cloudflare 3.0.0-beta.9 → 3.1.0

package/src/resources/zero-trust/access/groups.ts

@@ -5,12 +5,14 @@ import { APIResource } from "../../../resource";
 import { isRequestOptions } from "../../../core";
 import { CloudflareError } from "../../../error";
 import * as GroupsAPI from "./groups";
+import * as AccessAPI from "./access";
+import { SinglePage } from "../../../pagination";
 
 export class Groups extends APIResource {
   /**
    * Creates a new Access group.
    */
-  create(params: GroupCreateParams, options?: Core.RequestOptions): Core.APIPromise<AccessGroups> {
+  create(params: GroupCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGroup> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -32,7 +34,7 @@ export class Groups extends APIResource {
       this._client.post(`/${accountOrZone}/${accountOrZoneId}/access/groups`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessGroups }>
+      }) as Core.APIPromise<{ result: ZeroTrustGroup }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -43,7 +45,7 @@ export class Groups extends APIResource {
     uuid: string,
     params: GroupUpdateParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessGroups> {
+  ): Core.APIPromise<ZeroTrustGroup> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -65,19 +67,22 @@ export class Groups extends APIResource {
       this._client.put(`/${accountOrZone}/${accountOrZoneId}/access/groups/${uuid}`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: AccessGroups }>
+      }) as Core.APIPromise<{ result: ZeroTrustGroup }>
     )._thenUnwrap((obj) => obj.result);
   }
 
   /**
    * Lists all Access groups.
    */
-  list(params?: GroupListParams, options?: Core.RequestOptions): Core.APIPromise<GroupListResponse | null>;
-  list(options?: Core.RequestOptions): Core.APIPromise<GroupListResponse | null>;
+  list(
+    params?: GroupListParams,
+    options?: Core.RequestOptions,
+  ): Core.PagePromise<ZeroTrustGroupsSinglePage, ZeroTrustGroup>;
+  list(options?: Core.RequestOptions): Core.PagePromise<ZeroTrustGroupsSinglePage, ZeroTrustGroup>;
   list(
     params: GroupListParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<GroupListResponse | null> {
+  ): Core.PagePromise<ZeroTrustGroupsSinglePage, ZeroTrustGroup> {
     if (isRequestOptions(params)) {
       return this.list({}, params);
     }
@@ -98,11 +103,11 @@ export class Groups extends APIResource {
           accountOrZone: 'zones',
           accountOrZoneId: zone_id,
         };
-    return (
-      this._client.get(`/${accountOrZone}/${accountOrZoneId}/access/groups`, options) as Core.APIPromise<{
-        result: GroupListResponse | null;
-      }>
-    )._thenUnwrap((obj) => obj.result);
+    return this._client.getAPIList(
+      `/${accountOrZone}/${accountOrZoneId}/access/groups`,
+      ZeroTrustGroupsSinglePage,
+      options,
+    );
   }
 
   /**
@@ -150,13 +155,13 @@ export class Groups extends APIResource {
   /**
    * Fetches a single Access group.
    */
-  get(uuid: string, params?: GroupGetParams, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
-  get(uuid: string, options?: Core.RequestOptions): Core.APIPromise<AccessGroups>;
+  get(uuid: string, params?: GroupGetParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGroup>;
+  get(uuid: string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGroup>;
   get(
     uuid: string,
     params: GroupGetParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<AccessGroups> {
+  ): Core.APIPromise<ZeroTrustGroup> {
     if (isRequestOptions(params)) {
       return this.get(uuid, {}, params);
     }
@@ -181,12 +186,14 @@ export class Groups extends APIResource {
       this._client.get(
         `/${accountOrZone}/${accountOrZoneId}/access/groups/${uuid}`,
         options,
-      ) as Core.APIPromise<{ result: AccessGroups }>
+      ) as Core.APIPromise<{ result: ZeroTrustGroup }>
     )._thenUnwrap((obj) => obj.result);
   }
 }
 
