cloudflare 4.2.0 → 4.3.0

package/src/resources/zero-trust/access/applications/applications.ts

@@ -51,6 +51,14 @@ import {
   SAMLGroupRule,
   ServiceTokenRule,
 } from './policies';
+import * as SettingsAPI from './settings';
+import {
+  SettingEditParams,
+  SettingEditResponse,
+  SettingUpdateParams,
+  SettingUpdateResponse,
+  Settings,
+} from './settings';
 import * as UserPolicyChecksAPI from './user-policy-checks';
 import {
   UserPolicyCheckGeo,
@@ -76,9 +84,20 @@ export class Applications extends APIResource {
   );
   policies: ApplicationsPoliciesAPI.Policies = new ApplicationsPoliciesAPI.Policies(this._client);
   policyTests: PolicyTestsAPI.PolicyTests = new PolicyTestsAPI.PolicyTests(this._client);
+  settings: SettingsAPI.Settings = new SettingsAPI.Settings(this._client);
 
   /**
    * Adds a new application to Access.
+   *
+   * @example
+   * ```ts
+   * const application =
+   *   await client.zeroTrust.access.applications.create({
+   *     domain: 'test.example.com/admin',
+   *     type: 'self_hosted',
+   *     account_id: 'account_id',
+   *   });
+   * ```
    */
   create(
     params: ApplicationCreateParams,
@@ -111,6 +130,19 @@ export class Applications extends APIResource {
 
   /**
    * Updates an Access application.
+   *
+   * @example
+   * ```ts
+   * const application =
+   *   await client.zeroTrust.access.applications.update(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     {
+   *       domain: 'test.example.com/admin',
+   *       type: 'self_hosted',
+   *       account_id: 'account_id',
+   *     },
+   *   );
+   * ```
    */
   update(
     appId: AppIDParam,
@@ -144,6 +176,16 @@ export class Applications extends APIResource {
 
   /**
    * Lists all Access applications in an account or zone.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const applicationListResponse of client.zeroTrust.access.applications.list(
+   *   { account_id: 'account_id' },
+   * )) {
+   *   // ...
+   * }
+   * ```
    */
   list(
     params?: ApplicationListParams,
@@ -185,6 +227,15 @@ export class Applications extends APIResource {
 
   /**
    * Deletes an application from Access.
+   *
+   * @example
+   * ```ts
+   * const application =
+   *   await client.zeroTrust.access.applications.delete(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: 'account_id' },
+   *   );
+   * ```
    */
   delete(
     appId: AppIDParam,
@@ -227,6 +278,15 @@ export class Applications extends APIResource {
 
   /**
    * Fetches information about an Access application.
+   *
+   * @example
+   * ```ts
+   * const application =
+   *   await client.zeroTrust.access.applications.get(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: 'account_id' },
+   *   );
+   * ```
    */
   get(
     appId: AppIDParam,
@@ -269,6 +329,15 @@ export class Applications extends APIResource {
 
   /**
    * Revokes all tokens issued for an application.
+   *
+   * @example
+   * ```ts
+   * const response =
+   *   await client.zeroTrust.access.applications.revokeTokens(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: 'account_id' },
+   *   );
+   * ```
    */
   revokeTokens(
     appId: AppIDParam,
@@ -356,12 +425,12 @@ export type AllowedOrigins = string;
 export type AllowedOriginsParam = string;
 
 /**
- * Identifier
+ * Identifier.
  */
 export type AppID = string;
 
 /**
- * Identifier
+ * Identifier.
  */
 export type AppIDParam = string;
 
@@ -388,10 +457,15 @@ export namespace Application {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -537,7 +611,7 @@ export namespace Application {
 
   export interface SaaSApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -844,10 +918,15 @@ export namespace Application {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -1003,10 +1082,15 @@ export namespace Application {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -1157,7 +1241,7 @@ export namespace Application {
     type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -1213,7 +1297,7 @@ export namespace Application {
     type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -1269,7 +1353,7 @@ export namespace Application {
     type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -1330,7 +1414,7 @@ export namespace Application {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -2525,7 +2609,7 @@ export namespace ApplicationCreateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -2537,6 +2621,11 @@ export namespace ApplicationCreateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -2629,6 +2718,17 @@ export namespace ApplicationCreateResponse {
 
     policies?: Array<SelfHostedApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -2657,7 +2757,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -2726,12 +2826,85 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -2836,7 +3009,7 @@ export namespace ApplicationCreateResponse {
 
