cloudflare 3.0.0 → 3.2.0

package/resources/zero-trust/access/applications/applications.d.ts

@@ -12,36 +12,58 @@ export declare class Applications extends APIResource {
     /**
      * Adds a new application to Access.
      */
-    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Updates an Access application.
      */
-    update(appId: string | string, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    update(appId: AppIDParam, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Lists all Access applications in an account or zone.
      */
-    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
-    list(options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
+    list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
+    list(options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
     /**
      * Deletes an application from Access.
      */
-    delete(appId: string | string, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
-    delete(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppIDParam, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+    delete(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
     /**
      * Fetches information about an Access application.
      */
-    get(appId: string | string, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
-    get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+    get(appId: AppIDParam, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<Application>;
+    get(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<Application>;
     /**
      * Revokes all tokens issued for an application.
      */
-    revokeTokens(appId: string | string, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
-    revokeTokens(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppIDParam, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
+    revokeTokens(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
 }
-export declare class ZeroTrustAppsSinglePage extends SinglePage<ZeroTrustApps> {
+export declare class ApplicationsSinglePage extends SinglePage<Application> {
 }
-export type ZeroTrustApps = ZeroTrustApps.SelfHostedApplication | ZeroTrustApps.SaaSApplication | ZeroTrustApps.BrowserSSHApplication | ZeroTrustApps.BrowserVncApplication | ZeroTrustApps.AppLauncherApplication | ZeroTrustApps.DeviceEnrollmentPermissionsApplication | ZeroTrustApps.BrowserIsolationPermissionsApplication | ZeroTrustApps.BookmarkApplication;
-export declare namespace ZeroTrustApps {
+export type AllowedHeaders = string;
+export type AllowedHeadersParam = string;
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdPs = string;
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdPsParam = string;
+export type AllowedMethods = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH';
+export type AllowedMethodsParam = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH';
+export type AllowedOrigins = string;
+export type AllowedOriginsParam = string;
+/**
+ * Identifier
+ */
+export type AppID = string | string;
+/**
+ * Identifier
+ */
+export type AppIDParam = string | string;
+export type Application = Application.SelfHostedApplication | Application.SaaSApplication | Application.BrowserSSHApplication | Application.BrowserVncApplication | Application.AppLauncherApplication | Application.DeviceEnrollmentPermissionsApplication | Application.BrowserIsolationPermissionsApplication | Application.BookmarkApplication;
+export declare namespace Application {
     interface SelfHostedApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -67,7 +89,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -81,7 +103,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: SelfHostedApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -120,6 +142,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -133,7 +160,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -155,43 +182,6 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * UUID
@@ -201,7 +191,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -228,7 +218,7 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
-        saas_app?: SaaSApplication.AccessSamlSaasApp | SaaSApplication.AccessOidcSaasApp;
+        saas_app?: ApplicationsAPI.SAMLSaaSApp | SaaSApplication.AccessOIDCSaaSApp;
         /**
          * The tags you want assigned to an application. Tags are used to filter
          * applications in the App Launcher dashboard.
@@ -241,83 +231,7 @@ export declare namespace ZeroTrustApps {
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            created_at?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-            updated_at?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -336,6 +250,7 @@ export declare namespace ZeroTrustApps {
              */
             client_secret?: string;
             created_at?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -359,6 +274,35 @@ export declare namespace ZeroTrustApps {
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
             updated_at?: string;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -385,7 +329,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -399,7 +343,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserSSHApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -438,6 +382,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -451,7 +400,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -473,43 +422,6 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * The primary hostname and path that Access will secure. If the app is visible in
@@ -535,7 +447,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Displays the application in the App Launcher.
          */
@@ -549,7 +461,7 @@ export declare namespace ZeroTrustApps {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserVncApplication.CorsHeaders;
+        cors_headers?: ApplicationsAPI.CORSHeaders;
         created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
@@ -588,6 +500,11 @@ export declare namespace ZeroTrustApps {
          * The name of the application.
