cloudflare 3.0.0 → 3.2.0

package/src/resources/zero-trust/gateway/rules.ts

@@ -9,11 +9,11 @@ export class Rules extends APIResource {
   /**
    * Creates a new Zero Trust Gateway rule.
    */
-  create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<ZeroTrustGatewayRules> {
+  create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule> {
     const { account_id, ...body } = params;
     return (
       this._client.post(`/accounts/${account_id}/gateway/rules`, { body, ...options }) as Core.APIPromise<{
-        result: ZeroTrustGatewayRules;
+        result: GatewayRule;
       }>
     )._thenUnwrap((obj) => obj.result);
   }
@@ -25,13 +25,13 @@ export class Rules extends APIResource {
     ruleId: string,
     params: RuleUpdateParams,
     options?: Core.RequestOptions,
-  ): Core.APIPromise<ZeroTrustGatewayRules> {
+  ): Core.APIPromise<GatewayRule> {
     const { account_id, ...body } = params;
     return (
       this._client.put(`/accounts/${account_id}/gateway/rules/${ruleId}`, {
         body,
         ...options,
-      }) as Core.APIPromise<{ result: ZeroTrustGatewayRules }>
+      }) as Core.APIPromise<{ result: GatewayRule }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -41,13 +41,9 @@ export class Rules extends APIResource {
   list(
     params: RuleListParams,
     options?: Core.RequestOptions,
-  ): Core.PagePromise<ZeroTrustGatewayRulesSinglePage, ZeroTrustGatewayRules> {
+  ): Core.PagePromise<GatewayRulesSinglePage, GatewayRule> {
     const { account_id } = params;
-    return this._client.getAPIList(
-      `/accounts/${account_id}/gateway/rules`,
-      ZeroTrustGatewayRulesSinglePage,
-      options,
-    );
+    return this._client.getAPIList(`/accounts/${account_id}/gateway/rules`, GatewayRulesSinglePage, options);
   }
 
   /**
@@ -69,23 +65,125 @@ export class Rules extends APIResource {
   /**
    * Fetches a single Zero Trust Gateway rule.
    */
-  get(
-    ruleId: string,
-    params: RuleGetParams,
-    options?: Core.RequestOptions,
-  ): Core.APIPromise<ZeroTrustGatewayRules> {
+  get(ruleId: string, params: RuleGetParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule> {
     const { account_id } = params;
     return (
       this._client.get(`/accounts/${account_id}/gateway/rules/${ruleId}`, options) as Core.APIPromise<{
-        result: ZeroTrustGatewayRules;
+        result: GatewayRule;
       }>
     )._thenUnwrap((obj) => obj.result);
   }
 }
 
-export class ZeroTrustGatewayRulesSinglePage extends SinglePage<ZeroTrustGatewayRules> {}
+export class GatewayRulesSinglePage extends SinglePage<GatewayRule> {}
+
+export interface DNSResolverSettingsV4 {
+  /**
+   * IPv4 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
+
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
+export interface DNSResolverSettingsV4Param {
+  /**
+   * IPv4 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
 
-export interface ZeroTrustGatewayRules {
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
+export interface DNSResolverSettingsV6 {
+  /**
+   * IPv6 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
+
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
+export interface DNSResolverSettingsV6Param {
+  /**
+   * IPv6 address of upstream resolver.
+   */
+  ip: string;
+
+  /**
+   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   */
+  port?: number;
+
+  /**
+   * Whether to connect to this resolver over a private network. Must be set when
+   * vnet_id is set.
+   */
+  route_through_private_network?: boolean;
+
+  /**
+   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * network id if omitted.
+   */
+  vnet_id?: string;
+}
+
+/**
+ * The protocol or layer to use.
+ */
+export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress';
+
+/**
+ * The protocol or layer to use.
+ */
+export type GatewayFilterParam = 'http' | 'dns' | 'l4' | 'egress';
+
+export interface GatewayRule {
   /**
    * The API resource UUID.
    */
@@ -109,7 +207,8 @@ export interface ZeroTrustGatewayRules {
     | 'override'
     | 'l4_override'
     | 'egress'
-    | 'audit_ssh';
+    | 'audit_ssh'
+    | 'resolve';
 
   created_at?: string;
 
@@ -137,7 +236,7 @@ export interface ZeroTrustGatewayRules {
    * The protocol or layer to evaluate the traffic, identity, and device posture
    * expressions.
    */
-  filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+  filters?: Array<GatewayFilter>;
 
   /**
    * The wirefilter expression used for identity matching.
@@ -159,13 +258,13 @@ export interface ZeroTrustGatewayRules {
   /**
    * Additional settings that modify the rule's action.
    */
-  rule_settings?: ZeroTrustGatewayRules.RuleSettings;
+  rule_settings?: RuleSetting;
 
   /**
    * The schedule for activating DNS policies. This does not apply to HTTP or network
    * policies.
    */
-  schedule?: ZeroTrustGatewayRules.Schedule;
+  schedule?: Schedule;
 
   /**
    * The wirefilter expression used for traffic matching.
@@ -175,856 +274,677 @@ export interface ZeroTrustGatewayRules {
   updated_at?: string;
 }
 
