cloudflare 3.0.0 → 3.2.0

package/src/resources/zero-trust/access/applications/applications.ts

@@ -20,7 +20,7 @@ export class Applications extends APIResource {
   /**
    * Adds a new application to Access.
    */
-  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps> {
+  create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<Application> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -42,7 +42,7 @@ export class Applications extends APIResource {
       this._client.post(`/${accountOrZone}/${accountOrZoneId}/access/apps`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: ZeroTrustApps }>
+      }) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -50,10 +50,10 @@ export class Applications extends APIResource {
    * Updates an Access application.
    */
   update(
-    appId: string | string,
+    appId: AppIDParam,
     params: ApplicationUpdateParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ZeroTrustApps> {
+  ): Core.APIPromise<Application> {
     const { account_id, zone_id, ...body } = params;
     if (!account_id && !zone_id) {
       throw new CloudflareError('You must provide either account_id or zone_id.');
@@ -75,7 +75,7 @@ export class Applications extends APIResource {
       this._client.put(`/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: ZeroTrustApps }>
+      }) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -85,12 +85,12 @@ export class Applications extends APIResource {
   list(
     params?: ApplicationListParams,
     options?: Core.RequestOptions,
-  ): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
-  list(options?: Core.RequestOptions): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps>;
+  ): Core.PagePromise<ApplicationsSinglePage, Application>;
+  list(options?: Core.RequestOptions): Core.PagePromise<ApplicationsSinglePage, Application>;
   list(
     params: ApplicationListParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.PagePromise<ZeroTrustAppsSinglePage, ZeroTrustApps> {
+  ): Core.PagePromise<ApplicationsSinglePage, Application> {
     if (isRequestOptions(params)) {
       return this.list({}, params);
     }
@@ -113,7 +113,7 @@ export class Applications extends APIResource {
         };
     return this._client.getAPIList(
       `/${accountOrZone}/${accountOrZoneId}/access/apps`,
-      ZeroTrustAppsSinglePage,
+      ApplicationsSinglePage,
       options,
     );
   }
@@ -122,13 +122,13 @@ export class Applications extends APIResource {
    * Deletes an application from Access.
    */
   delete(
-    appId: string | string,
+    appId: AppIDParam,
     params?: ApplicationDeleteParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationDeleteResponse>;
-  delete(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
+  delete(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
   delete(
-    appId: string | string,
+    appId: AppIDParam,
     params: ApplicationDeleteParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationDeleteResponse> {
@@ -164,16 +164,16 @@ export class Applications extends APIResource {
    * Fetches information about an Access application.
    */
   get(
-    appId: string | string,
+    appId: AppIDParam,
     params?: ApplicationGetParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ZeroTrustApps>;
-  get(appId: string | string, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustApps>;
+  ): Core.APIPromise<Application>;
+  get(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<Application>;
   get(
-    appId: string | string,
+    appId: AppIDParam,
     params: ApplicationGetParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ZeroTrustApps> {
+  ): Core.APIPromise<Application> {
     if (isRequestOptions(params)) {
       return this.get(appId, {}, params);
     }
@@ -198,7 +198,7 @@ export class Applications extends APIResource {
       this._client.get(
         `/${accountOrZone}/${accountOrZoneId}/access/apps/${appId}`,
         options,
-      ) as Core.APIPromise<{ result: ZeroTrustApps }>
+      ) as Core.APIPromise<{ result: Application }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -206,16 +206,16 @@ export class Applications extends APIResource {
    * Revokes all tokens issued for an application.
    */
   revokeTokens(
-    appId: string | string,
+    appId: AppIDParam,
     params?: ApplicationRevokeTokensParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
   revokeTokens(
-    appId: string | string,
+    appId: AppIDParam,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
   revokeTokens(
-    appId: string | string,
+    appId: AppIDParam,
     params: ApplicationRevokeTokensParams | Core.RequestOptions = {},
     options?: Core.RequestOptions,
   ): Core.APIPromise<ApplicationRevokeTokensResponse | null> {
@@ -248,19 +248,69 @@ export class Applications extends APIResource {
   }
 }
 