          */
         name?: string;
+        /**
+         * Allows options preflight requests to bypass Access authentication and go
+         * directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Enables cookie paths to scope an application's JWT to the application path. If
          * disabled, the JWT will scope to the hostname by default
@@ -601,7 +518,7 @@ export declare namespace ZeroTrustApps {
         /**
          * List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -623,48 +540,11 @@ export declare namespace ZeroTrustApps {
         tags?: Array<string>;
         updated_at?: string;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID
          */
@@ -673,7 +553,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
@@ -705,7 +585,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID
          */
@@ -714,7 +594,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
@@ -746,7 +626,7 @@ export declare namespace ZeroTrustApps {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID
          */
@@ -755,7 +635,7 @@ export declare namespace ZeroTrustApps {
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
@@ -821,6 +701,278 @@ export declare namespace ZeroTrustApps {
         updated_at?: string;
     }
 }
+/**
+ * The application type.
+ */
+export type ApplicationType = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+/**
+ * The application type.
+ */
+export type ApplicationTypeParam = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+export interface CORSHeaders {
+    /**
+     * Allows all HTTP request headers.
+     */
+    allow_all_headers?: boolean;
+    /**
+     * Allows all HTTP request methods.
+     */
+    allow_all_methods?: boolean;
+    /**
+     * Allows all origins.
+     */
+    allow_all_origins?: boolean;
+    /**
+     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+     * client certificates) with requests.
+     */
+    allow_credentials?: boolean;
+    /**
+     * Allowed HTTP request headers.
+     */
+    allowed_headers?: Array<AllowedHeaders>;
+    /**
+     * Allowed HTTP request methods.
+     */
+    allowed_methods?: Array<AllowedMethods>;
+    /**
+     * Allowed origins.
+     */
+    allowed_origins?: Array<AllowedOrigins>;
+    /**
+     * The maximum number of seconds the results of a preflight request can be cached.
+     */
+    max_age?: number;
+}
+export interface CORSHeadersParam {
+    /**
+     * Allows all HTTP request headers.
+     */
+    allow_all_headers?: boolean;
+    /**
+     * Allows all HTTP request methods.
+     */
+    allow_all_methods?: boolean;
+    /**
+     * Allows all origins.
+     */
+    allow_all_origins?: boolean;
+    /**
+     * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+     * client certificates) with requests.
+     */
+    allow_credentials?: boolean;
+    /**
+     * Allowed HTTP request headers.
+     */
+    allowed_headers?: Array<AllowedHeadersParam>;
+    /**
+     * Allowed HTTP request methods.
+     */
+    allowed_methods?: Array<AllowedMethodsParam>;
+    /**
+     * Allowed origins.
+     */
+    allowed_origins?: Array<AllowedOriginsParam>;
+    /**
+     * The maximum number of seconds the results of a preflight request can be cached.
+     */
+    max_age?: number;
+}
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormat = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormatParam = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormat = 'id' | 'email';
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormatParam = 'id' | 'email';
+export interface SaaSAppSource {
+    /**
+     * The name of the IdP attribute.
+     */
+    name?: string;
+    /**
+     * A mapping from IdP ID to attribute name.
+     */
+    name_by_idp?: Record<string, string>;
+}
+export interface SaaSAppSourceParam {
+    /**
+     * The name of the IdP attribute.
+     */
+    name?: string;
+    /**
+     * A mapping from IdP ID to attribute name.
+     */
+    name_by_idp?: Record<string, string>;
+}
+export interface SAMLSaaSApp {
+    /**
+     * Optional identifier indicating the authentication protocol used for the saas
+     * app. Required for OIDC. Default if unset is "saml"
+     */
+    auth_type?: 'saml' | 'oidc';
+    /**
+     * The service provider's endpoint that is responsible for receiving and parsing a
+     * SAML assertion.
+     */
+    consumer_service_url?: string;
+    created_at?: string;
+    custom_attributes?: SAMLSaaSApp.CustomAttributes;
+    /**
+     * The URL that the user will be redirected to after a successful login for IDP
+     * initiated logins.
+     */
+    default_relay_state?: string;
+    /**
+     * The unique identifier for your SaaS application.
