cloudflare 3.0.0 → 3.1.0

package/resources/zero-trust/gateway/rules.d.ts

@@ -6,15 +6,15 @@ export declare class Rules extends APIResource {
     /**
      * Creates a new Zero Trust Gateway rule.
      */
-    create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGatewayRules>;
+    create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
      * Updates a configured Zero Trust Gateway rule.
      */
-    update(ruleId: string, params: RuleUpdateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGatewayRules>;
+    update(ruleId: string, params: RuleUpdateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
      * Fetches the Zero Trust Gateway rules for an account.
      */
-    list(params: RuleListParams, options?: Core.RequestOptions): Core.PagePromise<ZeroTrustGatewayRulesSinglePage, ZeroTrustGatewayRules>;
+    list(params: RuleListParams, options?: Core.RequestOptions): Core.PagePromise<GatewayRulesSinglePage, GatewayRule>;
     /**
      * Deletes a Zero Trust Gateway rule.
      */
@@ -22,11 +22,55 @@ export declare class Rules extends APIResource {
     /**
      * Fetches a single Zero Trust Gateway rule.
      */
-    get(ruleId: string, params: RuleGetParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGatewayRules>;
+    get(ruleId: string, params: RuleGetParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
 }
-export declare class ZeroTrustGatewayRulesSinglePage extends SinglePage<ZeroTrustGatewayRules> {
+export declare class GatewayRulesSinglePage extends SinglePage<GatewayRule> {
 }
-export interface ZeroTrustGatewayRules {
+export interface DNSResolverSettingsV4 {
+    /**
+     * IPv4 address of upstream resolver.
+     */
+    ip: string;
+    /**
+     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     */
+    port?: number;
+    /**
+     * Whether to connect to this resolver over a private network. Must be set when
+     * vnet_id is set.
+     */
+    route_through_private_network?: boolean;
+    /**
+     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * network id if omitted.
+     */
+    vnet_id?: string;
+}
+export interface DNSResolverSettingsV6 {
+    /**
+     * IPv6 address of upstream resolver.
+     */
+    ip: string;
+    /**
+     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     */
+    port?: number;
+    /**
+     * Whether to connect to this resolver over a private network. Must be set when
+     * vnet_id is set.
+     */
+    route_through_private_network?: boolean;
+    /**
+     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * network id if omitted.
+     */
+    vnet_id?: string;
+}
+/**
+ * The protocol or layer to use.
+ */
+export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress';
+export interface GatewayRule {
     /**
      * The API resource UUID.
      */
@@ -35,7 +79,7 @@ export interface ZeroTrustGatewayRules {
      * The action to preform when the associated traffic, identity, and device posture
      * expressions are either absent or evaluate to `true`.
      */
-    action?: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh';
+    action?: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh' | 'resolve';
     created_at?: string;
     /**
      * Date of deletion, if any.
@@ -57,7 +101,7 @@ export interface ZeroTrustGatewayRules {
      * The protocol or layer to evaluate the traffic, identity, and device posture
      * expressions.
      */
-    filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+    filters?: Array<GatewayFilter>;
     /**
      * The wirefilter expression used for identity matching.
      */
@@ -75,346 +119,305 @@ export interface ZeroTrustGatewayRules {
     /**
      * Additional settings that modify the rule's action.
      */
-    rule_settings?: ZeroTrustGatewayRules.RuleSettings;
+    rule_settings?: RuleSetting;
     /**
      * The schedule for activating DNS policies. This does not apply to HTTP or network
      * policies.
      */
-    schedule?: ZeroTrustGatewayRules.Schedule;
+    schedule?: Schedule;
     /**
      * The wirefilter expression used for traffic matching.
      */
     traffic?: string;
     updated_at?: string;
 }
-export declare namespace ZeroTrustGatewayRules {
+/**
+ * Additional settings that modify the rule's action.
+ */
+export interface RuleSetting {
     /**
-     * Additional settings that modify the rule's action.
+     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
+     * header names, pointing to an array with its header value(s).
      */
-    interface RuleSettings {
-        /**
-         * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-         * header names, pointing to an array with its header value(s).
-         */
-        add_headers?: unknown;
-        /**
-         * Set by parent MSP accounts to enable their children to bypass this rule.
-         */
-        allow_child_bypass?: boolean;
-        /**
-         * Settings for the Audit SSH action.
-         */
-        audit_ssh?: RuleSettings.AuditSSH;
-        /**
-         * Configure how browser isolation behaves.