-export class ZeroTrustAppsSinglePage extends SinglePage<ZeroTrustApps> {}
-
-export type ZeroTrustApps =
-  | ZeroTrustApps.SelfHostedApplication
-  | ZeroTrustApps.SaaSApplication
-  | ZeroTrustApps.BrowserSSHApplication
-  | ZeroTrustApps.BrowserVncApplication
-  | ZeroTrustApps.AppLauncherApplication
-  | ZeroTrustApps.DeviceEnrollmentPermissionsApplication
-  | ZeroTrustApps.BrowserIsolationPermissionsApplication
-  | ZeroTrustApps.BookmarkApplication;
-
-export namespace ZeroTrustApps {
+export class ApplicationsSinglePage extends SinglePage<Application> {}
+
+export type AllowedHeaders = string;
+
+export type AllowedHeadersParam = string;
+
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdPs = string;
+
+/**
+ * The identity providers selected for application.
+ */
+export type AllowedIdPsParam = string;
+
+export type AllowedMethods =
+  | 'GET'
+  | 'POST'
+  | 'HEAD'
+  | 'PUT'
+  | 'DELETE'
+  | 'CONNECT'
+  | 'OPTIONS'
+  | 'TRACE'
+  | 'PATCH';
+
+export type AllowedMethodsParam =
+  | 'GET'
+  | 'POST'
+  | 'HEAD'
+  | 'PUT'
+  | 'DELETE'
+  | 'CONNECT'
+  | 'OPTIONS'
+  | 'TRACE'
+  | 'PATCH';
+
+export type AllowedOrigins = string;
+
+export type AllowedOriginsParam = string;
+
+/**
+ * Identifier
+ */
+export type AppID = string | string;
+
+/**
+ * Identifier
+ */
+export type AppIDParam = string | string;
+
+export type Application =
+  | Application.SelfHostedApplication
+  | Application.SaaSApplication
+  | Application.BrowserSSHApplication
+  | Application.BrowserVncApplication
+  | Application.AppLauncherApplication
+  | Application.DeviceEnrollmentPermissionsApplication
+  | Application.BrowserIsolationPermissionsApplication
+  | Application.BookmarkApplication;
+
+export namespace Application {
   export interface SelfHostedApplication {
     /**
      * The primary hostname and path that Access will secure. If the app is visible in
@@ -290,7 +340,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Displays the application in the App Launcher.
@@ -308,7 +358,7 @@ export namespace ZeroTrustApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: SelfHostedApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -357,6 +407,12 @@ export namespace ZeroTrustApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -372,7 +428,7 @@ export namespace ZeroTrustApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -400,53 +456,6 @@ export namespace ZeroTrustApps {
     updated_at?: string;
   }
 
-  export namespace SelfHostedApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface SaaSApplication {
     /**
      * UUID
@@ -457,7 +466,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Displays the application in the App Launcher.
@@ -492,7 +501,7 @@ export namespace ZeroTrustApps {
      */
     name?: string;
 
-    saas_app?: SaaSApplication.AccessSamlSaasApp | SaaSApplication.AccessOidcSaasApp;
+    saas_app?: ApplicationsAPI.SAMLSaaSApp | SaaSApplication.AccessOIDCSaaSApp;
 
     /**
      * The tags you want assigned to an application. Tags are used to filter
@@ -509,103 +518,7 @@ export namespace ZeroTrustApps {
   }
 
   export namespace SaaSApplication {
-    export interface AccessSamlSaasApp {
-      /**
-       * Optional identifier indicating the authentication protocol used for the saas
-       * app. Required for OIDC. Default if unset is "saml"
-       */
-      auth_type?: 'saml' | 'oidc';
-
-      /**
-       * The service provider's endpoint that is responsible for receiving and parsing a
-       * SAML assertion.
-       */
-      consumer_service_url?: string;
-
-      created_at?: string;
-
-      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-
-      /**
-       * The URL that the user will be redirected to after a successful login for IDP
-       * initiated logins.
-       */
-      default_relay_state?: string;
-
-      /**
-       * The unique identifier for your SaaS application.
-       */
-      idp_entity_id?: string;
-
-      /**
-       * The format of the name identifier sent to the SaaS application.
-       */
-      name_id_format?: 'id' | 'email';
-
-      /**
-       * A [JSONata](https://jsonata.org/) expression that transforms an application's
-       * user identities into a NameID value for its SAML assertion. This expression
-       * should evaluate to a singular string. The output of this expression can override
-       * the `name_id_format` setting.
-       */
-      name_id_transform_jsonata?: string;
-
-      /**
-       * The Access public certificate that will be used to verify your identity.
-       */
-      public_key?: string;
-
-      /**
-       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-       * user identities into attribute assertions in the SAML response. The expression
-       * can transform id, email, name, and groups values. It can also transform fields
-       * listed in the saml_attributes or oidc_fields of the identity provider used to
-       * authenticate. The output of this expression must be a JSON object.
-       */
-      saml_attribute_transform_jsonata?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      sp_entity_id?: string;
-
-      /**
-       * The endpoint where your SaaS application will send login requests.
-       */
-      sso_endpoint?: string;
-
-      updated_at?: string;
-    }
-
-    export namespace AccessSamlSaasApp {
-      export interface CustomAttributes {
-        /**
-         * The name of the attribute.
-         */
-        name?: string;
-
-        /**
-         * A globally unique name for an identity or service provider.
-         */
-        name_format?:
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-
-        source?: CustomAttributes.Source;
-      }
-
-      export namespace CustomAttributes {
-        export interface Source {
-          /**
-           * The name of the IdP attribute.
-           */
-          name?: string;
-        }
-      }
-    }
-
-    export interface AccessOidcSaasApp {
+    export interface AccessOIDCSaaSApp {
       /**
        * The URL where this applications tile redirects users
        */
@@ -629,6 +542,8 @@ export namespace ZeroTrustApps {
 
       created_at?: string;
 
