cloudflare 3.0.0 → 3.1.0

package/resources/zero-trust/access/applications/policies.d.ts

@@ -1,21 +1,22 @@
 import * as Core from 'cloudflare/core';
 import { APIResource } from 'cloudflare/resource';
 import * as PoliciesAPI from 'cloudflare/resources/zero-trust/access/applications/policies';
+import * as AccessAPI from 'cloudflare/resources/zero-trust/access/access';
 import { SinglePage } from 'cloudflare/pagination';
 export declare class Policies extends APIResource {
     /**
      * Create a new Access policy for an application.
      */
-    create(uuid: string, params: PolicyCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustPolicies>;
+    create(uuid: string, params: PolicyCreateParams, options?: Core.RequestOptions): Core.APIPromise<Policy>;
     /**
      * Update a configured Access policy.
      */
-    update(uuid1: string, uuid: string, params: PolicyUpdateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustPolicies>;
+    update(uuid1: string, uuid: string, params: PolicyUpdateParams, options?: Core.RequestOptions): Core.APIPromise<Policy>;
     /**
      * Lists Access policies configured for an application.
      */
-    list(uuid: string, params?: PolicyListParams, options?: Core.RequestOptions): Core.PagePromise<ZeroTrustPoliciesSinglePage, ZeroTrustPolicies>;
-    list(uuid: string, options?: Core.RequestOptions): Core.PagePromise<ZeroTrustPoliciesSinglePage, ZeroTrustPolicies>;
+    list(uuid: string, params?: PolicyListParams, options?: Core.RequestOptions): Core.PagePromise<PoliciesSinglePage, Policy>;
+    list(uuid: string, options?: Core.RequestOptions): Core.PagePromise<PoliciesSinglePage, Policy>;
     /**
      * Delete an Access policy.
      */
@@ -24,12 +25,29 @@ export declare class Policies extends APIResource {
     /**
      * Fetches a single Access policy.
      */
-    get(uuid1: string, uuid: string, params?: PolicyGetParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustPolicies>;
-    get(uuid1: string, uuid: string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustPolicies>;
+    get(uuid1: string, uuid: string, params?: PolicyGetParams, options?: Core.RequestOptions): Core.APIPromise<Policy>;
+    get(uuid1: string, uuid: string, options?: Core.RequestOptions): Core.APIPromise<Policy>;
 }
-export declare class ZeroTrustPoliciesSinglePage extends SinglePage<ZeroTrustPolicies> {
+export declare class PoliciesSinglePage extends SinglePage<Policy> {
 }
-export interface ZeroTrustPolicies {
+/**
+ * A group of email addresses that can approve a temporary authentication request.
+ */
+export interface ApprovalGroup {
+    /**
+     * The number of approvals needed to obtain access.
+     */
+    approvals_needed: number;
+    /**
+     * A list of emails that can approve the access request.
+     */
+    email_addresses?: Array<string>;
+    /**
+     * The UUID of an re-usable email list.
+     */
+    email_list_uuid?: string;
+}
+export interface Policy {
     /**
      * UUID
      */
@@ -37,7 +55,7 @@ export interface ZeroTrustPolicies {
     /**
      * Administrators who can approve a temporary authentication request.
      */
-    approval_groups?: Array<ZeroTrustPolicies.ApprovalGroup>;
+    approval_groups?: Array<ApprovalGroup>;
     /**
      * Requires the user to request access from an administrator at the start of each
      * session.
@@ -52,12 +70,12 @@ export interface ZeroTrustPolicies {
      * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
      * meet any of the Exclude rules.
      */
-    exclude?: Array<ZeroTrustPolicies.AccessEmailRule | ZeroTrustPolicies.AccessEmailListRule | ZeroTrustPolicies.AccessDomainRule | ZeroTrustPolicies.AccessEveryoneRule | ZeroTrustPolicies.AccessIPRule | ZeroTrustPolicies.AccessIPListRule | ZeroTrustPolicies.AccessCertificateRule | ZeroTrustPolicies.AccessAccessGroupRule | ZeroTrustPolicies.AccessAzureGroupRule | ZeroTrustPolicies.AccessGitHubOrganizationRule | ZeroTrustPolicies.AccessGsuiteGroupRule | ZeroTrustPolicies.AccessOktaGroupRule | ZeroTrustPolicies.AccessSamlGroupRule | ZeroTrustPolicies.AccessServiceTokenRule | ZeroTrustPolicies.AccessAnyValidServiceTokenRule | ZeroTrustPolicies.AccessExternalEvaluationRule | ZeroTrustPolicies.AccessCountryRule | ZeroTrustPolicies.AccessAuthenticationMethodRule | ZeroTrustPolicies.AccessDevicePostureRule>;
+    exclude?: Array<AccessAPI.AccessRule>;
     /**
      * Rules evaluated with an OR logical operator. A user needs to meet only one of
      * the Include rules.
