
+    name?: string;
 
     /**
-     * A [JSONata](https://jsonata.org/) expression that transforms an application's
-     * user identities into a NameID value for its SAML assertion. This expression
-     * should evaluate to a singular string. The output of this expression can override
-     * the `name_id_format` setting.
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
      */
-    name_id_transform_jsonata?: string;
+    options_preflight_bypass?: boolean;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: Enables cookie paths to scope an application's JWT to the
+     * application path. If disabled, the JWT will scope to the hostname by default
      */
-    public_key?: string;
+    path_cookie_attribute?: boolean;
 
     /**
-     * A globally unique name for an identity or service provider.
+     * Body param: Sets the SameSite cookie setting, which provides increased security
+     * against CSRF attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Body param: List of domains that Access will secure.
+     */
+    self_hosted_domains?: Array<SelfHostedDomainsh>;
+
+    /**
+     * Body param: Returns a 401 status code when the request is blocked by a Service
+     * Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Body param: Enables automatic authentication through cloudflared.
      */
-    sp_entity_id?: string;
+    skip_interstitial?: boolean;
 
     /**
-     * The endpoint where your SaaS application will send login requests.
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    sso_endpoint?: string;
+    tags?: Array<string>;
   }
 
-  export namespace AccessSamlSaasApp {
-    export interface CustomAttributes {
-      /**
-       * The name of the attribute.
-       */
-      name?: string;
+  export interface AppLauncherApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
 
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      name_format?:
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-        | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
 
-      source?: CustomAttributes.Source;
-    }
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
 
-    export namespace CustomAttributes {
-      export interface Source {
-        /**
-         * The name of the IdP attribute.
-         */
-        name?: string;
-      }
-    }
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string;
   }
 
-  export interface AccessOidcSaasApp {
+  export interface BrowserIsolationPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdpsh>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
     /**
-     * The URL where this applications tile redirects users
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
      */
-    app_launcher_url?: string;
+    session_duration?: string;
+  }
 
+  export interface BookmarkApplication {
     /**
-     * Identifier of the authentication protocol used for the saas app. Required for
-     * OIDC.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    auth_type?: 'saml' | 'oidc';
+    account_id?: string;
 
     /**
-     * The application client id
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    client_id?: string;
+    zone_id?: string;
 
     /**
-     * The application client secret, only returned on POST request.
+     * Body param: Displays the application in the App Launcher.
      */
-    client_secret?: string;
+    app_launcher_visible?: boolean;
 
     /**
-     * The OIDC flows supported by this application
+     * Body param: The URL or domain of the bookmark.
      */
-    grant_types?: Array<'authorization_code' | 'authorization_code_with_pkce'>;
+    domain?: string;
 
     /**
-     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
+     * Body param: The image URL for the logo shown in the App Launcher dashboard.
      */
-    group_filter_regex?: string;
+    logo_url?: string;
 
     /**
-     * The Access public certificate that will be used to verify your identity.
+     * Body param: The name of the application.
      */
-    public_key?: string;
+    name?: string;
 
     /**
-     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID
-     * tokens
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
      */
-    redirect_uris?: Array<string>;
+    tags?: Array<string>;
 
     /**
-     * Define the user information shared with access
+     * Body param: The application type.
      */
-    scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
+    type?: string;
   }
 }
 
@@ -1927,10 +2843,22 @@ export interface ApplicationRevokeTokensParams {
 }
 
 export namespace Applications {
-  export import AccessApps = ApplicationsAPI.AccessApps;
-  export import ApplicationListResponse = ApplicationsAPI.ApplicationListResponse;
+  export import AllowedHeadersh = ApplicationsAPI.AllowedHeadersh;
+  export import AllowedIdpsh = ApplicationsAPI.AllowedIdpsh;
+  export import AllowedMethodsh = ApplicationsAPI.AllowedMethodsh;
+  export import AllowedOriginsh = ApplicationsAPI.AllowedOriginsh;
+  export import AppID = ApplicationsAPI.AppID;
+  export import Application = ApplicationsAPI.Application;
+  export import CORSHeaders = ApplicationsAPI.CORSHeaders;
+  export import CustomPagesh = ApplicationsAPI.CustomPagesh;
+  export import SaaSAppNameFormat = ApplicationsAPI.SaaSAppNameFormat;
+  export import SaaSAppNameIDFormat = ApplicationsAPI.SaaSAppNameIDFormat;
+  export import SaaSAppSource = ApplicationsAPI.SaaSAppSource;
+  export import SAMLSaaSApp = ApplicationsAPI.SAMLSaaSApp;
+  export import SelfHostedDomainsh = ApplicationsAPI.SelfHostedDomainsh;
   export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
   export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
+  export import ApplicationsSinglePage = ApplicationsAPI.ApplicationsSinglePage;
   export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
   export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
   export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -1938,22 +2866,24 @@ export namespace Applications {
   export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
   export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
   export import CAs = CAsAPI.CAs;
-  export import AccessCA = CAsAPI.AccessCA;
+  export import CA = CAsAPI.CA;
   export import CACreateResponse = CAsAPI.CACreateResponse;
-  export import CAListResponse = CAsAPI.CAListResponse;
   export import CADeleteResponse = CAsAPI.CADeleteResponse;
   export import CAGetResponse = CAsAPI.CAGetResponse;
+  export import CAsSinglePage = CAsAPI.CAsSinglePage;
   export import CACreateParams = CAsAPI.CACreateParams;
   export import CAListParams = CAsAPI.CAListParams;
   export import CADeleteParams = CAsAPI.CADeleteParams;
   export import CAGetParams = CAsAPI.CAGetParams;
   export import UserPolicyChecks = UserPolicyChecksAPI.UserPolicyChecks;
+  export import UserPolicyCheckGeo = UserPolicyChecksAPI.UserPolicyCheckGeo;
   export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
   export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
   export import Policies = PoliciesAPI.Policies;
-  export import AccessPolicies = PoliciesAPI.AccessPolicies;
-  export import PolicyListResponse = PoliciesAPI.PolicyListResponse;
+  export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+  export import Policy = PoliciesAPI.Policy;
   export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
+  export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
   export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
   export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
   export import PolicyListParams = PoliciesAPI.PolicyListParams;