-export namespace ZeroTrustGatewayRules {
+/**
+ * Additional settings that modify the rule's action.
+ */
+export interface RuleSetting {
   /**
-   * Additional settings that modify the rule's action.
+   * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
+   * header names, pointing to an array with its header value(s).
    */
-  export interface RuleSettings {
-    /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
-     */
-    add_headers?: unknown;
+  add_headers?: unknown;
 
-    /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
-     */
-    allow_child_bypass?: boolean;
+  /**
+   * Set by parent MSP accounts to enable their children to bypass this rule.
+   */
+  allow_child_bypass?: boolean;
 
-    /**
-     * Settings for the Audit SSH action.
-     */
-    audit_ssh?: RuleSettings.AuditSSH;
+  /**
+   * Settings for the Audit SSH action.
+   */
+  audit_ssh?: RuleSetting.AuditSSH;
 
-    /**
-     * Configure how browser isolation behaves.
-     */
-    biso_admin_controls?: RuleSettings.BisoAdminControls;
+  /**
+   * Configure how browser isolation behaves.
+   */
+  biso_admin_controls?: RuleSetting.BisoAdminControls;
 
-    /**
-     * Enable the custom block page.
-     */
-    block_page_enabled?: boolean;
+  /**
+   * Enable the custom block page.
+   */
+  block_page_enabled?: boolean;
 
-    /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
-     */
-    block_reason?: string;
+  /**
+   * The text describing why this block occurred, displayed on the custom block page
+   * (if enabled).
+   */
+  block_reason?: string;
 
-    /**
-     * Set by children MSP accounts to bypass their parent's rules.
-     */
-    bypass_parent_rule?: boolean;
+  /**
+   * Set by children MSP accounts to bypass their parent's rules.
+   */
+  bypass_parent_rule?: boolean;
 
-    /**
-     * Configure how session check behaves.
-     */
-    check_session?: RuleSettings.CheckSession;
+  /**
+   * Configure how session check behaves.
+   */
+  check_session?: RuleSetting.CheckSession;
 
-    /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
-     */
-    dns_resolvers?: RuleSettings.DNSResolvers;
+  /**
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
+   */
+  dns_resolvers?: RuleSetting.DNSResolvers;
 
-    /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
-     */
-    egress?: RuleSettings.Egress;
+  /**
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
+   */
+  egress?: RuleSetting.Egress;
 
-    /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
-     */
-    insecure_disable_dnssec_validation?: boolean;
+  /**
+   * INSECURE - disable DNSSEC validation (for Allow actions).
+   */
+  insecure_disable_dnssec_validation?: boolean;
 
-    /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
-     */
-    ip_categories?: boolean;
+  /**
+   * Set to true to enable IPs in DNS resolver category blocks. By default categories
+   * only block based on domain names.
+   */
+  ip_categories?: boolean;
 
-    /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
-     */
-    ip_indicator_feeds?: boolean;
+  /**
+   * Set to true to include IPs in DNS resolver indicator feed blocks. By default
+   * indicator feeds only block based on domain names.
+   */
+  ip_indicator_feeds?: boolean;
 
-    /**
-     * Send matching traffic to the supplied destination IP address and port.
-     */
-    l4override?: RuleSettings.L4override;
+  /**
+   * Send matching traffic to the supplied destination IP address and port.
+   */
+  l4override?: RuleSetting.L4override;
 
-    /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
-     */
-    notification_settings?: RuleSettings.NotificationSettings;
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  notification_settings?: RuleSetting.NotificationSettings;
 
-    /**
-     * Override matching DNS queries with a hostname.
-     */
-    override_host?: string;
+  /**
+   * Override matching DNS queries with a hostname.
+   */
+  override_host?: string;
 
-    /**
-     * Override matching DNS queries with an IP or set of IPs.
-     */
-    override_ips?: Array<string>;
+  /**
+   * Override matching DNS queries with an IP or set of IPs.
+   */
+  override_ips?: Array<string>;
 
-    /**
-     * Configure DLP payload logging.
-     */
-    payload_log?: RuleSettings.PayloadLog;
+  /**
+   * Configure DLP payload logging.
+   */
+  payload_log?: RuleSetting.PayloadLog;
+
+  /**
+   * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
+   * resolver. Cannot be set when dns_resolvers are specified. Only valid when a
+   * rule's action is set to 'resolve'.
+   */
+  resolve_dns_through_cloudflare?: boolean;
+
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  untrusted_cert?: RuleSetting.UntrustedCERT;
+}
 
+export namespace RuleSetting {
+  /**
+   * Settings for the Audit SSH action.
+   */
+  export interface AuditSSH {
     /**
-     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when dns_resolvers are specified.
+     * Enable to turn on SSH command logging.
      */
-    resolve_dns_through_cloudflare?: boolean;
+    command_logging?: boolean;
+  }
 
+  /**
+   * Configure how browser isolation behaves.
+   */
+  export interface BisoAdminControls {
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Set to true to enable copy-pasting.
      */
-    untrusted_cert?: RuleSettings.UntrustedCERT;
-  }
+    dcp?: boolean;
 
-  export namespace RuleSettings {
     /**
-     * Settings for the Audit SSH action.
+     * Set to true to enable downloading.
      */
-    export interface AuditSSH {
-      /**
-       * Enable to turn on SSH command logging.
-       */
-      command_logging?: boolean;
-    }
+    dd?: boolean;
 