      */
-    include?: Array<ZeroTrustPolicies.AccessEmailRule | ZeroTrustPolicies.AccessEmailListRule | ZeroTrustPolicies.AccessDomainRule | ZeroTrustPolicies.AccessEveryoneRule | ZeroTrustPolicies.AccessIPRule | ZeroTrustPolicies.AccessIPListRule | ZeroTrustPolicies.AccessCertificateRule | ZeroTrustPolicies.AccessAccessGroupRule | ZeroTrustPolicies.AccessAzureGroupRule | ZeroTrustPolicies.AccessGitHubOrganizationRule | ZeroTrustPolicies.AccessGsuiteGroupRule | ZeroTrustPolicies.AccessOktaGroupRule | ZeroTrustPolicies.AccessSamlGroupRule | ZeroTrustPolicies.AccessServiceTokenRule | ZeroTrustPolicies.AccessAnyValidServiceTokenRule | ZeroTrustPolicies.AccessExternalEvaluationRule | ZeroTrustPolicies.AccessCountryRule | ZeroTrustPolicies.AccessAuthenticationMethodRule | ZeroTrustPolicies.AccessDevicePostureRule>;
+    include?: Array<AccessAPI.AccessRule>;
     /**
      * Require this application to be served in an isolated browser for users matching
      * this policy. 'Client Web Isolation' must be on for the account in order to use
@@ -84,7 +102,7 @@ export interface ZeroTrustPolicies {
      * Rules evaluated with an AND logical operator. To match the policy, a user must
      * meet all of the Require rules.
      */
-    require?: Array<ZeroTrustPolicies.AccessEmailRule | ZeroTrustPolicies.AccessEmailListRule | ZeroTrustPolicies.AccessDomainRule | ZeroTrustPolicies.AccessEveryoneRule | ZeroTrustPolicies.AccessIPRule | ZeroTrustPolicies.AccessIPListRule | ZeroTrustPolicies.AccessCertificateRule | ZeroTrustPolicies.AccessAccessGroupRule | ZeroTrustPolicies.AccessAzureGroupRule | ZeroTrustPolicies.AccessGitHubOrganizationRule | ZeroTrustPolicies.AccessGsuiteGroupRule | ZeroTrustPolicies.AccessOktaGroupRule | ZeroTrustPolicies.AccessSamlGroupRule | ZeroTrustPolicies.AccessServiceTokenRule | ZeroTrustPolicies.AccessAnyValidServiceTokenRule | ZeroTrustPolicies.AccessExternalEvaluationRule | ZeroTrustPolicies.AccessCountryRule | ZeroTrustPolicies.AccessAuthenticationMethodRule | ZeroTrustPolicies.AccessDevicePostureRule>;
+    require?: Array<AccessAPI.AccessRule>;
     /**
      * The amount of time that tokens issued for the application will be valid. Must be
      * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
@@ -93,847 +111,6 @@ export interface ZeroTrustPolicies {
     session_duration?: string;
     updated_at?: string;
 }
-export declare namespace ZeroTrustPolicies {
-    /**
-     * A group of email addresses that can approve a temporary authentication request.
-     */
-    interface ApprovalGroup {
-        /**
-         * The number of approvals needed to obtain access.
-         */
-        approvals_needed: number;
-        /**
-         * A list of emails that can approve the access request.
-         */
-        email_addresses?: Array<string>;
-        /**
-         * The UUID of an re-usable email list.
-         */
-        email_list_uuid?: string;
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-}
 export interface PolicyDeleteResponse {
     /**
      * UUID
@@ -949,7 +126,7 @@ export interface PolicyCreateParams {
      * Body param: Rules evaluated with an OR logical operator. A user needs to meet
      * only one of the Include rules.