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
       /**
        * The OIDC flows supported by this application
        */
@@ -657,6 +572,41 @@ export namespace ZeroTrustApps {
 
       updated_at?: string;
     }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
   }
 
   export interface BrowserSSHApplication {
@@ -688,7 +638,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Displays the application in the App Launcher.
@@ -706,7 +656,7 @@ export namespace ZeroTrustApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: BrowserSSHApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -755,6 +705,12 @@ export namespace ZeroTrustApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -770,7 +726,7 @@ export namespace ZeroTrustApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -798,53 +754,6 @@ export namespace ZeroTrustApps {
     updated_at?: string;
   }
 
-  export namespace BrowserSSHApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface BrowserVncApplication {
     /**
      * The primary hostname and path that Access will secure. If the app is visible in
@@ -874,7 +783,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Displays the application in the App Launcher.
@@ -892,7 +801,7 @@ export namespace ZeroTrustApps {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: BrowserVncApplication.CorsHeaders;
+    cors_headers?: ApplicationsAPI.CORSHeaders;
 
     created_at?: string;
 
@@ -941,6 +850,12 @@ export namespace ZeroTrustApps {
      */
     name?: string;
 
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Enables cookie paths to scope an application's JWT to the application path. If
      * disabled, the JWT will scope to the hostname by default
@@ -956,7 +871,7 @@ export namespace ZeroTrustApps {
     /**
      * List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<ApplicationsAPI.SelfHostedDomains>;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -984,58 +899,11 @@ export namespace ZeroTrustApps {
     updated_at?: string;
   }
 
-  export namespace BrowserVncApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface AppLauncherApplication {
     /**
      * The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationsAPI.ApplicationType;
 
     /**
      * UUID
@@ -1046,7 +914,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
@@ -1086,7 +954,7 @@ export namespace ZeroTrustApps {
     /**
      * The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationsAPI.ApplicationType;
 
     /**
      * UUID
@@ -1097,7 +965,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
@@ -1137,7 +1005,7 @@ export namespace ZeroTrustApps {
     /**
      * The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationsAPI.ApplicationType;
 
     /**
      * UUID
@@ -1148,7 +1016,7 @@ export namespace ZeroTrustApps {
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
@@ -1232,6 +1100,364 @@ export namespace ZeroTrustApps {
   }
 }
 
