cloudflare 3.0.0 → 3.1.0

package/resources/zero-trust/access/applications/applications.d.ts

@@ -12,36 +12,47 @@ export declare class Applications extends APIResource {
     /**
      * Adds a new application to Access.
      */
-    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Updates an Access application.
      */
-    update(appId: string | string, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    update(appId: AppID, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Lists all Access applications in an account or zone.
      */
-    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
-    list(options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
+    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
+    list(options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
     /**
      * Deletes an application from Access.
      */
-    delete(appId: string | string, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
-    delete(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppID, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
     /**
      * Fetches information about an Access application.
      */
-    get(appId: string | string, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
-    get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    get(appId: AppID, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
+    get(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Revokes all tokens issued for an application.
      */
-    revokeTokens(appId: string | string, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
-    revokeTokens(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppID, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppID, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
 }
-export declare class ZeroTrustAppsSinglePage extends SinglePage<ZeroTrustApps> {
+export declare class ApplicationsSinglePage extends SinglePage<Application> {
 }
-export type ZeroTrustApps = ZeroTrustApps.SelfHostedApplication | ZeroTrustApps.SaaSApplication | ZeroTrustApps.BrowserSSHApplication | ZeroTrustApps.BrowserVncApplication | ZeroTrustApps.AppLauncherApplication | ZeroTrustApps.DeviceEnrollmentPermissionsApplication | ZeroTrustApps.BrowserIsolationPermissionsApplication | ZeroTrustApps.BookmarkApplication;
-export declare namespace ZeroTrustApps {
+export type AllowedHeadersh = string;
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdpsh = string;
+export type AllowedMethodsh = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH';
+export type AllowedOriginsh = string;
+/**
+ * Identifier
+ */
+export type AppID = string | string;
+export type Application = Application.SelfHostedApplication | Application.SaaSApplication | Application.BrowserSSHApplication | Application.BrowserVncApplication | Application.AppLauncherApplication | Application.DeviceEnrollmentPermissionsApplication | Application.BrowserIsolationPermissionsApplication | Application.BookmarkApplication;
+export declare namespace Application {
     interface SelfHostedApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -67,7 +78,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -81,7 +92,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: SelfHostedApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -101,7 +112,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -120,6 +131,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -133,7 +149,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -155,43 +171,6 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * UUID
@@ -201,7 +180,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -219,7 +198,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * The image URL for the logo shown in the App Launcher dashboard.
          */
@@ -228,7 +207,7 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
-        saas_app?: SaaSApplication.AccessSamlSaasApp | SaaSApplication.AccessOidcSaasApp;
+        saas_app?: ApplicationsAPI.SAMLSaaSApp | SaaSApplication.AccessOIDCSaaSApp;
         /**
          * The tags you want assigned to an application. Tags are used to filter
          * applications in the App Launcher dashboard.
@@ -241,83 +220,7 @@ export declare namespace ZeroTrustApps {
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            created_at?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-            updated_at?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -336,6 +239,7 @@ export declare namespace ZeroTrustApps {
              */
             client_secret?: string;
             created_at?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -359,6 +263,35 @@ export declare namespace ZeroTrustApps {
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
             updated_at?: string;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -385,7 +318,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -399,7 +332,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserSSHApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -419,7 +352,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -438,6 +371,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -451,7 +389,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -473,43 +411,6 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -535,7 +436,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -549,7 +450,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserVncApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -569,7 +470,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The custom pages that will be displayed when applicable for this application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<ApplicationsAPI.CustomPagesh>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -588,6 +489,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -601,7 +507,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomainsh>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -623,43 +529,6 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * The application type.
@@ -673,7 +542,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -714,7 +583,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -755,7 +624,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdpsh>;
         /**
          * Audience tag.
          */
@@ -821,6 +690,143 @@ export declare namespace ZeroTrustApps {
         updated_at?: string;
     }
 }
+export interface CORSHeaders {
+    /**
+     * Allows all HTTP request headers.
+     */
+    allow_all_headers?: boolean;
+    /**
+     * Allows all HTTP request methods.
+     */
+    allow_all_methods?: boolean;
+    /**
+     * Allows all origins.
+     */
+    allow_all_origins?: boolean;
+    /**
+     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+     * client certificates) with requests.
+     */
+    allow_credentials?: boolean;
+    /**
+     * Allowed HTTP request headers.
+     */
+    allowed_headers?: Array<AllowedHeadersh>;
+    /**
+     * Allowed HTTP request methods.
+     */
+    allowed_methods?: Array<AllowedMethodsh>;
+    /**
+     * Allowed origins.
+     */
+    allowed_origins?: Array<AllowedOriginsh>;
+    /**
+     * The maximum number of seconds the results of a preflight request can be cached.