      */
-    include: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    include: Array<AccessAPI.AccessRule>;
     /**
      * Body param: The name of the Access policy.
      */
@@ -967,7 +144,7 @@ export interface PolicyCreateParams {
     /**
      * Body param: Administrators who can approve a temporary authentication request.
      */
-    approval_groups?: Array<PolicyCreateParams.ApprovalGroup>;
+    approval_groups?: Array<ApprovalGroup>;
     /**
      * Body param: Requires the user to request access from an administrator at the
      * start of each session.
@@ -977,7 +154,7 @@ export interface PolicyCreateParams {
      * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
      * user cannot meet any of the Exclude rules.
      */
-    exclude?: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    exclude?: Array<AccessAPI.AccessRule>;
     /**
      * Body param: Require this application to be served in an isolated browser for
      * users matching this policy. 'Client Web Isolation' must be on for the account in
@@ -1003,7 +180,7 @@ export interface PolicyCreateParams {
      * Body param: Rules evaluated with an AND logical operator. To match the policy, a
      * user must meet all of the Require rules.
      */
-    require?: Array<PolicyCreateParams.AccessEmailRule | PolicyCreateParams.AccessEmailListRule | PolicyCreateParams.AccessDomainRule | PolicyCreateParams.AccessEveryoneRule | PolicyCreateParams.AccessIPRule | PolicyCreateParams.AccessIPListRule | PolicyCreateParams.AccessCertificateRule | PolicyCreateParams.AccessAccessGroupRule | PolicyCreateParams.AccessAzureGroupRule | PolicyCreateParams.AccessGitHubOrganizationRule | PolicyCreateParams.AccessGsuiteGroupRule | PolicyCreateParams.AccessOktaGroupRule | PolicyCreateParams.AccessSamlGroupRule | PolicyCreateParams.AccessServiceTokenRule | PolicyCreateParams.AccessAnyValidServiceTokenRule | PolicyCreateParams.AccessExternalEvaluationRule | PolicyCreateParams.AccessCountryRule | PolicyCreateParams.AccessAuthenticationMethodRule | PolicyCreateParams.AccessDevicePostureRule>;
+    require?: Array<AccessAPI.AccessRule>;
     /**
      * Body param: The amount of time that tokens issued for the application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -1011,847 +188,6 @@ export interface PolicyCreateParams {
      */
     session_duration?: string;
 }
-export declare namespace PolicyCreateParams {
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * A group of email addresses that can approve a temporary authentication request.
-     */
-    interface ApprovalGroup {
-        /**
-         * The number of approvals needed to obtain access.
-         */
-        approvals_needed: number;
-        /**
-         * A list of emails that can approve the access request.
-         */
-        email_addresses?: Array<string>;
-        /**
-         * The UUID of an re-usable email list.
-         */
-        email_list_uuid?: string;
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-}
 export interface PolicyUpdateParams {
     /**
      * Body param: The action Access will take if a user matches this policy.
@@ -1861,7 +197,7 @@ export interface PolicyUpdateParams {
      * Body param: Rules evaluated with an OR logical operator. A user needs to meet
      * only one of the Include rules.
      */
-    include: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    include: Array<AccessAPI.AccessRule>;
     /**
      * Body param: The name of the Access policy.
      */
@@ -1879,7 +215,7 @@ export interface PolicyUpdateParams {
     /**
      * Body param: Administrators who can approve a temporary authentication request.
      */
-    approval_groups?: Array<PolicyUpdateParams.ApprovalGroup>;
+    approval_groups?: Array<ApprovalGroup>;
     /**
      * Body param: Requires the user to request access from an administrator at the
      * start of each session.
@@ -1889,7 +225,7 @@ export interface PolicyUpdateParams {
      * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
      * user cannot meet any of the Exclude rules.
      */
-    exclude?: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    exclude?: Array<AccessAPI.AccessRule>;
     /**
      * Body param: Require this application to be served in an isolated browser for
      * users matching this policy. 'Client Web Isolation' must be on for the account in
@@ -1915,7 +251,7 @@ export interface PolicyUpdateParams {
      * Body param: Rules evaluated with an AND logical operator. To match the policy, a
      * user must meet all of the Require rules.