+/**
+ * The application type.
+ */
+export type ApplicationType =
+  | 'self_hosted'
+  | 'saas'
+  | 'ssh'
+  | 'vnc'
+  | 'app_launcher'
+  | 'warp'
+  | 'biso'
+  | 'bookmark'
+  | 'dash_sso';
+
+/**
+ * The application type.
+ */
+export type ApplicationTypeParam =
+  | 'self_hosted'
+  | 'saas'
+  | 'ssh'
+  | 'vnc'
+  | 'app_launcher'
+  | 'warp'
+  | 'biso'
+  | 'bookmark'
+  | 'dash_sso';
+
+export interface CORSHeaders {
+  /**
+   * Allows all HTTP request headers.
+   */
+  allow_all_headers?: boolean;
+
+  /**
+   * Allows all HTTP request methods.
+   */
+  allow_all_methods?: boolean;
+
+  /**
+   * Allows all origins.
+   */
+  allow_all_origins?: boolean;
+
+  /**
+   * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+   * client certificates) with requests.
+   */
+  allow_credentials?: boolean;
+
+  /**
+   * Allowed HTTP request headers.
+   */
+  allowed_headers?: Array<AllowedHeaders>;
+
+  /**
+   * Allowed HTTP request methods.
+   */
+  allowed_methods?: Array<AllowedMethods>;
+
+  /**
+   * Allowed origins.
+   */
+  allowed_origins?: Array<AllowedOrigins>;
+
+  /**
+   * The maximum number of seconds the results of a preflight request can be cached.
+   */
+  max_age?: number;
+}
+
+export interface CORSHeadersParam {
+  /**
+   * Allows all HTTP request headers.
+   */
+  allow_all_headers?: boolean;
+
+  /**
+   * Allows all HTTP request methods.
+   */
+  allow_all_methods?: boolean;
+
+  /**
+   * Allows all origins.
+   */
+  allow_all_origins?: boolean;
+
+  /**
+   * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+   * client certificates) with requests.
+   */
+  allow_credentials?: boolean;
+
+  /**
+   * Allowed HTTP request headers.
+   */
+  allowed_headers?: Array<AllowedHeadersParam>;
+
+  /**
+   * Allowed HTTP request methods.
+   */
+  allowed_methods?: Array<AllowedMethodsParam>;
+
+  /**
+   * Allowed origins.
+   */
+  allowed_origins?: Array<AllowedOriginsParam>;
+
+  /**
+   * The maximum number of seconds the results of a preflight request can be cached.
+   */
+  max_age?: number;
+}
+
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormat =
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+
+/**
+ * A globally unique name for an identity or service provider.
+ */
+export type SaaSAppNameFormatParam =
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+  | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
+
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormat = 'id' | 'email';
+
+/**
+ * The format of the name identifier sent to the SaaS application.
+ */
+export type SaaSAppNameIDFormatParam = 'id' | 'email';
+
+export interface SaaSAppSource {
+  /**
+   * The name of the IdP attribute.
+   */
+  name?: string;
+
+  /**
+   * A mapping from IdP ID to attribute name.
+   */
+  name_by_idp?: Record<string, string>;
+}
+
+export interface SaaSAppSourceParam {
+  /**
+   * The name of the IdP attribute.
+   */
+  name?: string;
+
+  /**
+   * A mapping from IdP ID to attribute name.
+   */
+  name_by_idp?: Record<string, string>;
+}
+
+export interface SAMLSaaSApp {
+  /**
+   * Optional identifier indicating the authentication protocol used for the saas
+   * app. Required for OIDC. Default if unset is "saml"
+   */
+  auth_type?: 'saml' | 'oidc';
+
+  /**
+   * The service provider's endpoint that is responsible for receiving and parsing a
+   * SAML assertion.
+   */
+  consumer_service_url?: string;
+
+  created_at?: string;
+
+  custom_attributes?: SAMLSaaSApp.CustomAttributes;
+
+  /**
+   * The URL that the user will be redirected to after a successful login for IDP
+   * initiated logins.
+   */
+  default_relay_state?: string;
+
+  /**
+   * The unique identifier for your SaaS application.
+   */
+  idp_entity_id?: string;
+
+  /**
+   * The format of the name identifier sent to the SaaS application.
+   */
+  name_id_format?: SaaSAppNameIDFormat;
+
+  /**
+   * A [JSONata](https://jsonata.org/) expression that transforms an application's
+   * user identities into a NameID value for its SAML assertion. This expression
+   * should evaluate to a singular string. The output of this expression can override
+   * the `name_id_format` setting.
+   */
+  name_id_transform_jsonata?: string;
+
+  /**
+   * The Access public certificate that will be used to verify your identity.
+   */
+  public_key?: string;
+
+  /**
+   * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+   * user identities into attribute assertions in the SAML response. The expression
+   * can transform id, email, name, and groups values. It can also transform fields
+   * listed in the saml_attributes or oidc_fields of the identity provider used to
+   * authenticate. The output of this expression must be a JSON object.
+   */
+  saml_attribute_transform_jsonata?: string;
+
+  /**
+   * A globally unique name for an identity or service provider.
+   */
+  sp_entity_id?: string;
+
+  /**
+   * The endpoint where your SaaS application will send login requests.
+   */
+  sso_endpoint?: string;
+
+  updated_at?: string;
+}
+
+export namespace SAMLSaaSApp {
+  export interface CustomAttributes {
+    /**
+     * The SAML FriendlyName of the attribute.
+     */
+    friendly_name?: string;
+
+    /**
+     * The name of the attribute.
+     */
+    name?: string;
+
+    /**
+     * A globally unique name for an identity or service provider.
+     */
+    name_format?: ApplicationsAPI.SaaSAppNameFormat;
+
+    /**
+     * If the attribute is required when building a SAML assertion.
+     */
+    required?: boolean;
+
+    source?: ApplicationsAPI.SaaSAppSource;
+  }
+}
+
+export interface SAMLSaaSAppParam {
+  /**
+   * Optional identifier indicating the authentication protocol used for the saas
+   * app. Required for OIDC. Default if unset is "saml"
+   */
+  auth_type?: 'saml' | 'oidc';
+
+  /**
+   * The service provider's endpoint that is responsible for receiving and parsing a
+   * SAML assertion.
+   */
+  consumer_service_url?: string;
+
+  custom_attributes?: SAMLSaaSAppParam.CustomAttributes;
+
+  /**
+   * The URL that the user will be redirected to after a successful login for IDP
+   * initiated logins.
+   */
+  default_relay_state?: string;
+
+  /**
+   * The unique identifier for your SaaS application.
+   */
+  idp_entity_id?: string;
+
+  /**
+   * The format of the name identifier sent to the SaaS application.
+   */
+  name_id_format?: SaaSAppNameIDFormatParam;
+
+  /**
+   * A [JSONata](https://jsonata.org/) expression that transforms an application's
+   * user identities into a NameID value for its SAML assertion. This expression
+   * should evaluate to a singular string. The output of this expression can override
+   * the `name_id_format` setting.
+   */
+  name_id_transform_jsonata?: string;
+
+  /**
+   * The Access public certificate that will be used to verify your identity.
+   */
+  public_key?: string;
+
+  /**
+   * A [JSONata] (https://jsonata.org/) expression that transforms an application's
+   * user identities into attribute assertions in the SAML response. The expression
+   * can transform id, email, name, and groups values. It can also transform fields
+   * listed in the saml_attributes or oidc_fields of the identity provider used to
+   * authenticate. The output of this expression must be a JSON object.
+   */
+  saml_attribute_transform_jsonata?: string;
+
+  /**
+   * A globally unique name for an identity or service provider.
+   */
+  sp_entity_id?: string;
+
+  /**
+   * The endpoint where your SaaS application will send login requests.
+   */
+  sso_endpoint?: string;
+}
+
+export namespace SAMLSaaSAppParam {
+  export interface CustomAttributes {
+    /**
+     * The SAML FriendlyName of the attribute.
+     */
+    friendly_name?: string;
+
+    /**
+     * The name of the attribute.
+     */
+    name?: string;
+
+    /**
+     * A globally unique name for an identity or service provider.
+     */
+    name_format?: ApplicationsAPI.SaaSAppNameFormatParam;
+
+    /**
+     * If the attribute is required when building a SAML assertion.
+     */
+    required?: boolean;
+
+    source?: ApplicationsAPI.SaaSAppSourceParam;
+  }
+}
+
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomains = string;
+
+/**
+ * A domain that Access will secure.
+ */
+export type SelfHostedDomainsParam = string;
+
 export interface ApplicationDeleteResponse {
   /**
    * UUID
@@ -1289,7 +1515,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -1305,7 +1531,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationCreateParams.SelfHostedApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -1353,6 +1579,12 @@ export namespace ApplicationCreateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -1368,7 +1600,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -1395,53 +1627,6 @@ export namespace ApplicationCreateParams {
     tags?: Array<string>;
   }
 