+     */
+    idp_entity_id?: string;
+    /**
+     * The format of the name identifier sent to the SaaS application.
+     */
+    name_id_format?: SaaSAppNameIDFormat;
+    /**
+     * A [JSONata](https://jsonata.org/) expression that transforms an application's
+     * user identities into a NameID value for its SAML assertion. This expression
+     * should evaluate to a singular string. The output of this expression can override
+     * the `name_id_format` setting.
+     */
+    name_id_transform_jsonata?: string;
+    /**
+     * The Access public certificate that will be used to verify your identity.
+     */
+    public_key?: string;
+    /**
+     * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+     * user identities into attribute assertions in the SAML response. The expression
+     * can transform id, email, name, and groups values. It can also transform fields
+     * listed in the saml_attributes or oidc_fields of the identity provider used to
+     * authenticate. The output of this expression must be a JSON object.
+     */
+    saml_attribute_transform_jsonata?: string;
+    /**
+     * A globally unique name for an identity or service provider.
+     */
+    sp_entity_id?: string;
+    /**
+     * The endpoint where your SaaS application will send login requests.
+     */
+    sso_endpoint?: string;
+    updated_at?: string;
+}
+export declare namespace SAMLSaaSApp {
+    interface CustomAttributes {
+        /**
+         * The SAML FriendlyName of the attribute.
+         */
+        friendly_name?: string;
+        /**
+         * The name of the attribute.
+         */
+        name?: string;
+        /**
+         * A globally unique name for an identity or service provider.
+         */
+        name_format?: ApplicationsAPI.SaaSAppNameFormat;
+        /**
+         * If the attribute is required when building a SAML assertion.
+         */
+        required?: boolean;
+        source?: ApplicationsAPI.SaaSAppSource;
+    }
+}
+export interface SAMLSaaSAppParam {
+    /**
+     * Optional identifier indicating the authentication protocol used for the saas
+     * app. Required for OIDC. Default if unset is "saml"
+     */
+    auth_type?: 'saml' | 'oidc';
+    /**
+     * The service provider's endpoint that is responsible for receiving and parsing a
+     * SAML assertion.
+     */
+    consumer_service_url?: string;
+    custom_attributes?: SAMLSaaSAppParam.CustomAttributes;
+    /**
+     * The URL that the user will be redirected to after a successful login for IDP
+     * initiated logins.
+     */
+    default_relay_state?: string;
+    /**
+     * The unique identifier for your SaaS application.
+     */
+    idp_entity_id?: string;
+    /**
+     * The format of the name identifier sent to the SaaS application.
+     */
+    name_id_format?: SaaSAppNameIDFormatParam;
+    /**
+     * A [JSONata](https://jsonata.org/) expression that transforms an application's
+     * user identities into a NameID value for its SAML assertion. This expression
+     * should evaluate to a singular string. The output of this expression can override
+     * the `name_id_format` setting.
+     */
+    name_id_transform_jsonata?: string;
+    /**
+     * The Access public certificate that will be used to verify your identity.
+     */
+    public_key?: string;
+    /**
+     * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+     * user identities into attribute assertions in the SAML response. The expression
+     * can transform id, email, name, and groups values. It can also transform fields
+     * listed in the saml_attributes or oidc_fields of the identity provider used to
+     * authenticate. The output of this expression must be a JSON object.
+     */
+    saml_attribute_transform_jsonata?: string;
+    /**
+     * A globally unique name for an identity or service provider.
+     */
+    sp_entity_id?: string;
+    /**
+     * The endpoint where your SaaS application will send login requests.
+     */
+    sso_endpoint?: string;
+}
+export declare namespace SAMLSaaSAppParam {
+    interface CustomAttributes {
+        /**
+         * The SAML FriendlyName of the attribute.
+         */
+        friendly_name?: string;
+        /**
+         * The name of the attribute.
+         */
+        name?: string;
+        /**
+         * A globally unique name for an identity or service provider.
+         */
+        name_format?: ApplicationsAPI.SaaSAppNameFormatParam;
+        /**
+         * If the attribute is required when building a SAML assertion.