   export interface SaaSApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -2904,12 +3077,85 @@ export namespace ApplicationCreateResponse {
   }
 
   export namespace SaaSApplication {
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -3025,7 +3271,7 @@ export namespace ApplicationCreateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -3037,6 +3283,11 @@ export namespace ApplicationCreateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -3129,6 +3380,17 @@ export namespace ApplicationCreateResponse {
 
     policies?: Array<BrowserSSHApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -3157,7 +3419,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -3226,12 +3488,85 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -3347,7 +3682,7 @@ export namespace ApplicationCreateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -3359,6 +3694,11 @@ export namespace ApplicationCreateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -3451,6 +3791,17 @@ export namespace ApplicationCreateResponse {
 
     policies?: Array<BrowserVNCApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -3479,7 +3830,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -3548,13 +3899,86 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The UUID of the policy
        */
-      precedence?: number;
-    }
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
 
     /**
      * Configuration for provisioning to this application via SCIM. This is currently
@@ -3663,7 +4087,7 @@ export namespace ApplicationCreateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -3733,7 +4157,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -3788,12 +4212,85 @@ export namespace ApplicationCreateResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -3903,7 +4400,7 @@ export namespace ApplicationCreateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -3973,7 +4470,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -4028,12 +4525,85 @@ export namespace ApplicationCreateResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -4143,7 +4713,7 @@ export namespace ApplicationCreateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -4213,7 +4783,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -4268,39 +4838,112 @@ export namespace ApplicationCreateResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The UUID of the policy
        */
-      precedence?: number;
-    }
+      id?: string;
 
-    /**
-     * Configuration for provisioning to this application via SCIM. This is currently
-     * in closed beta.
-     */
-    export interface SCIMConfig {
       /**
-       * The UID of the IdP to use as the source for SCIM resources to provision to this
-       * application.
+       * Administrators who can approve a temporary authentication request.
        */
-      idp_uid: string;
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
 
       /**
-       * The base URI for the application's SCIM-compatible API.
+       * Requires the user to request access from an administrator at the start of each
+       * session.
        */
-      remote_uri: string;
+      approval_required?: boolean;
+
+      created_at?: string;
 
       /**
-       * Attributes for configuring HTTP Basic authentication scheme for SCIM
-       * provisioning to an application.
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
        */
-      authentication?:
-        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
-        | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken
-        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
-        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
         | Array<
             | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
             | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken
@@ -4378,7 +5021,7 @@ export namespace ApplicationCreateResponse {
 
   export interface BookmarkApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -4539,7 +5182,7 @@ export namespace ApplicationCreateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -4778,7 +5421,7 @@ export namespace ApplicationCreateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -4790,6 +5433,11 @@ export namespace ApplicationCreateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -4882,6 +5530,17 @@ export namespace ApplicationCreateResponse {
 
     policies?: Array<BrowserRdpApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -4910,7 +5569,7 @@ export namespace ApplicationCreateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -4997,12 +5656,85 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -5132,7 +5864,7 @@ export namespace ApplicationUpdateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -5144,6 +5876,11 @@ export namespace ApplicationUpdateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -5236,6 +5973,17 @@ export namespace ApplicationUpdateResponse {
 
     policies?: Array<SelfHostedApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -5264,7 +6012,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -5333,12 +6081,85 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -5443,7 +6264,7 @@ export namespace ApplicationUpdateResponse {
 
   export interface SaaSApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -5511,21 +6332,94 @@ export namespace ApplicationUpdateResponse {
   }
 
   export namespace SaaSApplication {
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The UUID of the policy
        */
-      precedence?: number;
-    }
+      id?: string;
 
-    /**
-     * Configuration for provisioning to this application via SCIM. This is currently
-     * in closed beta.
-     */
-    export interface SCIMConfig {
       /**
-       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
        * application.
        */
       idp_uid: string;
@@ -5632,7 +6526,7 @@ export namespace ApplicationUpdateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -5644,6 +6538,11 @@ export namespace ApplicationUpdateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -5736,6 +6635,17 @@ export namespace ApplicationUpdateResponse {
 
     policies?: Array<BrowserSSHApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -5764,7 +6674,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -5833,12 +6743,85 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -5954,7 +6937,7 @@ export namespace ApplicationUpdateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -5966,6 +6949,11 @@ export namespace ApplicationUpdateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -6058,6 +7046,17 @@ export namespace ApplicationUpdateResponse {
 