-export interface AccessGroups {
+export class ZeroTrustGroupsSinglePage extends SinglePage<ZeroTrustGroup> {}
+
+export interface ZeroTrustGroup {
   /**
    * UUID
    */
@@ -198,79 +205,19 @@ export interface AccessGroups {
    * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
    * meet any of the Exclude rules.
    */
-  exclude?: Array<
-    | AccessGroups.AccessEmailRule
-    | AccessGroups.AccessEmailListRule
-    | AccessGroups.AccessDomainRule
-    | AccessGroups.AccessEveryoneRule
-    | AccessGroups.AccessIPRule
-    | AccessGroups.AccessIPListRule
-    | AccessGroups.AccessCertificateRule
-    | AccessGroups.AccessAccessGroupRule
-    | AccessGroups.AccessAzureGroupRule
-    | AccessGroups.AccessGitHubOrganizationRule
-    | AccessGroups.AccessGsuiteGroupRule
-    | AccessGroups.AccessOktaGroupRule
-    | AccessGroups.AccessSamlGroupRule
-    | AccessGroups.AccessServiceTokenRule
-    | AccessGroups.AccessAnyValidServiceTokenRule
-    | AccessGroups.AccessExternalEvaluationRule
-    | AccessGroups.AccessCountryRule
-    | AccessGroups.AccessAuthenticationMethodRule
-    | AccessGroups.AccessDevicePostureRule
-  >;
+  exclude?: Array<AccessAPI.AccessRule>;
 
   /**
    * Rules evaluated with an OR logical operator. A user needs to meet only one of
    * the Include rules.
    */
-  include?: Array<
-    | AccessGroups.AccessEmailRule
-    | AccessGroups.AccessEmailListRule
-    | AccessGroups.AccessDomainRule
-    | AccessGroups.AccessEveryoneRule
-    | AccessGroups.AccessIPRule
-    | AccessGroups.AccessIPListRule
-    | AccessGroups.AccessCertificateRule
-    | AccessGroups.AccessAccessGroupRule
-    | AccessGroups.AccessAzureGroupRule
-    | AccessGroups.AccessGitHubOrganizationRule
-    | AccessGroups.AccessGsuiteGroupRule
-    | AccessGroups.AccessOktaGroupRule
-    | AccessGroups.AccessSamlGroupRule
-    | AccessGroups.AccessServiceTokenRule
-    | AccessGroups.AccessAnyValidServiceTokenRule
-    | AccessGroups.AccessExternalEvaluationRule
-    | AccessGroups.AccessCountryRule
-    | AccessGroups.AccessAuthenticationMethodRule
-    | AccessGroups.AccessDevicePostureRule
-  >;
+  include?: Array<AccessAPI.AccessRule>;
 
   /**
    * Rules evaluated with an AND logical operator. To match a policy, a user must
    * meet all of the Require rules.
    */
-  is_default?: Array<
-    | AccessGroups.AccessEmailRule
-    | AccessGroups.AccessEmailListRule
-    | AccessGroups.AccessDomainRule
-    | AccessGroups.AccessEveryoneRule
-    | AccessGroups.AccessIPRule
-    | AccessGroups.AccessIPListRule
-    | AccessGroups.AccessCertificateRule
-    | AccessGroups.AccessAccessGroupRule
-    | AccessGroups.AccessAzureGroupRule
-    | AccessGroups.AccessGitHubOrganizationRule
-    | AccessGroups.AccessGsuiteGroupRule
-    | AccessGroups.AccessOktaGroupRule
-    | AccessGroups.AccessSamlGroupRule
-    | AccessGroups.AccessServiceTokenRule
-    | AccessGroups.AccessAnyValidServiceTokenRule
-    | AccessGroups.AccessExternalEvaluationRule
-    | AccessGroups.AccessCountryRule
-    | AccessGroups.AccessAuthenticationMethodRule
-    | AccessGroups.AccessDevicePostureRule
-  >;
+  is_default?: Array<AccessAPI.AccessRule>;
 