     /**
-     * Configure how browser isolation behaves.
+     * Set to true to enable keyboard usage.
      */
-    export interface BisoAdminControls {
-      /**
-       * Set to true to enable copy-pasting.
-       */
-      dcp?: boolean;
-
-      /**
-       * Set to true to enable downloading.
-       */
-      dd?: boolean;
-
-      /**
-       * Set to true to enable keyboard usage.
-       */
-      dk?: boolean;
-
-      /**
-       * Set to true to enable printing.
-       */
-      dp?: boolean;
-
-      /**
-       * Set to true to enable uploading.
-       */
-      du?: boolean;
-    }
+    dk?: boolean;
 
     /**
-     * Configure how session check behaves.
+     * Set to true to enable printing.
      */
-    export interface CheckSession {
-      /**
-       * Configure how fresh the session needs to be to be considered valid.
-       */
-      duration?: string;
-
-      /**
-       * Set to true to enable session enforcement.
-       */
-      enforce?: boolean;
-    }
+    dp?: boolean;
 
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
+     * Set to true to enable uploading.
      */
-    export interface DNSResolvers {
-      ipv4?: Array<DNSResolvers.IPV4>;
-
-      ipv6?: Array<DNSResolvers.IPV6>;
-    }
-
-    export namespace DNSResolvers {
-      export interface IPV4 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-
-      export interface IPV6 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-    }
+    du?: boolean;
+  }
 
+  /**
+   * Configure how session check behaves.
+   */
+  export interface CheckSession {
     /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * Configure how fresh the session needs to be to be considered valid.
      */
-    export interface Egress {
-      /**
-       * The IPv4 address to be used for egress.
-       */
-      ipv4?: string;
-
-      /**
-       * The fallback IPv4 address to be used for egress in the event of an error
-       * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-       * WARP IPs.
-       */
-      ipv4_fallback?: string;
-
-      /**
-       * The IPv6 range to be used for egress.
-       */
-      ipv6?: string;
-    }
+    duration?: string;
 
     /**
-     * Send matching traffic to the supplied destination IP address and port.
+     * Set to true to enable session enforcement.
      */
-    export interface L4override {
-      /**
-       * IPv4 or IPv6 address.
-       */
-      ip?: string;
-
-      /**
-       * A port number to use for TCP/UDP overrides.
-       */
-      port?: number;
-    }
+    enforce?: boolean;
+  }
+
+  /**
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
+   */
+  export interface DNSResolvers {
+    ipv4?: Array<RulesAPI.DNSResolverSettingsV4>;
+
+    ipv6?: Array<RulesAPI.DNSResolverSettingsV6>;
+  }
 
+  /**
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
+   */
+  export interface Egress {
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * The IPv4 address to be used for egress.
      */
-    export interface NotificationSettings {
-      /**
-       * Set notification on
-       */
-      enabled?: boolean;
-
-      /**
-       * Customize the message shown in the notification.
-       */
-      msg?: string;
-
-      /**
-       * Optional URL to direct users to additional information. If not set, the
-       * notification will open a block page.
-       */
-      support_url?: string;
-    }
+    ipv4?: string;
 
     /**
-     * Configure DLP payload logging.
+     * The fallback IPv4 address to be used for egress in the event of an error
+     * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
+     * WARP IPs.
      */
-    export interface PayloadLog {
-      /**
-       * Set to true to enable DLP payload logging for this rule.
-       */
-      enabled?: boolean;
-    }
+    ipv4_fallback?: string;
 
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * The IPv6 range to be used for egress.
      */
-    export interface UntrustedCERT {
-      /**
-       * The action performed when an untrusted certificate is seen. The default action
-       * is an error with HTTP code 526.
-       */
-      action?: 'pass_through' | 'block' | 'error';
-    }
+    ipv6?: string;
   }
 
   /**
-   * The schedule for activating DNS policies. This does not apply to HTTP or network
-   * policies.
+   * Send matching traffic to the supplied destination IP address and port.
    */
-  export interface Schedule {
+  export interface L4override {
     /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
+     * IPv4 or IPv6 address.
      */
-    fri?: string;
+    ip?: string;
 
     /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
+     * A port number to use for TCP/UDP overrides.
      */
-    mon?: string;
-
-    /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
-     */
-    sat?: string;
+    port?: number;
+  }
 
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  export interface NotificationSettings {
     /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
+     * Set notification on
      */
-    sun?: string;
+    enabled?: boolean;
 
     /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
+     * Customize the message shown in the notification.
      */
-    thu?: string;
+    msg?: string;
 
     /**
-     * The time zone the rule will be evaluated against. If a
-     * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
+     * Optional URL to direct users to additional information. If not set, the
+     * notification will open a block page.
      */
-    time_zone?: string;
+    support_url?: string;
+  }
 
+  /**
+   * Configure DLP payload logging.
+   */
+  export interface PayloadLog {
     /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
+     * Set to true to enable DLP payload logging for this rule.
      */
-    tue?: string;
+    enabled?: boolean;
+  }
 
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  export interface UntrustedCERT {
     /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
+     * The action performed when an untrusted certificate is seen. The default action
+     * is an error with HTTP code 526.
      */
-    wed?: string;
+    action?: 'pass_through' | 'block' | 'error';
   }
 }
 