     policies?: Array<BrowserVNCApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -6086,7 +7085,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -6155,12 +7154,85 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -6270,7 +7342,7 @@ export namespace ApplicationUpdateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -6340,7 +7412,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -6395,12 +7467,85 @@ export namespace ApplicationUpdateResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -6510,7 +7655,7 @@ export namespace ApplicationUpdateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -6580,7 +7725,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -6635,12 +7780,85 @@ export namespace ApplicationUpdateResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -6750,7 +7968,7 @@ export namespace ApplicationUpdateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -6820,7 +8038,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -6837,50 +8055,123 @@ export namespace ApplicationUpdateResponse {
       /**
        * The hypertext in the footer link.
        */
-      name: string;
+      name: string;
+
+      /**
+       * the hyperlink in the footer link.
+       */
+      url: string;
+    }
+
+    /**
+     * The design of the App Launcher landing page shown to users when they log in.
+     */
+    export interface LandingPageDesign {
+      /**
+       * The background color of the log in button on the landing page.
+       */
+      button_color?: string;
+
+      /**
+       * The color of the text in the log in button on the landing page.
+       */
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
       /**
-       * the hyperlink in the footer link.
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
        */
-      url: string;
-    }
+      isolation_required?: boolean;
 
-    /**
-     * The design of the App Launcher landing page shown to users when they log in.
-     */
-    export interface LandingPageDesign {
       /**
-       * The background color of the log in button on the landing page.
+       * The name of the Access policy.
        */
-      button_color?: string;
+      name?: string;
 
       /**
-       * The color of the text in the log in button on the landing page.
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
        */
-      button_text_color?: string;
+      precedence?: number;
 
       /**
-       * The URL of the image shown on the landing page.
+       * A custom message that will appear on the purpose justification screen.
        */
-      image_url?: string;
+      purpose_justification_prompt?: string;
 
       /**
-       * The message shown on the landing page.
+       * Require users to enter a justification when they log in to the application.
        */
-      message?: string;
+      purpose_justification_required?: boolean;
 
       /**
-       * The title shown on the landing page.
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
        */
-      title?: string;
-    }
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
        */
-      precedence?: number;
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -6985,7 +8276,7 @@ export namespace ApplicationUpdateResponse {
 
   export interface BookmarkApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -7146,7 +8437,7 @@ export namespace ApplicationUpdateResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -7385,7 +8676,7 @@ export namespace ApplicationUpdateResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -7397,6 +8688,11 @@ export namespace ApplicationUpdateResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -7489,6 +8785,17 @@ export namespace ApplicationUpdateResponse {
 
     policies?: Array<BrowserRdpApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -7517,7 +8824,7 @@ export namespace ApplicationUpdateResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -7604,12 +8911,85 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -7739,7 +9119,7 @@ export namespace ApplicationListResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -7751,6 +9131,11 @@ export namespace ApplicationListResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -7843,6 +9228,17 @@ export namespace ApplicationListResponse {
 
     policies?: Array<SelfHostedApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -7871,7 +9267,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -7940,12 +9336,85 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -8050,7 +9519,7 @@ export namespace ApplicationListResponse {
 
   export interface SaaSApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -8117,13 +9586,86 @@ export namespace ApplicationListResponse {
     updated_at?: string;
   }
 
-  export namespace SaaSApplication {
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+  export namespace SaaSApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -8239,7 +9781,7 @@ export namespace ApplicationListResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -8251,6 +9793,11 @@ export namespace ApplicationListResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -8343,6 +9890,17 @@ export namespace ApplicationListResponse {
 
     policies?: Array<BrowserSSHApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -8371,7 +9929,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -8440,12 +9998,85 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -8561,7 +10192,7 @@ export namespace ApplicationListResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -8573,6 +10204,11 @@ export namespace ApplicationListResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -8665,6 +10301,17 @@ export namespace ApplicationListResponse {
 
     policies?: Array<BrowserVNCApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -8693,7 +10340,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -8762,12 +10409,85 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -8877,7 +10597,7 @@ export namespace ApplicationListResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -8947,7 +10667,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -8982,32 +10702,105 @@ export namespace ApplicationListResponse {
       button_color?: string;
 
       /**
-       * The color of the text in the log in button on the landing page.
+       * The color of the text in the log in button on the landing page.
+       */
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
        */
-      button_text_color?: string;
+      precedence?: number;
 