   /**
    * The name of the Access group.
@@ -281,3398 +228,100 @@ export interface AccessGroups {
    * Rules evaluated with an AND logical operator. To match a policy, a user must
    * meet all of the Require rules.
    */
-  require?: Array<
-    | AccessGroups.AccessEmailRule
-    | AccessGroups.AccessEmailListRule
-    | AccessGroups.AccessDomainRule
-    | AccessGroups.AccessEveryoneRule
-    | AccessGroups.AccessIPRule
-    | AccessGroups.AccessIPListRule
-    | AccessGroups.AccessCertificateRule
-    | AccessGroups.AccessAccessGroupRule
-    | AccessGroups.AccessAzureGroupRule
-    | AccessGroups.AccessGitHubOrganizationRule
-    | AccessGroups.AccessGsuiteGroupRule
-    | AccessGroups.AccessOktaGroupRule
-    | AccessGroups.AccessSamlGroupRule
-    | AccessGroups.AccessServiceTokenRule
-    | AccessGroups.AccessAnyValidServiceTokenRule
-    | AccessGroups.AccessExternalEvaluationRule
-    | AccessGroups.AccessCountryRule
-    | AccessGroups.AccessAuthenticationMethodRule
-    | AccessGroups.AccessDevicePostureRule
-  >;
+  require?: Array<AccessAPI.AccessRule>;
 
   updated_at?: string;
 }
 
-export namespace AccessGroups {
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
+export interface GroupDeleteResponse {
   /**
-   * Matches an IP address block.
+   * UUID
    */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
+  id?: string;
+}
 
+export interface GroupCreateParams {
   /**
-   * Matches an IP address from a list.
+   * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+   * only one of the Include rules.
    */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
+  include: Array<AccessAPI.AccessRule>;
 
   /**
-   * Matches any valid client certificate.
+   * Body param: The name of the Access group.
    */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
+  name: string;
 
   /**
-   * Matches an Access group.
+   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+   * Zone ID.
    */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
+  account_id?: string;
 
   /**
-   * Matches an Azure group. Requires an Azure identity provider.
+   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+   * Account ID.
    */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
+  zone_id?: string;
 
   /**
-   * Matches a Github organization. Requires a Github identity provider.
+   * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
+   * user cannot meet any of the Exclude rules.
    */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
+  exclude?: Array<AccessAPI.AccessRule>;
 
   /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
+   * Body param: Whether this is the default group
    */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
+  is_default?: boolean;
 
   /**
-   * Matches an Okta group. Requires an Okta identity provider.
+   * Body param: Rules evaluated with an AND logical operator. To match a policy, a
+   * user must meet all of the Require rules.
    */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
+  require?: Array<AccessAPI.AccessRule>;
+}
 
+export interface GroupUpdateParams {
   /**
-   * Matches a SAML group. Requires a SAML identity provider.
+   * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+   * only one of the Include rules.
    */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
+  include: Array<AccessAPI.AccessRule>;
 
   /**
-   * Matches a specific Access Service Token
+   * Body param: The name of the Access group.
    */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
+  name: string;
 
   /**
-   * Matches any valid Access Service Token
+   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+   * Zone ID.
    */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
+  account_id?: string;
 
   /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
+   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+   * Account ID.
    */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
+  zone_id?: string;
 
   /**
-   * Matches a specific country
+   * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
+   * user cannot meet any of the Exclude rules.
    */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
+  exclude?: Array<AccessAPI.AccessRule>;
 
   /**
-   * Enforce different MFA options
+   * Body param: Whether this is the default group
    */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
+  is_default?: boolean;
 