      */
-    require?: Array<PolicyUpdateParams.AccessEmailRule | PolicyUpdateParams.AccessEmailListRule | PolicyUpdateParams.AccessDomainRule | PolicyUpdateParams.AccessEveryoneRule | PolicyUpdateParams.AccessIPRule | PolicyUpdateParams.AccessIPListRule | PolicyUpdateParams.AccessCertificateRule | PolicyUpdateParams.AccessAccessGroupRule | PolicyUpdateParams.AccessAzureGroupRule | PolicyUpdateParams.AccessGitHubOrganizationRule | PolicyUpdateParams.AccessGsuiteGroupRule | PolicyUpdateParams.AccessOktaGroupRule | PolicyUpdateParams.AccessSamlGroupRule | PolicyUpdateParams.AccessServiceTokenRule | PolicyUpdateParams.AccessAnyValidServiceTokenRule | PolicyUpdateParams.AccessExternalEvaluationRule | PolicyUpdateParams.AccessCountryRule | PolicyUpdateParams.AccessAuthenticationMethodRule | PolicyUpdateParams.AccessDevicePostureRule>;
+    require?: Array<AccessAPI.AccessRule>;
     /**
      * Body param: The amount of time that tokens issued for the application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -1923,847 +259,6 @@ export interface PolicyUpdateParams {
      */
     session_duration?: string;
 }
-export declare namespace PolicyUpdateParams {
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * A group of email addresses that can approve a temporary authentication request.
-     */
-    interface ApprovalGroup {
-        /**
-         * The number of approvals needed to obtain access.
-         */
-        approvals_needed: number;
-        /**
-         * A list of emails that can approve the access request.
-         */
-        email_addresses?: Array<string>;
-        /**
-         * The UUID of an re-usable email list.
-         */
-        email_list_uuid?: string;
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-    /**
-     * Matches a specific email.
-     */
-    interface AccessEmailRule {
-        email: AccessEmailRule.Email;
-    }
-    namespace AccessEmailRule {
-        interface Email {
-            /**
-             * The email of the user.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an email address from a list.
-     */
-    interface AccessEmailListRule {
-        email_list: AccessEmailListRule.EmailList;
-    }
-    namespace AccessEmailListRule {
-        interface EmailList {
-            /**
-             * The ID of a previously created email list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Match an entire email domain.
-     */
-    interface AccessDomainRule {
-        email_domain: AccessDomainRule.EmailDomain;
-    }
-    namespace AccessDomainRule {
-        interface EmailDomain {
-            /**
-             * The email domain to match.
-             */
-            domain: string;
-        }
-    }
-    /**
-     * Matches everyone.
-     */
-    interface AccessEveryoneRule {
-        /**
-         * An empty object which matches on all users.
-         */
-        everyone: unknown;
-    }
-    /**
-     * Matches an IP address block.
-     */
-    interface AccessIPRule {
-        ip: AccessIPRule.IP;
-    }
-    namespace AccessIPRule {
-        interface IP {
-            /**
-             * An IPv4 or IPv6 CIDR block.
-             */
-            ip: string;
-        }
-    }
-    /**
-     * Matches an IP address from a list.
-     */
-    interface AccessIPListRule {
-        ip_list: AccessIPListRule.IPList;
-    }
-    namespace AccessIPListRule {
-        interface IPList {
-            /**
-             * The ID of a previously created IP list.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches any valid client certificate.
-     */
-    interface AccessCertificateRule {
-        certificate: unknown;
-    }
-    /**
-     * Matches an Access group.
-     */
-    interface AccessAccessGroupRule {
-        group: AccessAccessGroupRule.Group;
-    }
-    namespace AccessAccessGroupRule {
-        interface Group {
-            /**
-             * The ID of a previously created Access group.
-             */
-            id: string;
-        }
-    }
-    /**
-     * Matches an Azure group. Requires an Azure identity provider.
-     */
-    interface AccessAzureGroupRule {
-        azureAD: AccessAzureGroupRule.AzureAd;
-    }
-    namespace AccessAzureGroupRule {
-        interface AzureAd {
-            /**
-             * The ID of an Azure group.
-             */
-            id: string;
-            /**
-             * The ID of your Azure identity provider.
-             */
-            connection_id: string;
-        }
-    }
-    /**
-     * Matches a Github organization. Requires a Github identity provider.
-     */
-    interface AccessGitHubOrganizationRule {
-        'github-organization': AccessGitHubOrganizationRule.GitHubOrganization;
-    }
-    namespace AccessGitHubOrganizationRule {
-        interface GitHubOrganization {
-            /**
-             * The ID of your Github identity provider.