       /**
-       * The URL of the image shown on the landing page.
+       * A custom message that will appear on the purpose justification screen.
        */
-      image_url?: string;
+      purpose_justification_prompt?: string;
 
       /**
-       * The message shown on the landing page.
+       * Require users to enter a justification when they log in to the application.
        */
-      message?: string;
+      purpose_justification_required?: boolean;
 
       /**
-       * The title shown on the landing page.
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
        */
-      title?: string;
-    }
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
        */
-      precedence?: number;
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -9117,7 +10910,7 @@ export namespace ApplicationListResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -9187,7 +10980,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -9242,12 +11035,85 @@ export namespace ApplicationListResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -9357,7 +11223,7 @@ export namespace ApplicationListResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -9427,7 +11293,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -9482,12 +11348,85 @@ export namespace ApplicationListResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -9592,7 +11531,7 @@ export namespace ApplicationListResponse {
 
   export interface BookmarkApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -9753,7 +11692,7 @@ export namespace ApplicationListResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -9992,7 +11931,7 @@ export namespace ApplicationListResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -10004,6 +11943,11 @@ export namespace ApplicationListResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -10096,6 +12040,17 @@ export namespace ApplicationListResponse {
 
     policies?: Array<BrowserRdpApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -10124,7 +12079,7 @@ export namespace ApplicationListResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -10195,28 +12150,101 @@ export namespace ApplicationListResponse {
        * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
        * match.
        */
-      l4_protocol?: 'tcp' | 'udp';
+      l4_protocol?: 'tcp' | 'udp';
+
+      /**
+       * The port range of the destination. Can be a single port or a range of ports.
+       * When omitted, all ports will match.
+       */
+      port_range?: string;
+
+      type?: 'private';
+
+      /**
+       * The VNET ID to match the destination. When omitted, all VNETs will match.
+       */
+      vnet_id?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
 
       /**
-       * The port range of the destination. Can be a single port or a range of ports.
-       * When omitted, all ports will match.
+       * Require users to enter a justification when they log in to the application.
        */
-      port_range?: string;
-
-      type?: 'private';
+      purpose_justification_required?: boolean;
 
       /**
-       * The VNET ID to match the destination. When omitted, all VNETs will match.
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
        */
-      vnet_id?: string;
-    }
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
        */
-      precedence?: number;
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -10322,7 +12350,7 @@ export namespace ApplicationListResponse {
 
 export interface ApplicationDeleteResponse {
   /**
-   * UUID
+   * UUID.
    */
   id?: string;
 }
@@ -10353,7 +12381,7 @@ export namespace ApplicationGetResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -10365,6 +12393,11 @@ export namespace ApplicationGetResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -10457,6 +12490,17 @@ export namespace ApplicationGetResponse {
 
     policies?: Array<SelfHostedApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -10485,7 +12529,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -10554,12 +12598,85 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -10664,7 +12781,7 @@ export namespace ApplicationGetResponse {
 
   export interface SaaSApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -10732,12 +12849,85 @@ export namespace ApplicationGetResponse {
   }
 
   export namespace SaaSApplication {
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -10853,7 +13043,7 @@ export namespace ApplicationGetResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -10865,6 +13055,11 @@ export namespace ApplicationGetResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -10957,6 +13152,17 @@ export namespace ApplicationGetResponse {
 
     policies?: Array<BrowserSSHApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -10985,7 +13191,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -11030,36 +13236,109 @@ export namespace ApplicationGetResponse {
       cidr?: string;
 
       /**
-       * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
+       * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
+       */
+      hostname?: string;
+
+      /**
+       * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
+       * match.
+       */
+      l4_protocol?: 'tcp' | 'udp';
+
+      /**
+       * The port range of the destination. Can be a single port or a range of ports.
+       * When omitted, all ports will match.
+       */
+      port_range?: string;
+
+      type?: 'private';
+
+      /**
+       * The VNET ID to match the destination. When omitted, all VNETs will match.
+       */
+      vnet_id?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
        */
-      hostname?: string;
+      precedence?: number;
 
       /**
-       * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
-       * match.
+       * A custom message that will appear on the purpose justification screen.
        */
-      l4_protocol?: 'tcp' | 'udp';
+      purpose_justification_prompt?: string;
 
       /**
-       * The port range of the destination. Can be a single port or a range of ports.
-       * When omitted, all ports will match.
+       * Require users to enter a justification when they log in to the application.
        */
-      port_range?: string;
-
-      type?: 'private';
+      purpose_justification_required?: boolean;
 