   /**
-   * Enforces a device posture rule has run successfully
+   * Body param: Rules evaluated with an AND logical operator. To match a policy, a
+   * user must meet all of the Require rules.
    */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-}
-
-export type GroupListResponse = Array<AccessGroups>;
-
-export interface GroupDeleteResponse {
-  /**
-   * UUID
-   */
-  id?: string;
-}
-
-export interface GroupCreateParams {
-  /**
-   * Body param: Rules evaluated with an OR logical operator. A user needs to meet
-   * only one of the Include rules.
-   */
-  include: Array<
-    | GroupCreateParams.AccessEmailRule
-    | GroupCreateParams.AccessEmailListRule
-    | GroupCreateParams.AccessDomainRule
-    | GroupCreateParams.AccessEveryoneRule
-    | GroupCreateParams.AccessIPRule
-    | GroupCreateParams.AccessIPListRule
-    | GroupCreateParams.AccessCertificateRule
-    | GroupCreateParams.AccessAccessGroupRule
-    | GroupCreateParams.AccessAzureGroupRule
-    | GroupCreateParams.AccessGitHubOrganizationRule
-    | GroupCreateParams.AccessGsuiteGroupRule
-    | GroupCreateParams.AccessOktaGroupRule
-    | GroupCreateParams.AccessSamlGroupRule
-    | GroupCreateParams.AccessServiceTokenRule
-    | GroupCreateParams.AccessAnyValidServiceTokenRule
-    | GroupCreateParams.AccessExternalEvaluationRule
-    | GroupCreateParams.AccessCountryRule
-    | GroupCreateParams.AccessAuthenticationMethodRule
-    | GroupCreateParams.AccessDevicePostureRule
-  >;
-
-  /**
-   * Body param: The name of the Access group.
-   */
-  name: string;
-
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
-
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
-
-  /**
-   * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
-   * user cannot meet any of the Exclude rules.
-   */
-  exclude?: Array<
-    | GroupCreateParams.AccessEmailRule
-    | GroupCreateParams.AccessEmailListRule
-    | GroupCreateParams.AccessDomainRule
-    | GroupCreateParams.AccessEveryoneRule
-    | GroupCreateParams.AccessIPRule
-    | GroupCreateParams.AccessIPListRule
-    | GroupCreateParams.AccessCertificateRule
-    | GroupCreateParams.AccessAccessGroupRule
-    | GroupCreateParams.AccessAzureGroupRule
-    | GroupCreateParams.AccessGitHubOrganizationRule
-    | GroupCreateParams.AccessGsuiteGroupRule
-    | GroupCreateParams.AccessOktaGroupRule
-    | GroupCreateParams.AccessSamlGroupRule
-    | GroupCreateParams.AccessServiceTokenRule
-    | GroupCreateParams.AccessAnyValidServiceTokenRule
-    | GroupCreateParams.AccessExternalEvaluationRule
-    | GroupCreateParams.AccessCountryRule
-    | GroupCreateParams.AccessAuthenticationMethodRule
-    | GroupCreateParams.AccessDevicePostureRule
-  >;
-
-  /**
-   * Body param: Whether this is the default group
-   */
-  is_default?: boolean;
-
-  /**
-   * Body param: Rules evaluated with an AND logical operator. To match a policy, a
-   * user must meet all of the Require rules.
-   */
-  require?: Array<
-    | GroupCreateParams.AccessEmailRule
-    | GroupCreateParams.AccessEmailListRule
-    | GroupCreateParams.AccessDomainRule
-    | GroupCreateParams.AccessEveryoneRule
-    | GroupCreateParams.AccessIPRule
-    | GroupCreateParams.AccessIPListRule
-    | GroupCreateParams.AccessCertificateRule
-    | GroupCreateParams.AccessAccessGroupRule
-    | GroupCreateParams.AccessAzureGroupRule
-    | GroupCreateParams.AccessGitHubOrganizationRule
-    | GroupCreateParams.AccessGsuiteGroupRule
-    | GroupCreateParams.AccessOktaGroupRule
-    | GroupCreateParams.AccessSamlGroupRule
-    | GroupCreateParams.AccessServiceTokenRule
-    | GroupCreateParams.AccessAnyValidServiceTokenRule
-    | GroupCreateParams.AccessExternalEvaluationRule