-  export namespace SelfHostedApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface SaaSApplication {
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -1459,7 +1644,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -1491,116 +1676,22 @@ export namespace ApplicationCreateParams {
     /**
      * Body param:
      */
-    saas_app?:
-      | ApplicationCreateParams.SaaSApplication.AccessSamlSaasApp
-      | ApplicationCreateParams.SaaSApplication.AccessOidcSaasApp;
+    saas_app?: SAMLSaaSAppParam | ApplicationCreateParams.SaaSApplication.AccessOIDCSaaSApp;
 
     /**
-     * Body param: The tags you want assigned to an application. Tags are used to
-     * filter applications in the App Launcher dashboard.
-     */
-    tags?: Array<string>;
-
-    /**
-     * Body param: The application type.
-     */
-    type?: string;
-  }
-
-  export namespace SaaSApplication {
-    export interface AccessSamlSaasApp {
-      /**
-       * Optional identifier indicating the authentication protocol used for the saas
-       * app. Required for OIDC. Default if unset is "saml"
-       */
-      auth_type?: 'saml' | 'oidc';
-
-      /**
-       * The service provider's endpoint that is responsible for receiving and parsing a
-       * SAML assertion.
-       */
-      consumer_service_url?: string;
-
-      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-
-      /**
-       * The URL that the user will be redirected to after a successful login for IDP
-       * initiated logins.
-       */
-      default_relay_state?: string;
-
-      /**
-       * The unique identifier for your SaaS application.
-       */
-      idp_entity_id?: string;
-
-      /**
-       * The format of the name identifier sent to the SaaS application.
-       */
-      name_id_format?: 'id' | 'email';
-
-      /**
-       * A [JSONata](https://jsonata.org/) expression that transforms an application's
-       * user identities into a NameID value for its SAML assertion. This expression
-       * should evaluate to a singular string. The output of this expression can override
-       * the `name_id_format` setting.
-       */
-      name_id_transform_jsonata?: string;
-
-      /**
-       * The Access public certificate that will be used to verify your identity.
-       */
-      public_key?: string;
-
-      /**
-       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-       * user identities into attribute assertions in the SAML response. The expression
-       * can transform id, email, name, and groups values. It can also transform fields
-       * listed in the saml_attributes or oidc_fields of the identity provider used to
-       * authenticate. The output of this expression must be a JSON object.
-       */
-      saml_attribute_transform_jsonata?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      sp_entity_id?: string;
-
-      /**
-       * The endpoint where your SaaS application will send login requests.
-       */
-      sso_endpoint?: string;
-    }
-
-    export namespace AccessSamlSaasApp {
-      export interface CustomAttributes {
-        /**
-         * The name of the attribute.
-         */
-        name?: string;
-
-        /**
-         * A globally unique name for an identity or service provider.
-         */
-        name_format?:
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-
-        source?: CustomAttributes.Source;
-      }
-
-      export namespace CustomAttributes {
-        export interface Source {
-          /**
-           * The name of the IdP attribute.
-           */
-          name?: string;
-        }
-      }
-    }
+     * Body param: The tags you want assigned to an application. Tags are used to
+     * filter applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * Body param: The application type.
+     */
+    type?: string;
+  }
 