+         */
+        required?: boolean;
+        source?: ApplicationsAPI.SaaSAppSourceParam;
+    }
+}
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomains = string;
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomainsParam = string;
 export interface ApplicationDeleteResponse {
     /**
      * UUID
@@ -862,7 +1014,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -875,7 +1027,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.SelfHostedApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -914,6 +1066,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -927,7 +1084,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -949,43 +1106,6 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -1001,7 +1121,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1027,7 +1147,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        saas_app?: ApplicationCreateParams.SaaSApplication.AccessSamlSaasApp | ApplicationCreateParams.SaaSApplication.AccessOidcSaasApp;
+        saas_app?: SAMLSaaSAppParam | ApplicationCreateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
          * Body param: The tags you want assigned to an application. Tags are used to
          * filter applications in the App Launcher dashboard.
@@ -1039,81 +1159,7 @@ export declare namespace ApplicationCreateParams {
         type?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -1131,6 +1177,7 @@ export declare namespace ApplicationCreateParams {
              * The application client secret, only returned on POST request.
              */
             client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -1153,6 +1200,35 @@ export declare namespace ApplicationCreateParams {
              */
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -1186,7 +1262,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1199,7 +1275,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.BrowserSSHApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1238,6 +1314,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1251,7 +1332,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1273,43 +1354,6 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * Body param: The primary hostname and path that Access will secure. If the app is
@@ -1342,7 +1386,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1355,7 +1399,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationCreateParams.BrowserVncApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1394,6 +1438,11 @@ export declare namespace ApplicationCreateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1407,7 +1456,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1429,48 +1478,11 @@ export declare namespace ApplicationCreateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -1485,7 +1497,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1502,7 +1514,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -1517,7 +1529,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1534,7 +1546,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -1549,7 +1561,7 @@ export declare namespace ApplicationCreateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -1634,7 +1646,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1647,7 +1659,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.SelfHostedApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -1686,6 +1698,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -1699,7 +1716,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -1721,43 +1738,6 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace SelfHostedApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface SaaSApplication {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -1773,7 +1753,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1799,7 +1779,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        saas_app?: ApplicationUpdateParams.SaaSApplication.AccessSamlSaasApp | ApplicationUpdateParams.SaaSApplication.AccessOidcSaasApp;
+        saas_app?: SAMLSaaSAppParam | ApplicationUpdateParams.SaaSApplication.AccessOIDCSaaSApp;
         /**
          * Body param: The tags you want assigned to an application. Tags are used to
          * filter applications in the App Launcher dashboard.
@@ -1811,81 +1791,7 @@ export declare namespace ApplicationUpdateParams {
         type?: string;
     }
     namespace SaaSApplication {
-        interface AccessSamlSaasApp {
-            /**
-             * Optional identifier indicating the authentication protocol used for the saas
-             * app. Required for OIDC. Default if unset is "saml"
-             */
-            auth_type?: 'saml' | 'oidc';
-            /**
-             * The service provider's endpoint that is responsible for receiving and parsing a
-             * SAML assertion.
-             */
-            consumer_service_url?: string;
-            custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-            /**
-             * The URL that the user will be redirected to after a successful login for IDP
-             * initiated logins.
-             */
-            default_relay_state?: string;
-            /**
-             * The unique identifier for your SaaS application.
-             */
-            idp_entity_id?: string;
-            /**
-             * The format of the name identifier sent to the SaaS application.
-             */
-            name_id_format?: 'id' | 'email';
-            /**
-             * A [JSONata](https://jsonata.org/) expression that transforms an application's
-             * user identities into a NameID value for its SAML assertion. This expression
-             * should evaluate to a singular string. The output of this expression can override
-             * the `name_id_format` setting.
-             */
-            name_id_transform_jsonata?: string;
-            /**
-             * The Access public certificate that will be used to verify your identity.