-export type RuleDeleteResponse = unknown | string;
+/**
+ * Additional settings that modify the rule's action.
+ */
+export interface RuleSettingParam {
+  /**
+   * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
+   * header names, pointing to an array with its header value(s).
+   */
+  add_headers?: unknown;
 
-export interface RuleCreateParams {
   /**
-   * Path param:
+   * Set by parent MSP accounts to enable their children to bypass this rule.
    */
-  account_id: string;
+  allow_child_bypass?: boolean;
 
   /**
-   * Body param: The action to preform when the associated traffic, identity, and
-   * device posture expressions are either absent or evaluate to `true`.
+   * Settings for the Audit SSH action.
    */
-  action:
-    | 'on'
-    | 'off'
-    | 'allow'
-    | 'block'
-    | 'scan'
-    | 'noscan'
-    | 'safesearch'
-    | 'ytrestricted'
-    | 'isolate'
-    | 'noisolate'
-    | 'override'
-    | 'l4_override'
-    | 'egress'
-    | 'audit_ssh';
+  audit_ssh?: RuleSettingParam.AuditSSH;
 
   /**
-   * Body param: The name of the rule.
+   * Configure how browser isolation behaves.
    */
-  name: string;
+  biso_admin_controls?: RuleSettingParam.BisoAdminControls;
 
   /**
-   * Body param: The description of the rule.
+   * Enable the custom block page.
    */
-  description?: string;
+  block_page_enabled?: boolean;
 
   /**
-   * Body param: The wirefilter expression used for device posture check matching.
+   * The text describing why this block occurred, displayed on the custom block page
+   * (if enabled).
    */
-  device_posture?: string;
+  block_reason?: string;
 
   /**
-   * Body param: True if the rule is enabled.
+   * Set by children MSP accounts to bypass their parent's rules.
    */
-  enabled?: boolean;
+  bypass_parent_rule?: boolean;
 
   /**
-   * Body param: The protocol or layer to evaluate the traffic, identity, and device
-   * posture expressions.
+   * Configure how session check behaves.
    */
-  filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+  check_session?: RuleSettingParam.CheckSession;
 
   /**
-   * Body param: The wirefilter expression used for identity matching.
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
    */
-  identity?: string;
+  dns_resolvers?: RuleSettingParam.DNSResolvers;
 
   /**
-   * Body param: Precedence sets the order of your rules. Lower values indicate
-   * higher precedence. At each processing phase, applicable rules are evaluated in
-   * ascending order of this value.
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
    */
-  precedence?: number;
+  egress?: RuleSettingParam.Egress;
 
   /**
-   * Body param: Additional settings that modify the rule's action.
+   * INSECURE - disable DNSSEC validation (for Allow actions).
    */
-  rule_settings?: RuleCreateParams.RuleSettings;
+  insecure_disable_dnssec_validation?: boolean;
 
   /**
-   * Body param: The schedule for activating DNS policies. This does not apply to
-   * HTTP or network policies.
+   * Set to true to enable IPs in DNS resolver category blocks. By default categories
+   * only block based on domain names.
    */
-  schedule?: RuleCreateParams.Schedule;
+  ip_categories?: boolean;
 
   /**
-   * Body param: The wirefilter expression used for traffic matching.
+   * Set to true to include IPs in DNS resolver indicator feed blocks. By default
+   * indicator feeds only block based on domain names.
    */
-  traffic?: string;
-}
+  ip_indicator_feeds?: boolean;
 
-export namespace RuleCreateParams {
   /**
-   * Additional settings that modify the rule's action.
+   * Send matching traffic to the supplied destination IP address and port.
    */
-  export interface RuleSettings {
-    /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
-     */
-    add_headers?: unknown;
+  l4override?: RuleSettingParam.L4override;
 
-    /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
-     */
-    allow_child_bypass?: boolean;
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  notification_settings?: RuleSettingParam.NotificationSettings;
 
-    /**
-     * Settings for the Audit SSH action.
-     */
-    audit_ssh?: RuleSettings.AuditSSH;
+  /**
+   * Override matching DNS queries with a hostname.
+   */
+  override_host?: string;
 
-    /**
-     * Configure how browser isolation behaves.
-     */
-    biso_admin_controls?: RuleSettings.BisoAdminControls;
+  /**
+   * Override matching DNS queries with an IP or set of IPs.
+   */
+  override_ips?: Array<string>;
 
-    /**
-     * Enable the custom block page.
-     */
-    block_page_enabled?: boolean;
+  /**
+   * Configure DLP payload logging.
+   */
+  payload_log?: RuleSettingParam.PayloadLog;
 
-    /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
-     */
-    block_reason?: string;
+  /**
+   * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
+   * resolver. Cannot be set when dns_resolvers are specified. Only valid when a
+   * rule's action is set to 'resolve'.
+   */
+  resolve_dns_through_cloudflare?: boolean;
 
-    /**
-     * Set by children MSP accounts to bypass their parent's rules.
-     */
-    bypass_parent_rule?: boolean;
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  untrusted_cert?: RuleSettingParam.UntrustedCERT;
+}
 
+export namespace RuleSettingParam {
+  /**
+   * Settings for the Audit SSH action.
+   */
+  export interface AuditSSH {
     /**
-     * Configure how session check behaves.
+     * Enable to turn on SSH command logging.
      */
-    check_session?: RuleSettings.CheckSession;
+    command_logging?: boolean;
+  }
 