-    | GroupCreateParams.AccessCountryRule
-    | GroupCreateParams.AccessAuthenticationMethodRule
-    | GroupCreateParams.AccessDevicePostureRule
-  >;
-}
-
-export namespace GroupCreateParams {
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-}
-
-export interface GroupUpdateParams {
-  /**
-   * Body param: Rules evaluated with an OR logical operator. A user needs to meet
-   * only one of the Include rules.
-   */
-  include: Array<
-    | GroupUpdateParams.AccessEmailRule
-    | GroupUpdateParams.AccessEmailListRule
-    | GroupUpdateParams.AccessDomainRule
-    | GroupUpdateParams.AccessEveryoneRule
-    | GroupUpdateParams.AccessIPRule
-    | GroupUpdateParams.AccessIPListRule
-    | GroupUpdateParams.AccessCertificateRule
-    | GroupUpdateParams.AccessAccessGroupRule
-    | GroupUpdateParams.AccessAzureGroupRule
-    | GroupUpdateParams.AccessGitHubOrganizationRule
-    | GroupUpdateParams.AccessGsuiteGroupRule
-    | GroupUpdateParams.AccessOktaGroupRule
-    | GroupUpdateParams.AccessSamlGroupRule
-    | GroupUpdateParams.AccessServiceTokenRule
-    | GroupUpdateParams.AccessAnyValidServiceTokenRule
-    | GroupUpdateParams.AccessExternalEvaluationRule
-    | GroupUpdateParams.AccessCountryRule
-    | GroupUpdateParams.AccessAuthenticationMethodRule
-    | GroupUpdateParams.AccessDevicePostureRule
-  >;
-
-  /**
-   * Body param: The name of the Access group.
-   */
-  name: string;
-
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
-
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
-
-  /**
-   * Body param: Rules evaluated with a NOT logical operator. To match a policy, a
-   * user cannot meet any of the Exclude rules.
-   */
-  exclude?: Array<
-    | GroupUpdateParams.AccessEmailRule
-    | GroupUpdateParams.AccessEmailListRule
-    | GroupUpdateParams.AccessDomainRule
-    | GroupUpdateParams.AccessEveryoneRule
-    | GroupUpdateParams.AccessIPRule
-    | GroupUpdateParams.AccessIPListRule
-    | GroupUpdateParams.AccessCertificateRule
-    | GroupUpdateParams.AccessAccessGroupRule
-    | GroupUpdateParams.AccessAzureGroupRule
-    | GroupUpdateParams.AccessGitHubOrganizationRule
-    | GroupUpdateParams.AccessGsuiteGroupRule
-    | GroupUpdateParams.AccessOktaGroupRule
-    | GroupUpdateParams.AccessSamlGroupRule
-    | GroupUpdateParams.AccessServiceTokenRule
-    | GroupUpdateParams.AccessAnyValidServiceTokenRule
-    | GroupUpdateParams.AccessExternalEvaluationRule
-    | GroupUpdateParams.AccessCountryRule
-    | GroupUpdateParams.AccessAuthenticationMethodRule
-    | GroupUpdateParams.AccessDevicePostureRule
-  >;
-
-  /**
-   * Body param: Whether this is the default group
-   */
-  is_default?: boolean;
-
-  /**
-   * Body param: Rules evaluated with an AND logical operator. To match a policy, a
-   * user must meet all of the Require rules.
-   */
-  require?: Array<
-    | GroupUpdateParams.AccessEmailRule
-    | GroupUpdateParams.AccessEmailListRule
-    | GroupUpdateParams.AccessDomainRule
-    | GroupUpdateParams.AccessEveryoneRule
-    | GroupUpdateParams.AccessIPRule
-    | GroupUpdateParams.AccessIPListRule
-    | GroupUpdateParams.AccessCertificateRule
-    | GroupUpdateParams.AccessAccessGroupRule
-    | GroupUpdateParams.AccessAzureGroupRule
-    | GroupUpdateParams.AccessGitHubOrganizationRule
-    | GroupUpdateParams.AccessGsuiteGroupRule
-    | GroupUpdateParams.AccessOktaGroupRule
-    | GroupUpdateParams.AccessSamlGroupRule
-    | GroupUpdateParams.AccessServiceTokenRule
-    | GroupUpdateParams.AccessAnyValidServiceTokenRule
-    | GroupUpdateParams.AccessExternalEvaluationRule
-    | GroupUpdateParams.AccessCountryRule
-    | GroupUpdateParams.AccessAuthenticationMethodRule
-    | GroupUpdateParams.AccessDevicePostureRule