-    export interface AccessOidcSaasApp {
+  export namespace SaaSApplication {
+    export interface AccessOIDCSaaSApp {
       /**
        * The URL where this applications tile redirects users
        */
@@ -1622,6 +1713,8 @@ export namespace ApplicationCreateParams {
        */
       client_secret?: string;
 
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
       /**
        * The OIDC flows supported by this application
        */
@@ -1648,6 +1741,41 @@ export namespace ApplicationCreateParams {
        */
       scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
     }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
   }
 
   export interface BrowserSSHApplication {
@@ -1687,7 +1815,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -1703,7 +1831,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationCreateParams.BrowserSSHApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -1751,6 +1879,12 @@ export namespace ApplicationCreateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -1766,7 +1900,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -1793,53 +1927,6 @@ export namespace ApplicationCreateParams {
     tags?: Array<string>;
   }
 
-  export namespace BrowserSSHApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface BrowserVncApplication {
     /**
      * Body param: The primary hostname and path that Access will secure. If the app is
@@ -1877,7 +1964,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -1893,7 +1980,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationCreateParams.BrowserVncApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -1941,6 +2028,12 @@ export namespace ApplicationCreateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -1956,7 +2049,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -1983,58 +2076,11 @@ export namespace ApplicationCreateParams {
     tags?: Array<string>;
   }
 
-  export namespace BrowserVncApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface AppLauncherApplication {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -2052,7 +2098,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -2072,7 +2118,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -2090,7 +2136,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -2110,7 +2156,7 @@ export namespace ApplicationCreateParams {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -2128,7 +2174,7 @@ export namespace ApplicationCreateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -2238,7 +2284,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -2254,7 +2300,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationUpdateParams.SelfHostedApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -2302,6 +2348,12 @@ export namespace ApplicationUpdateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -2317,7 +2369,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -2344,53 +2396,6 @@ export namespace ApplicationUpdateParams {
     tags?: Array<string>;
   }
 
-  export namespace SelfHostedApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface SaaSApplication {
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -2408,7 +2413,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -2440,9 +2445,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param:
      */
-    saas_app?:
-      | ApplicationUpdateParams.SaaSApplication.AccessSamlSaasApp
-      | ApplicationUpdateParams.SaaSApplication.AccessOidcSaasApp;
+    saas_app?: SAMLSaaSAppParam | ApplicationUpdateParams.SaaSApplication.AccessOIDCSaaSApp;
 
     /**
      * Body param: The tags you want assigned to an application. Tags are used to
@@ -2457,99 +2460,7 @@ export namespace ApplicationUpdateParams {
   }
 
   export namespace SaaSApplication {
-    export interface AccessSamlSaasApp {
-      /**
-       * Optional identifier indicating the authentication protocol used for the saas
-       * app. Required for OIDC. Default if unset is "saml"
-       */
-      auth_type?: 'saml' | 'oidc';
-
-      /**
-       * The service provider's endpoint that is responsible for receiving and parsing a
-       * SAML assertion.
-       */
-      consumer_service_url?: string;
-
-      custom_attributes?: AccessSamlSaasApp.CustomAttributes;
-
-      /**
-       * The URL that the user will be redirected to after a successful login for IDP
-       * initiated logins.
-       */
-      default_relay_state?: string;
-
-      /**
-       * The unique identifier for your SaaS application.
-       */
-      idp_entity_id?: string;
-
-      /**
-       * The format of the name identifier sent to the SaaS application.
-       */
-      name_id_format?: 'id' | 'email';
-
-      /**
-       * A [JSONata](https://jsonata.org/) expression that transforms an application's
-       * user identities into a NameID value for its SAML assertion. This expression
-       * should evaluate to a singular string. The output of this expression can override
-       * the `name_id_format` setting.
-       */
-      name_id_transform_jsonata?: string;
-
-      /**
-       * The Access public certificate that will be used to verify your identity.
-       */
-      public_key?: string;
-
-      /**
-       * A [JSONata] (https://jsonata.org/) expression that transforms an application's
-       * user identities into attribute assertions in the SAML response. The expression
-       * can transform id, email, name, and groups values. It can also transform fields
-       * listed in the saml_attributes or oidc_fields of the identity provider used to
-       * authenticate. The output of this expression must be a JSON object.
-       */
-      saml_attribute_transform_jsonata?: string;
-
-      /**
-       * A globally unique name for an identity or service provider.
-       */
-      sp_entity_id?: string;
-
-      /**
-       * The endpoint where your SaaS application will send login requests.
-       */
-      sso_endpoint?: string;
-    }
-
-    export namespace AccessSamlSaasApp {
-      export interface CustomAttributes {
-        /**
-         * The name of the attribute.
-         */
-        name?: string;
-
-        /**
-         * A globally unique name for an identity or service provider.
-         */
-        name_format?:
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
-          | 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri';
-
-        source?: CustomAttributes.Source;
-      }
-
-      export namespace CustomAttributes {
-        export interface Source {
-          /**
-           * The name of the IdP attribute.
-           */
-          name?: string;
-        }
-      }
-    }
-
-    export interface AccessOidcSaasApp {
+    export interface AccessOIDCSaaSApp {
       /**
        * The URL where this applications tile redirects users
        */
@@ -2571,6 +2482,8 @@ export namespace ApplicationUpdateParams {
        */
       client_secret?: string;
 