-         */
-        biso_admin_controls?: RuleSettings.BisoAdminControls;
-        /**
-         * Enable the custom block page.
-         */
-        block_page_enabled?: boolean;
-        /**
-         * The text describing why this block occurred, displayed on the custom block page
-         * (if enabled).
-         */
-        block_reason?: string;
-        /**
-         * Set by children MSP accounts to bypass their parent's rules.
-         */
-        bypass_parent_rule?: boolean;
-        /**
-         * Configure how session check behaves.
-         */
-        check_session?: RuleSettings.CheckSession;
-        /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
-         */
-        dns_resolvers?: RuleSettings.DNSResolvers;
-        /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
-         * WARP IPs.
-         */
-        egress?: RuleSettings.Egress;
-        /**
-         * INSECURE - disable DNSSEC validation (for Allow actions).
-         */
-        insecure_disable_dnssec_validation?: boolean;
-        /**
-         * Set to true to enable IPs in DNS resolver category blocks. By default categories
-         * only block based on domain names.
-         */
-        ip_categories?: boolean;
-        /**
-         * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-         * indicator feeds only block based on domain names.
-         */
-        ip_indicator_feeds?: boolean;
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        l4override?: RuleSettings.L4override;
+    add_headers?: unknown;
+    /**
+     * Set by parent MSP accounts to enable their children to bypass this rule.
+     */
+    allow_child_bypass?: boolean;
+    /**
+     * Settings for the Audit SSH action.
+     */
+    audit_ssh?: RuleSetting.AuditSSH;
+    /**
+     * Configure how browser isolation behaves.
+     */
+    biso_admin_controls?: RuleSetting.BisoAdminControls;
+    /**
+     * Enable the custom block page.
+     */
+    block_page_enabled?: boolean;
+    /**
+     * The text describing why this block occurred, displayed on the custom block page
+     * (if enabled).
+     */
+    block_reason?: string;
+    /**
+     * Set by children MSP accounts to bypass their parent's rules.
+     */
+    bypass_parent_rule?: boolean;
+    /**
+     * Configure how session check behaves.
+     */
+    check_session?: RuleSetting.CheckSession;
+    /**
+     * Add your own custom resolvers to route queries that match the resolver policy.
+     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+     * route to the address closest to their origin. Only valid when a rule's action is
+     * set to 'resolve'.
+     */
+    dns_resolvers?: RuleSetting.DNSResolvers;
+    /**
+     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+     * rules with Egress actions and filters, or omit it to indicate local egress via
+     * WARP IPs.
+     */
+    egress?: RuleSetting.Egress;
+    /**
+     * INSECURE - disable DNSSEC validation (for Allow actions).
+     */
+    insecure_disable_dnssec_validation?: boolean;
+    /**
+     * Set to true to enable IPs in DNS resolver category blocks. By default categories
+     * only block based on domain names.
+     */
+    ip_categories?: boolean;
+    /**
+     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
+     * indicator feeds only block based on domain names.
+     */
+    ip_indicator_feeds?: boolean;
+    /**
+     * Send matching traffic to the supplied destination IP address and port.
+     */
+    l4override?: RuleSetting.L4override;
+    /**
+     * Configure a notification to display on the user's device when this rule is
+     * matched.
+     */
+    notification_settings?: RuleSetting.NotificationSettings;
+    /**
+     * Override matching DNS queries with a hostname.
+     */
+    override_host?: string;
+    /**
+     * Override matching DNS queries with an IP or set of IPs.
+     */
+    override_ips?: Array<string>;
+    /**
+     * Configure DLP payload logging.
+     */
+    payload_log?: RuleSetting.PayloadLog;
+    /**
+     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
+     * resolver. Cannot be set when dns_resolvers are specified. Only valid when a
+     * rule's action is set to 'resolve'.
+     */
+    resolve_dns_through_cloudflare?: boolean;
+    /**
+     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     */
+    untrusted_cert?: RuleSetting.UntrustedCERT;
+}
+export declare namespace RuleSetting {
+    /**
+     * Settings for the Audit SSH action.
+     */
+    interface AuditSSH {
         /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
+         * Enable to turn on SSH command logging.
          */
-        notification_settings?: RuleSettings.NotificationSettings;
+        command_logging?: boolean;
+    }
+    /**
+     * Configure how browser isolation behaves.
+     */
+    interface BisoAdminControls {
         /**
-         * Override matching DNS queries with a hostname.
+         * Set to true to enable copy-pasting.