-  >;
-}
-
-export namespace GroupUpdateParams {
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
-
-  /**
-   * Matches a specific email.
-   */
-  export interface AccessEmailRule {
-    email: AccessEmailRule.Email;
-  }
-
-  export namespace AccessEmailRule {
-    export interface Email {
-      /**
-       * The email of the user.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an email address from a list.
-   */
-  export interface AccessEmailListRule {
-    email_list: AccessEmailListRule.EmailList;
-  }
-
-  export namespace AccessEmailListRule {
-    export interface EmailList {
-      /**
-       * The ID of a previously created email list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Match an entire email domain.
-   */
-  export interface AccessDomainRule {
-    email_domain: AccessDomainRule.EmailDomain;
-  }
-
-  export namespace AccessDomainRule {
-    export interface EmailDomain {
-      /**
-       * The email domain to match.
-       */
-      domain: string;
-    }
-  }
-
-  /**
-   * Matches everyone.
-   */
-  export interface AccessEveryoneRule {
-    /**
-     * An empty object which matches on all users.
-     */
-    everyone: unknown;
-  }
-
-  /**
-   * Matches an IP address block.
-   */
-  export interface AccessIPRule {
-    ip: AccessIPRule.IP;
-  }
-
-  export namespace AccessIPRule {
-    export interface IP {
-      /**
-       * An IPv4 or IPv6 CIDR block.
-       */
-      ip: string;
-    }
-  }
-
-  /**
-   * Matches an IP address from a list.
-   */
-  export interface AccessIPListRule {
-    ip_list: AccessIPListRule.IPList;
-  }
-
-  export namespace AccessIPListRule {
-    export interface IPList {
-      /**
-       * The ID of a previously created IP list.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches any valid client certificate.
-   */
-  export interface AccessCertificateRule {
-    certificate: unknown;
-  }
-
-  /**
-   * Matches an Access group.
-   */
-  export interface AccessAccessGroupRule {
-    group: AccessAccessGroupRule.Group;
-  }
-
-  export namespace AccessAccessGroupRule {
-    export interface Group {
-      /**
-       * The ID of a previously created Access group.
-       */
-      id: string;
-    }
-  }
-
-  /**
-   * Matches an Azure group. Requires an Azure identity provider.
-   */
-  export interface AccessAzureGroupRule {
-    azureAD: AccessAzureGroupRule.AzureAd;
-  }
-
-  export namespace AccessAzureGroupRule {
-    export interface AzureAd {
-      /**
-       * The ID of an Azure group.
-       */
-      id: string;
-
-      /**
-       * The ID of your Azure identity provider.
-       */
-      connection_id: string;
-    }
-  }
-
-  /**
-   * Matches a Github organization. Requires a Github identity provider.
-   */
-  export interface AccessGitHubOrganizationRule {
-    'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-  }
-
-  export namespace AccessGitHubOrganizationRule {
-    export interface GitHubOrganization {
-      /**
-       * The ID of your Github identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The name of the organization.
-       */
-      name: string;
-    }
-  }
-
-  /**
-   * Matches a group in Google Workspace. Requires a Google Workspace identity
-   * provider.
-   */
-  export interface AccessGsuiteGroupRule {
-    gsuite: AccessGsuiteGroupRule.Gsuite;
-  }
-
-  export namespace AccessGsuiteGroupRule {
-    export interface Gsuite {
-      /**
-       * The ID of your Google Workspace identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Google Workspace group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches an Okta group. Requires an Okta identity provider.
-   */
-  export interface AccessOktaGroupRule {