+  /**
+   * Configure how browser isolation behaves.
+   */
+  export interface BisoAdminControls {
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
+     * Set to true to enable copy-pasting.
      */
-    dns_resolvers?: RuleSettings.DNSResolvers;
+    dcp?: boolean;
 
     /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * Set to true to enable downloading.
      */
-    egress?: RuleSettings.Egress;
+    dd?: boolean;
 
     /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
+     * Set to true to enable keyboard usage.
      */
-    insecure_disable_dnssec_validation?: boolean;
+    dk?: boolean;
 
     /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
+     * Set to true to enable printing.
      */
-    ip_categories?: boolean;
+    dp?: boolean;
 
     /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
+     * Set to true to enable uploading.
      */
-    ip_indicator_feeds?: boolean;
+    du?: boolean;
+  }
 
+  /**
+   * Configure how session check behaves.
+   */
+  export interface CheckSession {
     /**
-     * Send matching traffic to the supplied destination IP address and port.
+     * Configure how fresh the session needs to be to be considered valid.
      */
-    l4override?: RuleSettings.L4override;
+    duration?: string;
 
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Set to true to enable session enforcement.
      */
-    notification_settings?: RuleSettings.NotificationSettings;
+    enforce?: boolean;
+  }
 
-    /**
-     * Override matching DNS queries with a hostname.
-     */
-    override_host?: string;
+  /**
+   * Add your own custom resolvers to route queries that match the resolver policy.
+   * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
+   * route to the address closest to their origin. Only valid when a rule's action is
+   * set to 'resolve'.
+   */
+  export interface DNSResolvers {
+    ipv4?: Array<RulesAPI.DNSResolverSettingsV4Param>;
 
-    /**
-     * Override matching DNS queries with an IP or set of IPs.
-     */
-    override_ips?: Array<string>;
+    ipv6?: Array<RulesAPI.DNSResolverSettingsV6Param>;
+  }
 
+  /**
+   * Configure how Gateway Proxy traffic egresses. You can enable this setting for
+   * rules with Egress actions and filters, or omit it to indicate local egress via
+   * WARP IPs.
+   */
+  export interface Egress {
     /**
-     * Configure DLP payload logging.
+     * The IPv4 address to be used for egress.
      */
-    payload_log?: RuleSettings.PayloadLog;
+    ipv4?: string;
 
     /**
-     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when dns_resolvers are specified.
+     * The fallback IPv4 address to be used for egress in the event of an error
+     * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
+     * WARP IPs.
      */
-    resolve_dns_through_cloudflare?: boolean;
+    ipv4_fallback?: string;
 
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * The IPv6 range to be used for egress.
      */
-    untrusted_cert?: RuleSettings.UntrustedCERT;
+    ipv6?: string;
   }
 
-  export namespace RuleSettings {
+  /**
+   * Send matching traffic to the supplied destination IP address and port.
+   */
+  export interface L4override {
     /**
-     * Settings for the Audit SSH action.
+     * IPv4 or IPv6 address.
      */
-    export interface AuditSSH {
-      /**
-       * Enable to turn on SSH command logging.
-       */
-      command_logging?: boolean;
-    }
+    ip?: string;
 
     /**
-     * Configure how browser isolation behaves.
+     * A port number to use for TCP/UDP overrides.
      */
-    export interface BisoAdminControls {
-      /**
-       * Set to true to enable copy-pasting.
-       */
-      dcp?: boolean;
-
-      /**
-       * Set to true to enable downloading.
-       */
-      dd?: boolean;
-
-      /**
-       * Set to true to enable keyboard usage.
-       */
-      dk?: boolean;
-
-      /**
-       * Set to true to enable printing.
-       */
-      dp?: boolean;
-
-      /**
-       * Set to true to enable uploading.
-       */
-      du?: boolean;
-    }
+    port?: number;
+  }
 
+  /**
+   * Configure a notification to display on the user's device when this rule is
+   * matched.
+   */
+  export interface NotificationSettings {
     /**
-     * Configure how session check behaves.
+     * Set notification on
      */
-    export interface CheckSession {
-      /**
-       * Configure how fresh the session needs to be to be considered valid.
-       */
-      duration?: string;
-
-      /**
-       * Set to true to enable session enforcement.
-       */
-      enforce?: boolean;
-    }
+    enabled?: boolean;
 
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
+     * Customize the message shown in the notification.
      */
-    export interface DNSResolvers {
-      ipv4?: Array<DNSResolvers.IPV4>;
-
-      ipv6?: Array<DNSResolvers.IPV6>;
-    }
-
-    export namespace DNSResolvers {
-      export interface IPV4 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-
-      export interface IPV6 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-    }
+    msg?: string;
 
     /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * Optional URL to direct users to additional information. If not set, the
+     * notification will open a block page.
      */
-    export interface Egress {
-      /**
-       * The IPv4 address to be used for egress.
-       */
-      ipv4?: string;
-
-      /**
-       * The fallback IPv4 address to be used for egress in the event of an error
-       * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-       * WARP IPs.
-       */
-      ipv4_fallback?: string;
-
-      /**
-       * The IPv6 range to be used for egress.
-       */
-      ipv6?: string;
-    }
+    support_url?: string;
+  }
 