          */
-        override_host?: string;
+        dcp?: boolean;
         /**
-         * Override matching DNS queries with an IP or set of IPs.
+         * Set to true to enable downloading.
          */
-        override_ips?: Array<string>;
+        dd?: boolean;
         /**
-         * Configure DLP payload logging.
+         * Set to true to enable keyboard usage.
          */
-        payload_log?: RuleSettings.PayloadLog;
+        dk?: boolean;
         /**
-         * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-         * resolver. Cannot be set when dns_resolvers are specified.
+         * Set to true to enable printing.
          */
-        resolve_dns_through_cloudflare?: boolean;
+        dp?: boolean;
         /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+         * Set to true to enable uploading.
          */
-        untrusted_cert?: RuleSettings.UntrustedCERT;
+        du?: boolean;
     }
-    namespace RuleSettings {
-        /**
-         * Settings for the Audit SSH action.
-         */
-        interface AuditSSH {
-            /**
-             * Enable to turn on SSH command logging.
-             */
-            command_logging?: boolean;
-        }
+    /**
+     * Configure how session check behaves.
+     */
+    interface CheckSession {
         /**
-         * Configure how browser isolation behaves.
+         * Configure how fresh the session needs to be to be considered valid.
          */
-        interface BisoAdminControls {
-            /**
-             * Set to true to enable copy-pasting.
-             */
-            dcp?: boolean;
-            /**
-             * Set to true to enable downloading.
-             */
-            dd?: boolean;
-            /**
-             * Set to true to enable keyboard usage.
-             */
-            dk?: boolean;
-            /**
-             * Set to true to enable printing.
-             */
-            dp?: boolean;
-            /**
-             * Set to true to enable uploading.
-             */
-            du?: boolean;
-        }
+        duration?: string;
         /**
-         * Configure how session check behaves.
+         * Set to true to enable session enforcement.
          */
-        interface CheckSession {
-            /**
-             * Configure how fresh the session needs to be to be considered valid.
-             */
-            duration?: string;
-            /**
-             * Set to true to enable session enforcement.
-             */
-            enforce?: boolean;
-        }
+        enforce?: boolean;
+    }
+    /**
+     * Add your own custom resolvers to route queries that match the resolver policy.
+     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+     * route to the address closest to their origin. Only valid when a rule's action is
+     * set to 'resolve'.
+     */
+    interface DNSResolvers {
+        ipv4?: Array<RulesAPI.DNSResolverSettingsV4>;
+        ipv6?: Array<RulesAPI.DNSResolverSettingsV6>;
+    }
+    /**
+     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+     * rules with Egress actions and filters, or omit it to indicate local egress via
+     * WARP IPs.
+     */
+    interface Egress {
         /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
+         * The IPv4 address to be used for egress.
          */
-        interface DNSResolvers {
-            ipv4?: Array<DNSResolvers.IPV4>;
-            ipv6?: Array<DNSResolvers.IPV6>;
-        }
-        namespace DNSResolvers {
-            interface IPV4 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-            interface IPV6 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-        }
+        ipv4?: string;
         /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
+         * The fallback IPv4 address to be used for egress in the event of an error
+         * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
          * WARP IPs.
          */
-        interface Egress {
-            /**
-             * The IPv4 address to be used for egress.
-             */
-            ipv4?: string;
-            /**
-             * The fallback IPv4 address to be used for egress in the event of an error
-             * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-             * WARP IPs.
-             */
-            ipv4_fallback?: string;
-            /**
-             * The IPv6 range to be used for egress.
-             */
-            ipv6?: string;
-        }
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        interface L4override {
-            /**
-             * IPv4 or IPv6 address.
-             */
-            ip?: string;
-            /**
-             * A port number to use for TCP/UDP overrides.
-             */
-            port?: number;
-        }
-        /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
-         */
-        interface NotificationSettings {
-            /**
-             * Set notification on
-             */
-            enabled?: boolean;
-            /**
-             * Customize the message shown in the notification.
-             */
-            msg?: string;
-            /**
-             * Optional URL to direct users to additional information. If not set, the
-             * notification will open a block page.
-             */
-            support_url?: string;
-        }
-        /**
-         * Configure DLP payload logging.
-         */
-        interface PayloadLog {
-            /**
-             * Set to true to enable DLP payload logging for this rule.
-             */
-            enabled?: boolean;
-        }
+        ipv4_fallback?: string;
         /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+         * The IPv6 range to be used for egress.
          */
-        interface UntrustedCERT {
-            /**
-             * The action performed when an untrusted certificate is seen. The default action
-             * is an error with HTTP code 526.