-    okta: AccessOktaGroupRule.Okta;
-  }
-
-  export namespace AccessOktaGroupRule {
-    export interface Okta {
-      /**
-       * The ID of your Okta identity provider.
-       */
-      connection_id: string;
-
-      /**
-       * The email of the Okta group.
-       */
-      email: string;
-    }
-  }
-
-  /**
-   * Matches a SAML group. Requires a SAML identity provider.
-   */
-  export interface AccessSamlGroupRule {
-    saml: AccessSamlGroupRule.Saml;
-  }
-
-  export namespace AccessSamlGroupRule {
-    export interface Saml {
-      /**
-       * The name of the SAML attribute.
-       */
-      attribute_name: string;
-
-      /**
-       * The SAML attribute value to look for.
-       */
-      attribute_value: string;
-    }
-  }
-
-  /**
-   * Matches a specific Access Service Token
-   */
-  export interface AccessServiceTokenRule {
-    service_token: AccessServiceTokenRule.ServiceToken;
-  }
-
-  export namespace AccessServiceTokenRule {
-    export interface ServiceToken {
-      /**
-       * The ID of a Service Token.
-       */
-      token_id: string;
-    }
-  }
-
-  /**
-   * Matches any valid Access Service Token
-   */
-  export interface AccessAnyValidServiceTokenRule {
-    /**
-     * An empty object which matches on all service tokens.
-     */
-    any_valid_service_token: unknown;
-  }
-
-  /**
-   * Create Allow or Block policies which evaluate the user based on custom criteria.
-   */
-  export interface AccessExternalEvaluationRule {
-    external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-  }
-
-  export namespace AccessExternalEvaluationRule {
-    export interface ExternalEvaluation {
-      /**
-       * The API endpoint containing your business logic.
-       */
-      evaluate_url: string;
-
-      /**
-       * The API endpoint containing the key that Access uses to verify that the response
-       * came from your API.
-       */
-      keys_url: string;
-    }
-  }
-
-  /**
-   * Matches a specific country
-   */
-  export interface AccessCountryRule {
-    geo: AccessCountryRule.Geo;
-  }
-
-  export namespace AccessCountryRule {
-    export interface Geo {
-      /**
-       * The country code that should be matched.
-       */
-      country_code: string;
-    }
-  }
-
-  /**
-   * Enforce different MFA options
-   */
-  export interface AccessAuthenticationMethodRule {
-    auth_method: AccessAuthenticationMethodRule.AuthMethod;
-  }
-
-  export namespace AccessAuthenticationMethodRule {
-    export interface AuthMethod {
-      /**
-       * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-       */
-      auth_method: string;
-    }
-  }
-
-  /**
-   * Enforces a device posture rule has run successfully
-   */
-  export interface AccessDevicePostureRule {
-    device_posture: AccessDevicePostureRule.DevicePosture;
-  }
-
-  export namespace AccessDevicePostureRule {
-    export interface DevicePosture {
-      /**
-       * The ID of a device posture integration.
-       */
-      integration_uid: string;
-    }
-  }
+  require?: Array<AccessAPI.AccessRule>;
 }
 
 export interface GroupListParams {
@@ -3712,9 +361,9 @@ export interface GroupGetParams {
 }
 
 export namespace Groups {
-  export import AccessGroups = GroupsAPI.AccessGroups;
-  export import GroupListResponse = GroupsAPI.GroupListResponse;
+  export import ZeroTrustGroup = GroupsAPI.ZeroTrustGroup;
   export import GroupDeleteResponse = GroupsAPI.GroupDeleteResponse;
+  export import ZeroTrustGroupsSinglePage = GroupsAPI.ZeroTrustGroupsSinglePage;
   export import GroupCreateParams = GroupsAPI.GroupCreateParams;
   export import GroupUpdateParams = GroupsAPI.GroupUpdateParams;
   export import GroupListParams = GroupsAPI.GroupListParams;