+  /**
+   * Configure DLP payload logging.
+   */
+  export interface PayloadLog {
     /**
-     * Send matching traffic to the supplied destination IP address and port.
+     * Set to true to enable DLP payload logging for this rule.
      */
-    export interface L4override {
-      /**
-       * IPv4 or IPv6 address.
-       */
-      ip?: string;
-
-      /**
-       * A port number to use for TCP/UDP overrides.
-       */
-      port?: number;
-    }
+    enabled?: boolean;
+  }
 
+  /**
+   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   */
+  export interface UntrustedCERT {
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * The action performed when an untrusted certificate is seen. The default action
+     * is an error with HTTP code 526.
      */
-    export interface NotificationSettings {
-      /**
-       * Set notification on
-       */
-      enabled?: boolean;
-
-      /**
-       * Customize the message shown in the notification.
-       */
-      msg?: string;
-
-      /**
-       * Optional URL to direct users to additional information. If not set, the
-       * notification will open a block page.
-       */
-      support_url?: string;
-    }
+    action?: 'pass_through' | 'block' | 'error';
+  }
+}
 
-    /**
-     * Configure DLP payload logging.
-     */
-    export interface PayloadLog {
-      /**
-       * Set to true to enable DLP payload logging for this rule.
-       */
-      enabled?: boolean;
-    }
+/**
+ * The schedule for activating DNS policies. This does not apply to HTTP or network
+ * policies.
+ */
+export interface Schedule {
+  /**
+   * The time intervals when the rule will be active on Fridays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Fridays.
+   */
+  fri?: string;
 
-    /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-     */
-    export interface UntrustedCERT {
-      /**
-       * The action performed when an untrusted certificate is seen. The default action
-       * is an error with HTTP code 526.
-       */
-      action?: 'pass_through' | 'block' | 'error';
-    }
-  }
+  /**
+   * The time intervals when the rule will be active on Mondays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Mondays.
+   */
+  mon?: string;
 
   /**
-   * The schedule for activating DNS policies. This does not apply to HTTP or network
-   * policies.
+   * The time intervals when the rule will be active on Saturdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Saturdays.
    */
-  export interface Schedule {
-    /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
-     */
-    fri?: string;
+  sat?: string;
 
-    /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
-     */
-    mon?: string;
+  /**
+   * The time intervals when the rule will be active on Sundays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Sundays.
+   */
+  sun?: string;
 
-    /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
-     */
-    sat?: string;
+  /**
+   * The time intervals when the rule will be active on Thursdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Thursdays.
+   */
+  thu?: string;
 
-    /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
-     */
-    sun?: string;
+  /**
+   * The time zone the rule will be evaluated against. If a
+   * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
+   * is provided, Gateway will always use the current time at that time zone. If this
+   * parameter is omitted, then Gateway will use the time zone inferred from the
+   * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
+   * from the IP, we will fall back to the time zone of the user's connected data
+   * center.
+   */
+  time_zone?: string;
 
-    /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
-     */
-    thu?: string;
+  /**
+   * The time intervals when the rule will be active on Tuesdays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Tuesdays.
+   */
+  tue?: string;
 
-    /**
-     * The time zone the rule will be evaluated against. If a
-     * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
-     */
-    time_zone?: string;
+  /**
+   * The time intervals when the rule will be active on Wednesdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Wednesdays.
+   */
+  wed?: string;
+}
 
-    /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
-     */
-    tue?: string;
+/**
+ * The schedule for activating DNS policies. This does not apply to HTTP or network
+ * policies.
+ */
+export interface ScheduleParam {
+  /**
+   * The time intervals when the rule will be active on Fridays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Fridays.
+   */
+  fri?: string;
 
-    /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
-     */
-    wed?: string;
-  }
+  /**
+   * The time intervals when the rule will be active on Mondays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Mondays.
+   */
+  mon?: string;
+
+  /**
+   * The time intervals when the rule will be active on Saturdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Saturdays.
+   */
+  sat?: string;
+
+  /**
+   * The time intervals when the rule will be active on Sundays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Sundays.
+   */
+  sun?: string;
+
+  /**
+   * The time intervals when the rule will be active on Thursdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Thursdays.
+   */
+  thu?: string;
+
+  /**
+   * The time zone the rule will be evaluated against. If a
+   * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
+   * is provided, Gateway will always use the current time at that time zone. If this
+   * parameter is omitted, then Gateway will use the time zone inferred from the
+   * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
+   * from the IP, we will fall back to the time zone of the user's connected data
+   * center.
+   */
+  time_zone?: string;
+
+  /**
+   * The time intervals when the rule will be active on Tuesdays, in increasing order
+   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
+   * Tuesdays.
+   */
+  tue?: string;
+
+  /**
+   * The time intervals when the rule will be active on Wednesdays, in increasing
+   * order from 00:00-24:00. If this parameter is omitted, the rule will be
+   * deactivated on Wednesdays.
+   */
+  wed?: string;
 }
 
-export interface RuleUpdateParams {
+export type RuleDeleteResponse = unknown | string | null;
+
+export interface RuleCreateParams {
   /**
    * Path param:
    */
@@ -1048,7 +968,8 @@ export interface RuleUpdateParams {
     | 'override'
     | 'l4_override'
     | 'egress'
-    | 'audit_ssh';
+    | 'audit_ssh'
+    | 'resolve';
 