+      custom_claims?: AccessOIDCSaaSApp.CustomClaims;
+
       /**
        * The OIDC flows supported by this application
        */
@@ -2597,6 +2510,41 @@ export namespace ApplicationUpdateParams {
        */
       scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
     }
+
+    export namespace AccessOIDCSaaSApp {
+      export interface CustomClaims {
+        /**
+         * The name of the claim.
+         */
+        name?: string;
+
+        /**
+         * A mapping from IdP ID to claim name.
+         */
+        name_by_idp?: Record<string, string>;
+
+        /**
+         * If the claim is required when building an OIDC token.
+         */
+        required?: boolean;
+
+        /**
+         * The scope of the claim.
+         */
+        scope?: 'groups' | 'profile' | 'email' | 'openid';
+
+        source?: CustomClaims.Source;
+      }
+
+      export namespace CustomClaims {
+        export interface Source {
+          /**
+           * The name of the IdP claim.
+           */
+          name?: string;
+        }
+      }
+    }
   }
 
   export interface BrowserSSHApplication {
@@ -2636,7 +2584,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -2652,7 +2600,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationUpdateParams.BrowserSSHApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -2700,6 +2648,12 @@ export namespace ApplicationUpdateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -2715,7 +2669,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -2742,53 +2696,6 @@ export namespace ApplicationUpdateParams {
     tags?: Array<string>;
   }
 
-  export namespace BrowserSSHApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface BrowserVncApplication {
     /**
      * Body param: The primary hostname and path that Access will secure. If the app is
@@ -2826,7 +2733,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: Displays the application in the App Launcher.
@@ -2842,7 +2749,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param:
      */
-    cors_headers?: ApplicationUpdateParams.BrowserVncApplication.CorsHeaders;
+    cors_headers?: CORSHeadersParam;
 
     /**
      * Body param: The custom error message shown to a user when they are denied access
@@ -2890,6 +2797,12 @@ export namespace ApplicationUpdateParams {
      */
     name?: string;
 
+    /**
+     * Body param: Allows options preflight requests to bypass Access authentication
+     * and go directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
     /**
      * Body param: Enables cookie paths to scope an application's JWT to the
      * application path. If disabled, the JWT will scope to the hostname by default
@@ -2905,7 +2818,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param: List of domains that Access will secure.
      */
-    self_hosted_domains?: Array<string>;
+    self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
     /**
      * Body param: Returns a 401 status code when the request is blocked by a Service
@@ -2932,58 +2845,11 @@ export namespace ApplicationUpdateParams {
     tags?: Array<string>;
   }
 
-  export namespace BrowserVncApplication {
-    export interface CorsHeaders {
-      /**
-       * Allows all HTTP request headers.
-       */
-      allow_all_headers?: boolean;
-
-      /**
-       * Allows all HTTP request methods.
-       */
-      allow_all_methods?: boolean;
-
-      /**
-       * Allows all origins.
-       */
-      allow_all_origins?: boolean;
-
-      /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
-       */
-      allow_credentials?: boolean;
-
-      /**
-       * Allowed HTTP request headers.
-       */
-      allowed_headers?: Array<string>;
-
-      /**
-       * Allowed HTTP request methods.
-       */
-      allowed_methods?: Array<
-        'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | 'CONNECT' | 'OPTIONS' | 'TRACE' | 'PATCH'
-      >;
-
-      /**
-       * Allowed origins.
-       */
-      allowed_origins?: Array<string>;
-
-      /**
-       * The maximum number of seconds the results of a preflight request can be cached.
-       */
-      max_age?: number;
-    }
-  }
-
   export interface AppLauncherApplication {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -3001,7 +2867,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -3021,7 +2887,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -3039,7 +2905,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -3059,7 +2925,7 @@ export namespace ApplicationUpdateParams {
     /**
      * Body param: The application type.
      */
-    type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+    type: ApplicationTypeParam;
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -3077,7 +2943,7 @@ export namespace ApplicationUpdateParams {
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
      */
-    allowed_idps?: Array<string>;
+    allowed_idps?: Array<AllowedIdPsParam>;
 