+     */
+    max_age?: number;
+}
+/**
+ * The custom pages selected for application.
+ */
+export type CustomPagesh = string;
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormat = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormat = 'id' | 'email';
+export interface SaaSAppSource {
+    /**
+     * The name of the IdP attribute.
+     */
+    name?: string;
+    /**
+     * A mapping from IdP ID to attribute name.
+     */
+    name_by_idp?: Record<string, string>;
+}
+export interface SAMLSaaSApp {
+    /**
+     * Optional identifier indicating the authentication protocol used for the saas
+     * app. Required for OIDC. Default if unset is "saml"
+     */
+    auth_type?: 'saml' | 'oidc';
+    /**
+     * The service provider's endpoint that is responsible for receiving and parsing a
+     * SAML assertion.
+     */
+    consumer_service_url?: string;
+    created_at?: string;
+    custom_attributes?: SAMLSaaSApp.CustomAttributes;
+    /**
+     * The URL that the user will be redirected to after a successful login for IDP
+     * initiated logins.
+     */
+    default_relay_state?: string;
+    /**
+     * The unique identifier for your SaaS application.
+     */
+    idp_entity_id?: string;
+    /**
+     * The format of the name identifier sent to the SaaS application.
+     */
+    name_id_format?: SaaSAppNameIDFormat;
+    /**
+     * A [JSONata](https://jsonata.org/) expression that transforms an application's
+     * user identities into a NameID value for its SAML assertion. This expression
+     * should evaluate to a singular string. The output of this expression can override
+     * the `name_id_format` setting.
+     */
+    name_id_transform_jsonata?: string;
+    /**
+     * The Access public certificate that will be used to verify your identity.
+     */
+    public_key?: string;
+    /**
+     * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+     * user identities into attribute assertions in the SAML response. The expression
+     * can transform id, email, name, and groups values. It can also transform fields
+     * listed in the saml_attributes or oidc_fields of the identity provider used to
+     * authenticate. The output of this expression must be a JSON object.
+     */
+    saml_attribute_transform_jsonata?: string;
+    /**
+     * A globally unique name for an identity or service provider.
+     */
+    sp_entity_id?: string;
+    /**
+     * The endpoint where your SaaS application will send login requests.
+     */
+    sso_endpoint?: string;
+    updated_at?: string;
+}
+export declare namespace SAMLSaaSApp {
+    interface CustomAttributes {
+        /**
+         * The SAML FriendlyName of the attribute.
+         */
+        friendly_name?: string;
+        /**
+         * The name of the attribute.
+         */
+        name?: string;
+        /**
+         * A globally unique name for an identity or service provider.
+         */
+        name_format?: ApplicationsAPI.SaaSAppNameFormat;
+        /**
+         * If the attribute is required when building a SAML assertion.
+         */
+        required?: boolean;
+        source?: ApplicationsAPI.SaaSAppSource;
+    }
+}
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomainsh = string;
 export interface ApplicationDeleteResponse {
     /**
      * UUID
@@ -862,7 +868,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -875,7 +881,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.SelfHostedApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -895,7 +901,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -914,6 +920,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -927,7 +938,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -949,43 +960,6 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -1001,7 +975,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1015,7 +989,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
@@ -1027,7 +1001,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        saas_app?: ApplicationCreateParams.SaaSApplication.AccessSamlSaasApp | ApplicationCreateParams.SaaSApplication.AccessOidcSaasApp;
+        saas_app?: SAMLSaaSApp | ApplicationCreateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
          * Body param: The tags you want assigned to an application. Tags are used to
          * filter applications in the App Launcher dashboard.
@@ -1039,81 +1013,7 @@ export declare namespace ApplicationCreateParams {
         type?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -1131,6 +1031,7 @@ export declare namespace ApplicationCreateParams {
              * The application client secret, only returned on POST request.
              */
             client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -1153,6 +1054,35 @@ export declare namespace ApplicationCreateParams {
              */
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -1186,7 +1116,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1199,7 +1129,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.BrowserSSHApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1219,7 +1149,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -1238,6 +1168,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1251,7 +1186,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1273,43 +1208,6 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * Body param: The primary hostname and path that Access will secure. If the app is
@@ -1342,7 +1240,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1355,7 +1253,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.BrowserVncApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1375,7 +1273,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -1394,6 +1292,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1407,7 +1310,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1429,43 +1332,6 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * Body param: The application type.
@@ -1485,7 +1351,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1517,7 +1383,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1549,7 +1415,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1634,7 +1500,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1647,7 +1513,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.SelfHostedApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1667,7 +1533,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -1686,6 +1552,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1699,7 +1570,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1721,43 +1592,6 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -1773,7 +1607,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1787,7 +1621,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: The image URL for the logo shown in the App Launcher dashboard.