       /**
-       * The VNET ID to match the destination. When omitted, all VNETs will match.
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
        */
-      vnet_id?: string;
-    }
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
        */
-      precedence?: number;
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -11175,7 +13454,7 @@ export namespace ApplicationGetResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -11187,6 +13466,11 @@ export namespace ApplicationGetResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -11279,6 +13563,17 @@ export namespace ApplicationGetResponse {
 
     policies?: Array<BrowserVNCApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -11307,7 +13602,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -11376,12 +13671,85 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -11491,7 +13859,7 @@ export namespace ApplicationGetResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -11561,7 +13929,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -11616,12 +13984,85 @@ export namespace ApplicationGetResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -11731,7 +14172,7 @@ export namespace ApplicationGetResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -11801,7 +14242,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -11838,30 +14279,103 @@ export namespace ApplicationGetResponse {
       /**
        * The color of the text in the log in button on the landing page.
        */
-      button_text_color?: string;
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
 
       /**
-       * The URL of the image shown on the landing page.
+       * A custom message that will appear on the purpose justification screen.
        */
-      image_url?: string;
+      purpose_justification_prompt?: string;
 
       /**
-       * The message shown on the landing page.
+       * Require users to enter a justification when they log in to the application.
        */
-      message?: string;
+      purpose_justification_required?: boolean;
 
       /**
-       * The title shown on the landing page.
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
        */
-      title?: string;
-    }
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
       /**
-       * The order of execution for this policy. Must be unique for each policy within an
-       * app.
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
        */
-      precedence?: number;
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -11971,7 +14485,7 @@ export namespace ApplicationGetResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -12041,7 +14555,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -12096,12 +14610,85 @@ export namespace ApplicationGetResponse {
       title?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -12206,7 +14793,7 @@ export namespace ApplicationGetResponse {
 
   export interface BookmarkApplication {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -12367,7 +14954,7 @@ export namespace ApplicationGetResponse {
     type: ApplicationsAPI.ApplicationType;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -12606,7 +15193,7 @@ export namespace ApplicationGetResponse {
     type: string;
 
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 
@@ -12618,6 +15205,11 @@ export namespace ApplicationGetResponse {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -12710,6 +15302,17 @@ export namespace ApplicationGetResponse {
 
     policies?: Array<BrowserRdpApplication.Policy>;
 
+    /**
+     * Allows matching Access Service Tokens passed HTTP in a single header with this
+     * name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Sets the SameSite cookie setting, which provides increased security against CSRF
      * attacks.
@@ -12738,7 +15341,7 @@ export namespace ApplicationGetResponse {
     /**
      * The amount of time that tokens issued for this application will be valid. Must
      * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -12825,12 +15428,85 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
-    export interface Policy extends ApplicationsAPI.ApplicationPolicy {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
       /**
        * The order of execution for this policy. Must be unique for each policy within an
        * app.
        */
       precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
     }
 