-             */
-            connection_id: string;
-            /**
-             * The name of the organization.
-             */
-            name: string;
-        }
-    }
-    /**
-     * Matches a group in Google Workspace. Requires a Google Workspace identity
-     * provider.
-     */
-    interface AccessGsuiteGroupRule {
-        gsuite: AccessGsuiteGroupRule.Gsuite;
-    }
-    namespace AccessGsuiteGroupRule {
-        interface Gsuite {
-            /**
-             * The ID of your Google Workspace identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Google Workspace group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches an Okta group. Requires an Okta identity provider.
-     */
-    interface AccessOktaGroupRule {
-        okta: AccessOktaGroupRule.Okta;
-    }
-    namespace AccessOktaGroupRule {
-        interface Okta {
-            /**
-             * The ID of your Okta identity provider.
-             */
-            connection_id: string;
-            /**
-             * The email of the Okta group.
-             */
-            email: string;
-        }
-    }
-    /**
-     * Matches a SAML group. Requires a SAML identity provider.
-     */
-    interface AccessSamlGroupRule {
-        saml: AccessSamlGroupRule.Saml;
-    }
-    namespace AccessSamlGroupRule {
-        interface Saml {
-            /**
-             * The name of the SAML attribute.
-             */
-            attribute_name: string;
-            /**
-             * The SAML attribute value to look for.
-             */
-            attribute_value: string;
-        }
-    }
-    /**
-     * Matches a specific Access Service Token
-     */
-    interface AccessServiceTokenRule {
-        service_token: AccessServiceTokenRule.ServiceToken;
-    }
-    namespace AccessServiceTokenRule {
-        interface ServiceToken {
-            /**
-             * The ID of a Service Token.
-             */
-            token_id: string;
-        }
-    }
-    /**
-     * Matches any valid Access Service Token
-     */
-    interface AccessAnyValidServiceTokenRule {
-        /**
-         * An empty object which matches on all service tokens.
-         */
-        any_valid_service_token: unknown;
-    }
-    /**
-     * Create Allow or Block policies which evaluate the user based on custom criteria.
-     */
-    interface AccessExternalEvaluationRule {
-        external_evaluation: AccessExternalEvaluationRule.ExternalEvaluation;
-    }
-    namespace AccessExternalEvaluationRule {
-        interface ExternalEvaluation {
-            /**
-             * The API endpoint containing your business logic.
-             */
-            evaluate_url: string;
-            /**
-             * The API endpoint containing the key that Access uses to verify that the response
-             * came from your API.
-             */
-            keys_url: string;
-        }
-    }
-    /**
-     * Matches a specific country
-     */
-    interface AccessCountryRule {
-        geo: AccessCountryRule.Geo;
-    }
-    namespace AccessCountryRule {
-        interface Geo {
-            /**
-             * The country code that should be matched.
-             */
-            country_code: string;
-        }
-    }
-    /**
-     * Enforce different MFA options
-     */
-    interface AccessAuthenticationMethodRule {
-        auth_method: AccessAuthenticationMethodRule.AuthMethod;
-    }
-    namespace AccessAuthenticationMethodRule {
-        interface AuthMethod {
-            /**
-             * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176.
-             */
-            auth_method: string;
-        }
-    }
-    /**
-     * Enforces a device posture rule has run successfully
-     */
-    interface AccessDevicePostureRule {
-        device_posture: AccessDevicePostureRule.DevicePosture;
-    }
-    namespace AccessDevicePostureRule {
-        interface DevicePosture {
-            /**
-             * The ID of a device posture integration.
-             */
-            integration_uid: string;
-        }
-    }
-}
 export interface PolicyListParams {
     /**
      * The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
@@ -2795,9 +290,10 @@ export interface PolicyGetParams {
     zone_id?: string;
 }
 export declare namespace Policies {
-    export import ZeroTrustPolicies = PoliciesAPI.ZeroTrustPolicies;
+    export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+    export import Policy = PoliciesAPI.Policy;
     export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
-    export import ZeroTrustPoliciesSinglePage = PoliciesAPI.ZeroTrustPoliciesSinglePage;
+    export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
     export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
     export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
     export import PolicyListParams = PoliciesAPI.PolicyListParams;