-             */
-            action?: 'pass_through' | 'block' | 'error';
-        }
+        ipv6?: string;
     }
     /**
-     * The schedule for activating DNS policies. This does not apply to HTTP or network
-     * policies.
+     * Send matching traffic to the supplied destination IP address and port.
      */
-    interface Schedule {
+    interface L4override {
         /**
-         * The time intervals when the rule will be active on Fridays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Fridays.
+         * IPv4 or IPv6 address.
          */
-        fri?: string;
+        ip?: string;
         /**
-         * The time intervals when the rule will be active on Mondays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Mondays.
+         * A port number to use for TCP/UDP overrides.
          */
-        mon?: string;
-        /**
-         * The time intervals when the rule will be active on Saturdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Saturdays.
-         */
-        sat?: string;
+        port?: number;
+    }
+    /**
+     * Configure a notification to display on the user's device when this rule is
+     * matched.
+     */
+    interface NotificationSettings {
         /**
-         * The time intervals when the rule will be active on Sundays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Sundays.
+         * Set notification on
          */
-        sun?: string;
+        enabled?: boolean;
         /**
-         * The time intervals when the rule will be active on Thursdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Thursdays.
+         * Customize the message shown in the notification.
          */
-        thu?: string;
+        msg?: string;
         /**
-         * The time zone the rule will be evaluated against. If a
-         * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-         * is provided, Gateway will always use the current time at that time zone. If this
-         * parameter is omitted, then Gateway will use the time zone inferred from the
-         * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-         * from the IP, we will fall back to the time zone of the user's connected data
-         * center.
+         * Optional URL to direct users to additional information. If not set, the
+         * notification will open a block page.
          */
-        time_zone?: string;
+        support_url?: string;
+    }
+    /**
+     * Configure DLP payload logging.
+     */
+    interface PayloadLog {
         /**
-         * The time intervals when the rule will be active on Tuesdays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Tuesdays.
+         * Set to true to enable DLP payload logging for this rule.
          */
-        tue?: string;
+        enabled?: boolean;
+    }
+    /**
+     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     */
+    interface UntrustedCERT {
         /**
-         * The time intervals when the rule will be active on Wednesdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Wednesdays.
+         * The action performed when an untrusted certificate is seen. The default action
+         * is an error with HTTP code 526.
          */
-        wed?: string;
+        action?: 'pass_through' | 'block' | 'error';
     }
 }
-export type RuleDeleteResponse = unknown | string;
+/**
+ * The schedule for activating DNS policies. This does not apply to HTTP or network
+ * policies.
+ */
+export interface Schedule {
+    /**
+     * The time intervals when the rule will be active on Fridays, in increasing order
+     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+     * Fridays.
+     */
+    fri?: string;
+    /**
+     * The time intervals when the rule will be active on Mondays, in increasing order
+     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+     * Mondays.
+     */
+    mon?: string;
+    /**
+     * The time intervals when the rule will be active on Saturdays, in increasing
+     * order from 00:00-24:00. If this parameter is omitted, the rule will be
+     * deactivated on Saturdays.
+     */
+    sat?: string;
+    /**
+     * The time intervals when the rule will be active on Sundays, in increasing order
+     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+     * Sundays.
+     */
+    sun?: string;
+    /**
+     * The time intervals when the rule will be active on Thursdays, in increasing
+     * order from 00:00-24:00. If this parameter is omitted, the rule will be
+     * deactivated on Thursdays.
+     */
+    thu?: string;
+    /**
+     * The time zone the rule will be evaluated against. If a
+     * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
+     * is provided, Gateway will always use the current time at that time zone. If this
+     * parameter is omitted, then Gateway will use the time zone inferred from the
+     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
+     * from the IP, we will fall back to the time zone of the user's connected data
+     * center.
+     */
+    time_zone?: string;
+    /**
+     * The time intervals when the rule will be active on Tuesdays, in increasing order
+     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+     * Tuesdays.
+     */
+    tue?: string;
+    /**
+     * The time intervals when the rule will be active on Wednesdays, in increasing
+     * order from 00:00-24:00. If this parameter is omitted, the rule will be
+     * deactivated on Wednesdays.
+     */
+    wed?: string;
+}
+export type RuleDeleteResponse = unknown | string | null;
 export interface RuleCreateParams {
     /**
      * Path param:
@@ -424,7 +427,7 @@ export interface RuleCreateParams {
      * Body param: The action to preform when the associated traffic, identity, and
      * device posture expressions are either absent or evaluate to `true`.