-             */
-            public_key?: string;
-            /**
-             * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-             * user identities into attribute assertions in the SAML response. The expression
-             * can transform id, email, name, and groups values. It can also transform fields
-             * listed in the saml_attributes or oidc_fields of the identity provider used to
-             * authenticate. The output of this expression must be a JSON object.
-             */
-            saml_attribute_transform_jsonata?: string;
-            /**
-             * A globally unique name for an identity or service provider.
-             */
-            sp_entity_id?: string;
-            /**
-             * The endpoint where your SaaS application will send login requests.
-             */
-            sso_endpoint?: string;
-        }
-        namespace AccessSamlSaasApp {
-            interface CustomAttributes {
-                /**
-                 * The name of the attribute.
-                 */
-                name?: string;
-                /**
-                 * A globally unique name for an identity or service provider.
-                 */
-                name_format?: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic' | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-                source?: CustomAttributes.Source;
-            }
-            namespace CustomAttributes {
-                interface Source {
-                    /**
-                     * The name of the IdP attribute.
-                     */
-                    name?: string;
-                }
-            }
-        }
-        interface AccessOidcSaasApp {
+        interface AccessOIDCSaaSApp {
             /**
              * The URL where this applications tile redirects users
              */
@@ -1903,6 +1809,7 @@ export declare namespace ApplicationUpdateParams {
              * The application client secret, only returned on POST request.
              */
             client_secret?: string;
+            custom_claims?: AccessOIDCSaaSApp.CustomClaims;
             /**
              * The OIDC flows supported by this application
              */
@@ -1925,6 +1832,35 @@ export declare namespace ApplicationUpdateParams {
              */
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
         }
+        namespace AccessOIDCSaaSApp {
+            interface CustomClaims {
+                /**
+                 * The name of the claim.
+                 */
+                name?: string;
+                /**
+                 * A mapping from IdP ID to claim name.
+                 */
+                name_by_idp?: Record<string, string>;
+                /**
+                 * If the claim is required when building an OIDC token.
+                 */
+                required?: boolean;
+                /**
+                 * The scope of the claim.
+                 */
+                scope?: 'groups' | 'profile' | 'email' | 'openid';
+                source?: CustomClaims.Source;
+            }
+            namespace CustomClaims {
+                interface Source {
+                    /**
+                     * The name of the IdP claim.
+                     */
+                    name?: string;
+                }
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -1958,7 +1894,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -1971,7 +1907,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.BrowserSSHApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -2010,6 +1946,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -2023,7 +1964,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -2045,43 +1986,6 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserSSHApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface BrowserVncApplication {
         /**
          * Body param: The primary hostname and path that Access will secure. If the app is
@@ -2114,7 +2018,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: Displays the application in the App Launcher.
          */
@@ -2127,7 +2031,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param:
          */
-        cors_headers?: ApplicationUpdateParams.BrowserVncApplication.CorsHeaders;
+        cors_headers?: CORSHeadersParam;
         /**
          * Body param: The custom error message shown to a user when they are denied access
          * to the application.
@@ -2166,6 +2070,11 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The name of the application.
          */
         name?: string;
+        /**
+         * Body param: Allows options preflight requests to bypass Access authentication
+         * and go directly to the origin. Cannot turn on if cors_headers is set.
+         */
+        options_preflight_bypass?: boolean;
         /**
          * Body param: Enables cookie paths to scope an application's JWT to the
          * application path. If disabled, the JWT will scope to the hostname by default
@@ -2179,7 +2088,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: List of domains that Access will secure.
          */
-        self_hosted_domains?: Array<string>;
+        self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
          * Body param: Returns a 401 status code when the request is blocked by a Service
          * Auth policy.
@@ -2201,48 +2110,11 @@ export declare namespace ApplicationUpdateParams {
          */
         tags?: Array<string>;
     }
-    namespace BrowserVncApplication {
-        interface CorsHeaders {
-            /**
-             * Allows all HTTP request headers.
-             */
-            allow_all_headers?: boolean;
-            /**
-             * Allows all HTTP request methods.
-             */
-            allow_all_methods?: boolean;
-            /**
-             * Allows all origins.