     /**
      * Body param: When set to `true`, users skip the identity provider selection step
@@ -3188,10 +3054,22 @@ export interface ApplicationRevokeTokensParams {
 }
 
 export namespace Applications {
-  export import ZeroTrustApps = ApplicationsAPI.ZeroTrustApps;
+  export import AllowedHeaders = ApplicationsAPI.AllowedHeaders;
+  export import AllowedIdPs = ApplicationsAPI.AllowedIdPs;
+  export import AllowedMethods = ApplicationsAPI.AllowedMethods;
+  export import AllowedOrigins = ApplicationsAPI.AllowedOrigins;
+  export import AppID = ApplicationsAPI.AppID;
+  export import Application = ApplicationsAPI.Application;
+  export import ApplicationType = ApplicationsAPI.ApplicationType;
+  export import CORSHeaders = ApplicationsAPI.CORSHeaders;
+  export import SaaSAppNameFormat = ApplicationsAPI.SaaSAppNameFormat;
+  export import SaaSAppNameIDFormat = ApplicationsAPI.SaaSAppNameIDFormat;
+  export import SaaSAppSource = ApplicationsAPI.SaaSAppSource;
+  export import SAMLSaaSApp = ApplicationsAPI.SAMLSaaSApp;
+  export import SelfHostedDomains = ApplicationsAPI.SelfHostedDomains;
   export import ApplicationDeleteResponse = ApplicationsAPI.ApplicationDeleteResponse;
   export import ApplicationRevokeTokensResponse = ApplicationsAPI.ApplicationRevokeTokensResponse;
-  export import ZeroTrustAppsSinglePage = ApplicationsAPI.ZeroTrustAppsSinglePage;
+  export import ApplicationsSinglePage = ApplicationsAPI.ApplicationsSinglePage;
   export import ApplicationCreateParams = ApplicationsAPI.ApplicationCreateParams;
   export import ApplicationUpdateParams = ApplicationsAPI.ApplicationUpdateParams;
   export import ApplicationListParams = ApplicationsAPI.ApplicationListParams;
@@ -3199,22 +3077,24 @@ export namespace Applications {
   export import ApplicationGetParams = ApplicationsAPI.ApplicationGetParams;
   export import ApplicationRevokeTokensParams = ApplicationsAPI.ApplicationRevokeTokensParams;
   export import CAs = CAsAPI.CAs;
-  export import ZeroTrustCA = CAsAPI.ZeroTrustCA;
+  export import CA = CAsAPI.CA;
   export import CACreateResponse = CAsAPI.CACreateResponse;
   export import CADeleteResponse = CAsAPI.CADeleteResponse;
   export import CAGetResponse = CAsAPI.CAGetResponse;
-  export import ZeroTrustCAsSinglePage = CAsAPI.ZeroTrustCAsSinglePage;
+  export import CAsSinglePage = CAsAPI.CAsSinglePage;
   export import CACreateParams = CAsAPI.CACreateParams;
   export import CAListParams = CAsAPI.CAListParams;
   export import CADeleteParams = CAsAPI.CADeleteParams;
   export import CAGetParams = CAsAPI.CAGetParams;
   export import UserPolicyChecks = UserPolicyChecksAPI.UserPolicyChecks;
+  export import UserPolicyCheckGeo = UserPolicyChecksAPI.UserPolicyCheckGeo;
   export import UserPolicyCheckListResponse = UserPolicyChecksAPI.UserPolicyCheckListResponse;
   export import UserPolicyCheckListParams = UserPolicyChecksAPI.UserPolicyCheckListParams;
   export import Policies = PoliciesAPI.Policies;
-  export import ZeroTrustPolicies = PoliciesAPI.ZeroTrustPolicies;
+  export import ApprovalGroup = PoliciesAPI.ApprovalGroup;
+  export import Policy = PoliciesAPI.Policy;
   export import PolicyDeleteResponse = PoliciesAPI.PolicyDeleteResponse;
-  export import ZeroTrustPoliciesSinglePage = PoliciesAPI.ZeroTrustPoliciesSinglePage;
+  export import PoliciesSinglePage = PoliciesAPI.PoliciesSinglePage;
   export import PolicyCreateParams = PoliciesAPI.PolicyCreateParams;
   export import PolicyUpdateParams = PoliciesAPI.PolicyUpdateParams;
   export import PolicyListParams = PoliciesAPI.PolicyListParams;