          */
@@ -1799,7 +1633,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        saas_app?: ApplicationUpdateParams.SaaSApplication.AccessSamlSaasApp | ApplicationUpdateParams.SaaSApplication.AccessOidcSaasApp;
+        saas_app?: SAMLSaaSApp | ApplicationUpdateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
          * Body param: The tags you want assigned to an application. Tags are used to
          * filter applications in the App Launcher dashboard.
@@ -1811,81 +1645,7 @@ export declare namespace ApplicationUpdateParams {
         type?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -1903,6 +1663,7 @@ export declare namespace ApplicationUpdateParams {
              * The application client secret, only returned on POST request.
              */
             client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -1925,6 +1686,35 @@ export declare namespace ApplicationUpdateParams {
              */
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -1958,7 +1748,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1971,7 +1761,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.BrowserSSHApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1991,7 +1781,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -2010,6 +1800,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -2023,7 +1818,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -2045,43 +1840,6 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * Body param: The primary hostname and path that Access will secure. If the app is
@@ -2114,7 +1872,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -2127,7 +1885,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.BrowserVncApplication.CorsHeaders;
+        cors_headers?: CORSHeaders;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -2147,7 +1905,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The custom pages that will be displayed when applicable for this
          * application
          */
-        custom_pages?: Array<string>;
+        custom_pages?: Array<CustomPagesh>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -2166,6 +1924,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -2179,7 +1942,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsh>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -2201,43 +1964,6 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * Body param: The application type.
@@ -2257,7 +1983,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2289,7 +2015,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2321,7 +2047,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdpsh>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2413,10 +2139,22 @@ export interface ApplicationRevokeTokensParams {
     zone_id?: string;
 }
 export declare namespace Applications {
-    export import ZeroTrustApps = ApplicationsAPI.ZeroTrustApps;
+    export import AllowedHeadersh = ApplicationsAPI.AllowedHeadersh;
+    export import AllowedIdpsh = ApplicationsAPI.AllowedIdpsh;
+    export import AllowedMethodsh = ApplicationsAPI.AllowedMethodsh;
+    export import AllowedOriginsh = ApplicationsAPI.AllowedOriginsh;
+    export import AppID = ApplicationsAPI.AppID;
+    export import Application = ApplicationsAPI.Application;
+    export import CORSHeaders = ApplicationsAPI.CORSHeaders;
+    export import CustomPagesh = ApplicationsAPI.CustomPagesh;
+    export import SaaSAppNameFormat = ApplicationsAPI.SaaSAppNameFormat;
+    export import SaaSAppNameIDFormat = ApplicationsAPI.SaaSAppNameIDFormat;
+    export import SaaSAppSource = ApplicationsAPI.SaaSAppSource;
+    export import SAMLSaaSApp = ApplicationsAPI.SAMLSaaSApp;
+    export import SelfHostedDomainsh = ApplicationsAPI.SelfHostedDomainsh;
     export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
     export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
-    export import ZeroTrustAppsSinglePage = ApplicationsAPI.ZeroTrustAppsSinglePage;
+    export import ApplicationsSinglePage = ApplicationsAPI.ApplicationsSinglePage;
     export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
     export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
     export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -2424,22 +2162,24 @@ export declare namespace Applications {
     export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
     export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
     export import CAs = CAsAPI.CAs;
-    export import ZeroTrustCA = CAsAPI.ZeroTrustCA;
+    export import CA = CAsAPI.CA;
     export import CACreateResponse = CAsAPI.CACreateResponse;
     export import CADeleteResponse = CAsAPI.CADeleteResponse;
     export import CAGetResponse = CAsAPI.CAGetResponse;
-    export import ZeroTrustCAsSinglePage = CAsAPI.ZeroTrustCAsSinglePage;
+    export import CAsSinglePage = CAsAPI.CAsSinglePage;
     export import CACreateParams = CAsAPI.CACreateParams;
     export import CAListParams = CAsAPI.CAListParams;
     export import CADeleteParams = CAsAPI.CADeleteParams;
     export import CAGetParams = CAsAPI.CAGetParams;
     export import UserPolicyChecks = UserPolicyChecksAPI.UserPolicyChecks;
+    export import UserPolicyCheckGeo = UserPolicyChecksAPI.UserPolicyCheckGeo;
     export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
     export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
     export import Policies = PoliciesAPI.Policies;
-    export import ZeroTrustPolicies = PoliciesAPI.ZeroTrustPolicies;
+    export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+    export import Policy = PoliciesAPI.Policy;
     export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
-    export import ZeroTrustPoliciesSinglePage = PoliciesAPI.ZeroTrustPoliciesSinglePage;
+    export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
     export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
     export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
     export import PolicyListParams = PoliciesAPI.PolicyListParams;