   /**
    * Body param: The name of the rule.
@@ -1074,7 +995,7 @@ export interface RuleUpdateParams {
    * Body param: The protocol or layer to evaluate the traffic, identity, and device
    * posture expressions.
    */
-  filters?: Array<'http' | 'dns' | 'l4' | 'egress'>;
+  filters?: Array<GatewayFilterParam>;
 
   /**
    * Body param: The wirefilter expression used for identity matching.
@@ -1091,13 +1012,13 @@ export interface RuleUpdateParams {
   /**
    * Body param: Additional settings that modify the rule's action.
    */
-  rule_settings?: RuleUpdateParams.RuleSettings;
+  rule_settings?: RuleSettingParam;
 
   /**
    * Body param: The schedule for activating DNS policies. This does not apply to
    * HTTP or network policies.
    */
-  schedule?: RuleUpdateParams.Schedule;
+  schedule?: ScheduleParam;
 
   /**
    * Body param: The wirefilter expression used for traffic matching.
@@ -1105,387 +1026,86 @@ export interface RuleUpdateParams {
   traffic?: string;
 }
 
-export namespace RuleUpdateParams {
+export interface RuleUpdateParams {
   /**
-   * Additional settings that modify the rule's action.
+   * Path param:
    */
-  export interface RuleSettings {
-    /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
-     */
-    add_headers?: unknown;
-
-    /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
-     */
-    allow_child_bypass?: boolean;
-
-    /**
-     * Settings for the Audit SSH action.
-     */
-    audit_ssh?: RuleSettings.AuditSSH;
-
-    /**
-     * Configure how browser isolation behaves.
-     */
-    biso_admin_controls?: RuleSettings.BisoAdminControls;
-
-    /**
-     * Enable the custom block page.
-     */
-    block_page_enabled?: boolean;
-
-    /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
-     */
-    block_reason?: string;
-
-    /**
-     * Set by children MSP accounts to bypass their parent's rules.
-     */
-    bypass_parent_rule?: boolean;
-
-    /**
-     * Configure how session check behaves.
-     */
-    check_session?: RuleSettings.CheckSession;
-
-    /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
-     */
-    dns_resolvers?: RuleSettings.DNSResolvers;
-
-    /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
-     */
-    egress?: RuleSettings.Egress;
-
-    /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
-     */
-    insecure_disable_dnssec_validation?: boolean;
-
-    /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
-     */
-    ip_categories?: boolean;
-
-    /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
-     */
-    ip_indicator_feeds?: boolean;
-
-    /**
-     * Send matching traffic to the supplied destination IP address and port.
-     */
-    l4override?: RuleSettings.L4override;
-
-    /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
-     */
-    notification_settings?: RuleSettings.NotificationSettings;
-
-    /**
-     * Override matching DNS queries with a hostname.
-     */
-    override_host?: string;
-
-    /**
-     * Override matching DNS queries with an IP or set of IPs.
-     */
-    override_ips?: Array<string>;
-
-    /**
-     * Configure DLP payload logging.
-     */
-    payload_log?: RuleSettings.PayloadLog;
-
-    /**
-     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when dns_resolvers are specified.
-     */
-    resolve_dns_through_cloudflare?: boolean;
-
-    /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-     */
-    untrusted_cert?: RuleSettings.UntrustedCERT;
-  }
-
-  export namespace RuleSettings {
-    /**
-     * Settings for the Audit SSH action.
-     */
-    export interface AuditSSH {
-      /**
-       * Enable to turn on SSH command logging.
-       */
-      command_logging?: boolean;
-    }
-
-    /**
-     * Configure how browser isolation behaves.
-     */
-    export interface BisoAdminControls {
-      /**
-       * Set to true to enable copy-pasting.
-       */
-      dcp?: boolean;
-
-      /**
-       * Set to true to enable downloading.
-       */
-      dd?: boolean;
-
-      /**
-       * Set to true to enable keyboard usage.
-       */
-      dk?: boolean;
-
-      /**
-       * Set to true to enable printing.
-       */
-      dp?: boolean;
-
-      /**
-       * Set to true to enable uploading.
-       */
-      du?: boolean;
-    }
-
-    /**
-     * Configure how session check behaves.
-     */
-    export interface CheckSession {
-      /**
-       * Configure how fresh the session needs to be to be considered valid.
-       */
-      duration?: string;
-
-      /**
-       * Set to true to enable session enforcement.
-       */
-      enforce?: boolean;
-    }
-
-    /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when resolve_dns_through_cloudflare is set. DNS queries will
-     * route to the address closest to their origin.
-     */
-    export interface DNSResolvers {
-      ipv4?: Array<DNSResolvers.IPV4>;
-
-      ipv6?: Array<DNSResolvers.IPV6>;
-    }
-
-    export namespace DNSResolvers {
-      export interface IPV4 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-
-      export interface IPV6 {
-        /**
-         * IP address of upstream resolver.
-         */
-        ip: string;
-
-        /**
-         * A port number to use for upstream resolver.
-         */
-        port?: number;
-
-        /**
-         * Whether to connect to this resolver over a private network. Must be set when
-         * vnet_id is set.
-         */
-        route_through_private_network?: boolean;
-
-        /**
-         * Optionally specify a virtual network for this resolver. Uses default virtual
-         * network id if omitted.
-         */
-        vnet_id?: string;
-      }
-    }
-
-    /**
-     * Configure how Gateway Proxy traffic egresses. You can enable this setting for
-     * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
-     */
-    export interface Egress {
-      /**
-       * The IPv4 address to be used for egress.
-       */
-      ipv4?: string;
-
-      /**
-       * The fallback IPv4 address to be used for egress in the event of an error
-       * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-       * WARP IPs.
-       */
-      ipv4_fallback?: string;
-
-      /**
-       * The IPv6 range to be used for egress.
-       */
-      ipv6?: string;
-    }
-
-    /**
-     * Send matching traffic to the supplied destination IP address and port.
-     */
-    export interface L4override {
-      /**
-       * IPv4 or IPv6 address.
-       */
-      ip?: string;
-
-      /**
-       * A port number to use for TCP/UDP overrides.
-       */
-      port?: number;
-    }
+  account_id: string;
 