     /**
@@ -12981,6 +15657,11 @@ export declare namespace ApplicationCreateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -13076,6 +15757,17 @@ export declare namespace ApplicationCreateParams {
      */
     policies?: Array<SelfHostedApplication.AccessAppPolicyLink | string | SelfHostedApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -13089,10 +15781,10 @@ export declare namespace ApplicationCreateParams {
     scim_config?: SelfHostedApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -13105,7 +15797,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -13609,6 +16301,11 @@ export declare namespace ApplicationCreateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -13704,6 +16401,17 @@ export declare namespace ApplicationCreateParams {
      */
     policies?: Array<BrowserSSHApplication.AccessAppPolicyLink | string | BrowserSSHApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -13717,10 +16425,10 @@ export declare namespace ApplicationCreateParams {
     scim_config?: BrowserSSHApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -13733,7 +16441,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -13996,6 +16704,11 @@ export declare namespace ApplicationCreateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -14091,6 +16804,17 @@ export declare namespace ApplicationCreateParams {
      */
     policies?: Array<BrowserVNCApplication.AccessAppPolicyLink | string | BrowserVNCApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -14104,10 +16828,10 @@ export declare namespace ApplicationCreateParams {
     scim_config?: BrowserVNCApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -14120,7 +16844,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -14425,7 +17149,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -14718,7 +17442,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -15011,7 +17735,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -15540,6 +18264,11 @@ export declare namespace ApplicationCreateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -15635,6 +18364,17 @@ export declare namespace ApplicationCreateParams {
      */
     policies?: Array<BrowserRdpApplication.AccessAppPolicyLink | string | BrowserRdpApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -15648,10 +18388,10 @@ export declare namespace ApplicationCreateParams {
     scim_config?: BrowserRdpApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -15664,7 +18404,7 @@ export declare namespace ApplicationCreateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -15959,6 +18699,11 @@ export declare namespace ApplicationUpdateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -16054,6 +18799,17 @@ export declare namespace ApplicationUpdateParams {
      */
     policies?: Array<SelfHostedApplication.AccessAppPolicyLink | string | SelfHostedApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -16067,10 +18823,10 @@ export declare namespace ApplicationUpdateParams {
     scim_config?: SelfHostedApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -16083,7 +18839,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -16587,6 +19343,11 @@ export declare namespace ApplicationUpdateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -16682,6 +19443,17 @@ export declare namespace ApplicationUpdateParams {
      */
     policies?: Array<BrowserSSHApplication.AccessAppPolicyLink | string | BrowserSSHApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -16695,10 +19467,10 @@ export declare namespace ApplicationUpdateParams {
     scim_config?: BrowserSSHApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -16711,7 +19483,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -16974,6 +19746,11 @@ export declare namespace ApplicationUpdateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -17069,6 +19846,17 @@ export declare namespace ApplicationUpdateParams {
      */
     policies?: Array<BrowserVNCApplication.AccessAppPolicyLink | string | BrowserVNCApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -17082,10 +19870,10 @@ export declare namespace ApplicationUpdateParams {
     scim_config?: BrowserVNCApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -17098,7 +19886,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -17403,7 +20191,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -17696,7 +20484,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -17989,7 +20777,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -18518,6 +21306,11 @@ export declare namespace ApplicationUpdateParams {
      */
     allow_authenticate_via_warp?: boolean;
 
+    /**
+     * Body param: Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
     /**
      * Body param: The identity providers your users can select when connecting to this
      * application. Defaults to all IdPs configured in your account.
@@ -18613,6 +21406,17 @@ export declare namespace ApplicationUpdateParams {
      */
     policies?: Array<BrowserRdpApplication.AccessAppPolicyLink | string | BrowserRdpApplication.UnionMember2>;
 
+    /**
+     * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+     * with this name. This works as an alternative to the (CF-Access-Client-Id,
+     * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+     * as a json object similar to: { "cf-access-client-id":
+     * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+     * "cf-access-client-secret":
+     * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+     */
+    read_service_tokens_from_header?: string;
+
     /**
      * Body param: Sets the SameSite cookie setting, which provides increased security
      * against CSRF attacks.
@@ -18626,10 +21430,10 @@ export declare namespace ApplicationUpdateParams {
     scim_config?: BrowserRdpApplication.SCIMConfig;
 
     /**
-     * Body param: List of public domains that Access will secure. This field is
-     * deprecated in favor of `destinations` and will be supported until **November
-     * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-     * ignored.
+     * @deprecated Body param: List of public domains that Access will secure. This
+     * field is deprecated in favor of `destinations` and will be supported until
+     * **November 21, 2025.** If `destinations` are provided, then
+     * `self_hosted_domains` will be ignored.
      */
     self_hosted_domains?: Array<SelfHostedDomainsParam>;
 
@@ -18642,7 +21446,7 @@ export declare namespace ApplicationUpdateParams {
     /**
      * Body param: The amount of time that tokens issued for this application will be
      * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
 
@@ -18969,6 +21773,7 @@ Applications.UserPolicyChecks = UserPolicyChecks;
 Applications.Policies = Policies;
 Applications.PolicyListResponsesSinglePage = PolicyListResponsesSinglePage;
 Applications.PolicyTests = PolicyTests;
+Applications.Settings = Settings;
 
 export declare namespace Applications {
   export {
@@ -19066,4 +21871,12 @@ export declare namespace Applications {
     type PolicyTestCreateParams as PolicyTestCreateParams,
     type PolicyTestGetParams as PolicyTestGetParams,
   };
+
+  export {
+    Settings as Settings,
+    type SettingUpdateResponse as SettingUpdateResponse,
+    type SettingEditResponse as SettingEditResponse,
+    type SettingUpdateParams as SettingUpdateParams,
+    type SettingEditParams as SettingEditParams,
+  };
 }