      */
-    action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh';
+    action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh' | 'resolve';
     /**
      * Body param: The name of the rule.
      */
@@ -445,7 +448,7 @@ export interface RuleCreateParams {
      * Body param: The protocol or layer to evaluate the traffic, identity, and device
      * posture expressions.
      */
-    filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+    filters?: Array<GatewayFilter>;
     /**
      * Body param: The wirefilter expression used for identity matching.
      */
@@ -459,344 +462,17 @@ export interface RuleCreateParams {
     /**
      * Body param: Additional settings that modify the rule's action.
      */
-    rule_settings?: RuleCreateParams.RuleSettings;
+    rule_settings?: RuleSetting;
     /**
      * Body param: The schedule for activating DNS policies. This does not apply to
      * HTTP or network policies.
      */
-    schedule?: RuleCreateParams.Schedule;
+    schedule?: Schedule;
     /**
      * Body param: The wirefilter expression used for traffic matching.
      */
     traffic?: string;
 }
-export declare namespace RuleCreateParams {
-    /**
-     * Additional settings that modify the rule's action.
-     */
-    interface RuleSettings {
-        /**
-         * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-         * header names, pointing to an array with its header value(s).
-         */
-        add_headers?: unknown;
-        /**
-         * Set by parent MSP accounts to enable their children to bypass this rule.
-         */
-        allow_child_bypass?: boolean;
-        /**
-         * Settings for the Audit SSH action.
-         */
-        audit_ssh?: RuleSettings.AuditSSH;
-        /**
-         * Configure how browser isolation behaves.
-         */
-        biso_admin_controls?: RuleSettings.BisoAdminControls;
-        /**
-         * Enable the custom block page.
-         */
-        block_page_enabled?: boolean;
-        /**
-         * The text describing why this block occurred, displayed on the custom block page
-         * (if enabled).
-         */
-        block_reason?: string;
-        /**
-         * Set by children MSP accounts to bypass their parent's rules.
-         */
-        bypass_parent_rule?: boolean;
-        /**
-         * Configure how session check behaves.
-         */
-        check_session?: RuleSettings.CheckSession;
-        /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
-         */
-        dns_resolvers?: RuleSettings.DNSResolvers;
-        /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
-         * WARP IPs.
-         */
-        egress?: RuleSettings.Egress;
-        /**
-         * INSECURE - disable DNSSEC validation (for Allow actions).
-         */
-        insecure_disable_dnssec_validation?: boolean;
-        /**
-         * Set to true to enable IPs in DNS resolver category blocks. By default categories
-         * only block based on domain names.
-         */
-        ip_categories?: boolean;
-        /**
-         * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-         * indicator feeds only block based on domain names.
-         */
-        ip_indicator_feeds?: boolean;
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        l4override?: RuleSettings.L4override;
-        /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
-         */
-        notification_settings?: RuleSettings.NotificationSettings;
-        /**
-         * Override matching DNS queries with a hostname.
-         */
-        override_host?: string;
-        /**
-         * Override matching DNS queries with an IP or set of IPs.
-         */
-        override_ips?: Array<string>;
-        /**
-         * Configure DLP payload logging.
-         */
-        payload_log?: RuleSettings.PayloadLog;
-        /**
-         * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-         * resolver. Cannot be set when dns_resolvers are specified.
-         */
-        resolve_dns_through_cloudflare?: boolean;
-        /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-         */
-        untrusted_cert?: RuleSettings.UntrustedCERT;
-    }
-    namespace RuleSettings {
-        /**
-         * Settings for the Audit SSH action.
-         */
-        interface AuditSSH {
-            /**
-             * Enable to turn on SSH command logging.
-             */
-            command_logging?: boolean;
-        }
-        /**
-         * Configure how browser isolation behaves.
-         */
-        interface BisoAdminControls {
-            /**
-             * Set to true to enable copy-pasting.
-             */
-            dcp?: boolean;
-            /**
-             * Set to true to enable downloading.
-             */
-            dd?: boolean;
-            /**
-             * Set to true to enable keyboard usage.
-             */
-            dk?: boolean;
-            /**
-             * Set to true to enable printing.
-             */
-            dp?: boolean;
-            /**
-             * Set to true to enable uploading.
-             */
-            du?: boolean;
-        }
-        /**
-         * Configure how session check behaves.
-         */
-        interface CheckSession {
-            /**
-             * Configure how fresh the session needs to be to be considered valid.
-             */
-            duration?: string;
-            /**
-             * Set to true to enable session enforcement.