-    /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
-     */
-    export interface NotificationSettings {
-      /**
-       * Set notification on
-       */
-      enabled?: boolean;
-
-      /**
-       * Customize the message shown in the notification.
-       */
-      msg?: string;
-
-      /**
-       * Optional URL to direct users to additional information. If not set, the
-       * notification will open a block page.
-       */
-      support_url?: string;
-    }
+  /**
+   * Body param: The action to preform when the associated traffic, identity, and
+   * device posture expressions are either absent or evaluate to `true`.
+   */
+  action:
+    | 'on'
+    | 'off'
+    | 'allow'
+    | 'block'
+    | 'scan'
+    | 'noscan'
+    | 'safesearch'
+    | 'ytrestricted'
+    | 'isolate'
+    | 'noisolate'
+    | 'override'
+    | 'l4_override'
+    | 'egress'
+    | 'audit_ssh'
+    | 'resolve';
 
-    /**
-     * Configure DLP payload logging.
-     */
-    export interface PayloadLog {
-      /**
-       * Set to true to enable DLP payload logging for this rule.
-       */
-      enabled?: boolean;
-    }
+  /**
+   * Body param: The name of the rule.
+   */
+  name: string;
 
-    /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
-     */
-    export interface UntrustedCERT {
-      /**
-       * The action performed when an untrusted certificate is seen. The default action
-       * is an error with HTTP code 526.
-       */
-      action?: 'pass_through' | 'block' | 'error';
-    }
-  }
+  /**
+   * Body param: The description of the rule.
+   */
+  description?: string;
 
   /**
-   * The schedule for activating DNS policies. This does not apply to HTTP or network
-   * policies.
+   * Body param: The wirefilter expression used for device posture check matching.
    */
-  export interface Schedule {
-    /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
-     */
-    fri?: string;
+  device_posture?: string;
 
-    /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
-     */
-    mon?: string;
+  /**
+   * Body param: True if the rule is enabled.
+   */
+  enabled?: boolean;
 
-    /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
-     */
-    sat?: string;
+  /**
+   * Body param: The protocol or layer to evaluate the traffic, identity, and device
+   * posture expressions.
+   */
+  filters?: Array<GatewayFilterParam>;
 
-    /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
-     */
-    sun?: string;
+  /**
+   * Body param: The wirefilter expression used for identity matching.
+   */
+  identity?: string;
 
-    /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
-     */
-    thu?: string;
+  /**
+   * Body param: Precedence sets the order of your rules. Lower values indicate
+   * higher precedence. At each processing phase, applicable rules are evaluated in
+   * ascending order of this value.
+   */
+  precedence?: number;
 
-    /**
-     * The time zone the rule will be evaluated against. If a
-     * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
-     */
-    time_zone?: string;
+  /**
+   * Body param: Additional settings that modify the rule's action.
+   */
+  rule_settings?: RuleSettingParam;
 
-    /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
-     */
-    tue?: string;
+  /**
+   * Body param: The schedule for activating DNS policies. This does not apply to
+   * HTTP or network policies.
+   */
+  schedule?: ScheduleParam;
 
-    /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
-     */
-    wed?: string;
-  }
+  /**
+   * Body param: The wirefilter expression used for traffic matching.
+   */
+  traffic?: string;
 }
 
 export interface RuleListParams {
@@ -1501,9 +1121,14 @@ export interface RuleGetParams {
 }
 
 export namespace Rules {
-  export import ZeroTrustGatewayRules = RulesAPI.ZeroTrustGatewayRules;
+  export import DNSResolverSettingsV4 = RulesAPI.DNSResolverSettingsV4;
+  export import DNSResolverSettingsV6 = RulesAPI.DNSResolverSettingsV6;
+  export import GatewayFilter = RulesAPI.GatewayFilter;
+  export import GatewayRule = RulesAPI.GatewayRule;
+  export import RuleSetting = RulesAPI.RuleSetting;
+  export import Schedule = RulesAPI.Schedule;
   export import RuleDeleteResponse = RulesAPI.RuleDeleteResponse;
-  export import ZeroTrustGatewayRulesSinglePage = RulesAPI.ZeroTrustGatewayRulesSinglePage;
+  export import GatewayRulesSinglePage = RulesAPI.GatewayRulesSinglePage;
   export import RuleCreateParams = RulesAPI.RuleCreateParams;
   export import RuleUpdateParams = RulesAPI.RuleUpdateParams;
   export import RuleListParams = RulesAPI.RuleListParams;