-             */
-            allow_all_origins?: boolean;
-            /**
-             * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-             * client certificates) with requests.
-             */
-            allow_credentials?: boolean;
-            /**
-             * Allowed HTTP request headers.
-             */
-            allowed_headers?: Array<string>;
-            /**
-             * Allowed HTTP request methods.
-             */
-            allowed_methods?: Array<'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'>;
-            /**
-             * Allowed origins.
-             */
-            allowed_origins?: Array<string>;
-            /**
-             * The maximum number of seconds the results of a preflight request can be cached.
-             */
-            max_age?: number;
-        }
-    }
     interface AppLauncherApplication {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -2257,7 +2129,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2274,7 +2146,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -2289,7 +2161,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2306,7 +2178,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -2321,7 +2193,7 @@ export declare namespace ApplicationUpdateParams {
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
          */
-        allowed_idps?: Array<string>;
+        allowed_idps?: Array<AllowedIdPsParam>;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
@@ -2413,10 +2285,22 @@ export interface ApplicationRevokeTokensParams {
     zone_id?: string;
 }
 export declare namespace Applications {
-    export import ZeroTrustApps = ApplicationsAPI.ZeroTrustApps;
+    export import AllowedHeaders = ApplicationsAPI.AllowedHeaders;
+    export import AllowedIdPs = ApplicationsAPI.AllowedIdPs;
+    export import AllowedMethods = ApplicationsAPI.AllowedMethods;
+    export import AllowedOrigins = ApplicationsAPI.AllowedOrigins;
+    export import AppID = ApplicationsAPI.AppID;
+    export import Application = ApplicationsAPI.Application;
+    export import ApplicationType = ApplicationsAPI.ApplicationType;
+    export import CORSHeaders = ApplicationsAPI.CORSHeaders;
+    export import SaaSAppNameFormat = ApplicationsAPI.SaaSAppNameFormat;
+    export import SaaSAppNameIDFormat = ApplicationsAPI.SaaSAppNameIDFormat;
+    export import SaaSAppSource = ApplicationsAPI.SaaSAppSource;
+    export import SAMLSaaSApp = ApplicationsAPI.SAMLSaaSApp;
+    export import SelfHostedDomains = ApplicationsAPI.SelfHostedDomains;
     export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
     export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
-    export import ZeroTrustAppsSinglePage = ApplicationsAPI.ZeroTrustAppsSinglePage;
+    export import ApplicationsSinglePage = ApplicationsAPI.ApplicationsSinglePage;
     export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
     export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
     export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -2424,22 +2308,24 @@ export declare namespace Applications {
     export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
     export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
     export import CAs = CAsAPI.CAs;
-    export import ZeroTrustCA = CAsAPI.ZeroTrustCA;
+    export import CA = CAsAPI.CA;
     export import CACreateResponse = CAsAPI.CACreateResponse;
     export import CADeleteResponse = CAsAPI.CADeleteResponse;
     export import CAGetResponse = CAsAPI.CAGetResponse;
-    export import ZeroTrustCAsSinglePage = CAsAPI.ZeroTrustCAsSinglePage;
+    export import CAsSinglePage = CAsAPI.CAsSinglePage;
     export import CACreateParams = CAsAPI.CACreateParams;
     export import CAListParams = CAsAPI.CAListParams;
     export import CADeleteParams = CAsAPI.CADeleteParams;
     export import CAGetParams = CAsAPI.CAGetParams;
     export import UserPolicyChecks = UserPolicyChecksAPI.UserPolicyChecks;
+    export import UserPolicyCheckGeo = UserPolicyChecksAPI.UserPolicyCheckGeo;
     export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
     export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
     export import Policies = PoliciesAPI.Policies;
-    export import ZeroTrustPolicies = PoliciesAPI.ZeroTrustPolicies;
+    export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+    export import Policy = PoliciesAPI.Policy;
     export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
-    export import ZeroTrustPoliciesSinglePage = PoliciesAPI.ZeroTrustPoliciesSinglePage;
+    export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
     export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
     export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
     export import PolicyListParams = PoliciesAPI.PolicyListParams;