-             */
-            enforce?: boolean;
-        }
-        /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
-         */
-        interface DNSResolvers {
-            ipv4?: Array<DNSResolvers.IPV4>;
-            ipv6?: Array<DNSResolvers.IPV6>;
-        }
-        namespace DNSResolvers {
-            interface IPV4 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-            interface IPV6 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-        }
-        /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
-         * WARP IPs.
-         */
-        interface Egress {
-            /**
-             * The IPv4 address to be used for egress.
-             */
-            ipv4?: string;
-            /**
-             * The fallback IPv4 address to be used for egress in the event of an error
-             * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-             * WARP IPs.
-             */
-            ipv4_fallback?: string;
-            /**
-             * The IPv6 range to be used for egress.
-             */
-            ipv6?: string;
-        }
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        interface L4override {
-            /**
-             * IPv4 or IPv6 address.
-             */
-            ip?: string;
-            /**
-             * A port number to use for TCP/UDP overrides.
-             */
-            port?: number;
-        }
-        /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
-         */
-        interface NotificationSettings {
-            /**
-             * Set notification on
-             */
-            enabled?: boolean;
-            /**
-             * Customize the message shown in the notification.
-             */
-            msg?: string;
-            /**
-             * Optional URL to direct users to additional information. If not set, the
-             * notification will open a block page.
-             */
-            support_url?: string;
-        }
-        /**
-         * Configure DLP payload logging.
-         */
-        interface PayloadLog {
-            /**
-             * Set to true to enable DLP payload logging for this rule.
-             */
-            enabled?: boolean;
-        }
-        /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-         */
-        interface UntrustedCERT {
-            /**
-             * The action performed when an untrusted certificate is seen. The default action
-             * is an error with HTTP code 526.
-             */
-            action?: 'pass_through' | 'block' | 'error';
-        }
-    }
-    /**
-     * The schedule for activating DNS policies. This does not apply to HTTP or network
-     * policies.
-     */
-    interface Schedule {
-        /**
-         * The time intervals when the rule will be active on Fridays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Fridays.
-         */
-        fri?: string;
-        /**
-         * The time intervals when the rule will be active on Mondays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Mondays.
-         */
-        mon?: string;
-        /**
-         * The time intervals when the rule will be active on Saturdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Saturdays.
-         */
-        sat?: string;
-        /**
-         * The time intervals when the rule will be active on Sundays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Sundays.
-         */
-        sun?: string;
-        /**
-         * The time intervals when the rule will be active on Thursdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Thursdays.
-         */
-        thu?: string;
-        /**
-         * The time zone the rule will be evaluated against. If a
-         * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-         * is provided, Gateway will always use the current time at that time zone. If this
-         * parameter is omitted, then Gateway will use the time zone inferred from the
-         * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-         * from the IP, we will fall back to the time zone of the user's connected data
-         * center.
-         */
-        time_zone?: string;
-        /**
-         * The time intervals when the rule will be active on Tuesdays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Tuesdays.
-         */
-        tue?: string;
-        /**
-         * The time intervals when the rule will be active on Wednesdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Wednesdays.
-         */
-        wed?: string;
-    }
-}
 export interface RuleUpdateParams {
     /**
      * Path param:
@@ -806,7 +482,7 @@ export interface RuleUpdateParams {
      * Body param: The action to preform when the associated traffic, identity, and
      * device posture expressions are either absent or evaluate to `true`.
      */
-    action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh';
+    action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'audit_ssh' | 'resolve';
     /**
      * Body param: The name of the rule.
      */
@@ -827,7 +503,7 @@ export interface RuleUpdateParams {
      * Body param: The protocol or layer to evaluate the traffic, identity, and device
      * posture expressions.
      */
-    filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+    filters?: Array<GatewayFilter>;
     /**
      * Body param: The wirefilter expression used for identity matching.
      */
@@ -841,357 +517,42 @@ export interface RuleUpdateParams {
     /**
      * Body param: Additional settings that modify the rule's action.
      */
-    rule_settings?: RuleUpdateParams.RuleSettings;
+    rule_settings?: RuleSetting;
     /**
      * Body param: The schedule for activating DNS policies. This does not apply to
      * HTTP or network policies.
      */
-    schedule?: RuleUpdateParams.Schedule;
+    schedule?: Schedule;
     /**
      * Body param: The wirefilter expression used for traffic matching.
      */
     traffic?: string;
 }
-export declare namespace RuleUpdateParams {
-    /**
-     * Additional settings that modify the rule's action.
-     */
-    interface RuleSettings {
-        /**
-         * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-         * header names, pointing to an array with its header value(s).
-         */
-        add_headers?: unknown;
-        /**
-         * Set by parent MSP accounts to enable their children to bypass this rule.
-         */
-        allow_child_bypass?: boolean;
-        /**
-         * Settings for the Audit SSH action.
-         */
-        audit_ssh?: RuleSettings.AuditSSH;
-        /**
-         * Configure how browser isolation behaves.
-         */
-        biso_admin_controls?: RuleSettings.BisoAdminControls;
-        /**
-         * Enable the custom block page.
-         */
-        block_page_enabled?: boolean;
-        /**
-         * The text describing why this block occurred, displayed on the custom block page
-         * (if enabled).
-         */
-        block_reason?: string;
-        /**
-         * Set by children MSP accounts to bypass their parent's rules.
-         */
-        bypass_parent_rule?: boolean;
-        /**
-         * Configure how session check behaves.
-         */
-        check_session?: RuleSettings.CheckSession;
-        /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
-         */
-        dns_resolvers?: RuleSettings.DNSResolvers;
-        /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
-         * WARP IPs.
-         */
-        egress?: RuleSettings.Egress;
-        /**
-         * INSECURE - disable DNSSEC validation (for Allow actions).
-         */
-        insecure_disable_dnssec_validation?: boolean;
-        /**
-         * Set to true to enable IPs in DNS resolver category blocks. By default categories
-         * only block based on domain names.
-         */
-        ip_categories?: boolean;
-        /**
-         * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-         * indicator feeds only block based on domain names.
-         */
-        ip_indicator_feeds?: boolean;
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        l4override?: RuleSettings.L4override;
-        /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
-         */
-        notification_settings?: RuleSettings.NotificationSettings;
-        /**
-         * Override matching DNS queries with a hostname.
-         */
-        override_host?: string;
-        /**
-         * Override matching DNS queries with an IP or set of IPs.
-         */
-        override_ips?: Array<string>;
-        /**
-         * Configure DLP payload logging.
-         */
-        payload_log?: RuleSettings.PayloadLog;
-        /**
-         * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-         * resolver. Cannot be set when dns_resolvers are specified.
-         */
-        resolve_dns_through_cloudflare?: boolean;
-        /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-         */
-        untrusted_cert?: RuleSettings.UntrustedCERT;
-    }
-    namespace RuleSettings {
-        /**
-         * Settings for the Audit SSH action.
-         */
-        interface AuditSSH {
-            /**
-             * Enable to turn on SSH command logging.
-             */
-            command_logging?: boolean;
-        }
-        /**
-         * Configure how browser isolation behaves.
-         */
-        interface BisoAdminControls {
-            /**
-             * Set to true to enable copy-pasting.
-             */
-            dcp?: boolean;
-            /**
-             * Set to true to enable downloading.
-             */
-            dd?: boolean;
-            /**
-             * Set to true to enable keyboard usage.
-             */
-            dk?: boolean;
-            /**
-             * Set to true to enable printing.
-             */
-            dp?: boolean;
-            /**
-             * Set to true to enable uploading.
-             */
-            du?: boolean;
-        }
-        /**
-         * Configure how session check behaves.
-         */
-        interface CheckSession {
-            /**
-             * Configure how fresh the session needs to be to be considered valid.
-             */
-            duration?: string;
-            /**
-             * Set to true to enable session enforcement.
-             */
-            enforce?: boolean;
-        }
-        /**
-         * Add your own custom resolvers to route queries that match the resolver policy.
-         * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-         * route to the address closest to their origin.
-         */
-        interface DNSResolvers {
-            ipv4?: Array<DNSResolvers.IPV4>;
-            ipv6?: Array<DNSResolvers.IPV6>;
-        }
-        namespace DNSResolvers {
-            interface IPV4 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-            interface IPV6 {
-                /**
-                 * IP address of upstream resolver.
-                 */
-                ip: string;
-                /**
-                 * A port number to use for upstream resolver.
-                 */
-                port?: number;
-                /**
-                 * Whether to connect to this resolver over a private network. Must be set when
-                 * vnet_id is set.
-                 */
-                route_through_private_network?: boolean;
-                /**
-                 * Optionally specify a virtual network for this resolver. Uses default virtual
-                 * network id if omitted.
-                 */
-                vnet_id?: string;
-            }
-        }
-        /**
-         * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-         * rules with Egress actions and filters, or omit it to indicate local egress via
-         * WARP IPs.
-         */
-        interface Egress {
-            /**
-             * The IPv4 address to be used for egress.
-             */
-            ipv4?: string;
-            /**
-             * The fallback IPv4 address to be used for egress in the event of an error
-             * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-             * WARP IPs.
-             */
-            ipv4_fallback?: string;
-            /**
-             * The IPv6 range to be used for egress.
-             */
-            ipv6?: string;
-        }
-        /**
-         * Send matching traffic to the supplied destination IP address and port.
-         */
-        interface L4override {
-            /**
-             * IPv4 or IPv6 address.
-             */
-            ip?: string;
-            /**
-             * A port number to use for TCP/UDP overrides.
-             */
-            port?: number;
-        }
-        /**
-         * Configure a notification to display on the user's device when this rule is
-         * matched.
-         */
-        interface NotificationSettings {
-            /**
-             * Set notification on
-             */
-            enabled?: boolean;
-            /**
-             * Customize the message shown in the notification.
-             */
-            msg?: string;
-            /**
-             * Optional URL to direct users to additional information. If not set, the
-             * notification will open a block page.
-             */
-            support_url?: string;
-        }
-        /**
-         * Configure DLP payload logging.
-         */
-        interface PayloadLog {
-            /**
-             * Set to true to enable DLP payload logging for this rule.
-             */
-            enabled?: boolean;
-        }
-        /**
-         * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-         */
-        interface UntrustedCERT {
-            /**
-             * The action performed when an untrusted certificate is seen. The default action
-             * is an error with HTTP code 526.
-             */
-            action?: 'pass_through' | 'block' | 'error';
-        }
-    }
-    /**
-     * The schedule for activating DNS policies. This does not apply to HTTP or network
-     * policies.
-     */
-    interface Schedule {
-        /**
-         * The time intervals when the rule will be active on Fridays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Fridays.
-         */
-        fri?: string;
-        /**
-         * The time intervals when the rule will be active on Mondays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Mondays.
-         */
-        mon?: string;
-        /**
-         * The time intervals when the rule will be active on Saturdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Saturdays.
-         */
-        sat?: string;
-        /**
-         * The time intervals when the rule will be active on Sundays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Sundays.
-         */
-        sun?: string;
-        /**
-         * The time intervals when the rule will be active on Thursdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Thursdays.
-         */
-        thu?: string;
-        /**
-         * The time zone the rule will be evaluated against. If a
-         * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-         * is provided, Gateway will always use the current time at that time zone. If this
-         * parameter is omitted, then Gateway will use the time zone inferred from the
-         * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-         * from the IP, we will fall back to the time zone of the user's connected data
-         * center.
-         */
-        time_zone?: string;
-        /**
-         * The time intervals when the rule will be active on Tuesdays, in increasing order
-         * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-         * Tuesdays.
-         */
-        tue?: string;
-        /**
-         * The time intervals when the rule will be active on Wednesdays, in increasing
-         * order from 00:00-24:00. If this parameter is omitted, the rule will be
-         * deactivated on Wednesdays.
-         */
-        wed?: string;
-    }
-}
 export interface RuleListParams {
     account_id: string;
 }
 export interface RuleDeleteParams {
+    /**
+     * Path param:
+     */
     account_id: string;
+    /**
+     * Body param:
+     */
+    body: unknown;
 }
 export interface RuleGetParams {
     account_id: string;
 }
 export declare namespace Rules {
-    export import ZeroTrustGatewayRules = RulesAPI.ZeroTrustGatewayRules;
+    export import DNSResolverSettingsV4 = RulesAPI.DNSResolverSettingsV4;
+    export import DNSResolverSettingsV6 = RulesAPI.DNSResolverSettingsV6;
+    export import GatewayFilter = RulesAPI.GatewayFilter;
+    export import GatewayRule = RulesAPI.GatewayRule;
+    export import RuleSetting = RulesAPI.RuleSetting;
+    export import Schedule = RulesAPI.Schedule;
     export import RuleDeleteResponse = RulesAPI.RuleDeleteResponse;
-    export import ZeroTrustGatewayRulesSinglePage = RulesAPI.ZeroTrustGatewayRulesSinglePage;
+    export import GatewayRulesSinglePage = RulesAPI.GatewayRulesSinglePage;
     export import RuleCreateParams = RulesAPI.RuleCreateParams;
     export import RuleUpdateParams = RulesAPI.RuleUpdateParams;
     export import RuleListParams = RulesAPI.RuleListParams;