cloudflare 4.2.0 → 4.4.0

package/resources/zero-trust/access/applications/applications.d.ts

@@ -6,6 +6,8 @@ import * as CAsAPI from "./cas.js";
 import { CA, CACreateParams, CADeleteParams, CADeleteResponse, CAGetParams, CAListParams, CAs, CAsSinglePage } from "./cas.js";
 import * as ApplicationsPoliciesAPI from "./policies.js";
 import { AccessDevicePostureRule, AccessRule, AnyValidServiceTokenRule, AuthenticationMethodRule, AzureGroupRule, CertificateRule, CountryRule, DomainRule, EmailListRule, EmailRule, EveryoneRule, ExternalEvaluationRule, GSuiteGroupRule, GitHubOrganizationRule, GroupRule, IPListRule, IPRule, OktaGroupRule, Policies, PolicyCreateParams, PolicyCreateResponse, PolicyDeleteParams, PolicyDeleteResponse, PolicyGetParams, PolicyGetResponse, PolicyListParams, PolicyListResponse, PolicyListResponsesSinglePage, PolicyUpdateParams, PolicyUpdateResponse, SAMLGroupRule, ServiceTokenRule } from "./policies.js";
+import * as SettingsAPI from "./settings.js";
+import { SettingEditParams, SettingEditResponse, SettingUpdateParams, SettingUpdateResponse, Settings } from "./settings.js";
 import * as UserPolicyChecksAPI from "./user-policy-checks.js";
 import { UserPolicyCheckGeo, UserPolicyCheckListParams, UserPolicyCheckListResponse, UserPolicyChecks } from "./user-policy-checks.js";
 import * as PolicyTestsAPI from "./policy-tests/policy-tests.js";
@@ -16,31 +18,92 @@ export declare class Applications extends APIResource {
     userPolicyChecks: UserPolicyChecksAPI.UserPolicyChecks;
     policies: ApplicationsPoliciesAPI.Policies;
     policyTests: PolicyTestsAPI.PolicyTests;
+    settings: SettingsAPI.Settings;
     /**
      * Adds a new application to Access.
+     *
+     * @example
+     * ```ts
+     * const application =
+     *   await client.zeroTrust.access.applications.create({
+     *     domain: 'test.example.com/admin',
+     *     type: 'self_hosted',
+     *     account_id: 'account_id',
+     *   });
+     * ```
      */
     create(params: ApplicationCreateParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationCreateResponse>;
     /**
      * Updates an Access application.
+     *
+     * @example
+     * ```ts
+     * const application =
+     *   await client.zeroTrust.access.applications.update(
+     *     '023e105f4ecef8ad9ca31a8372d0c353',
+     *     {
+     *       domain: 'test.example.com/admin',
+     *       type: 'self_hosted',
+     *       account_id: 'account_id',
+     *     },
+     *   );
+     * ```
      */
     update(appId: AppIDParam, params: ApplicationUpdateParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationUpdateResponse>;
     /**
      * Lists all Access applications in an account or zone.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const applicationListResponse of client.zeroTrust.access.applications.list(
+     *   { account_id: 'account_id' },
+     * )) {
+     *   // ...
+     * }
+     * ```
      */
     list(params?: ApplicationListParams, options?: Core.RequestOptions): Core.PagePromise<ApplicationListResponsesSinglePage, ApplicationListResponse>;
     list(options?: Core.RequestOptions): Core.PagePromise<ApplicationListResponsesSinglePage, ApplicationListResponse>;
     /**
      * Deletes an application from Access.
+     *
+     * @example
+     * ```ts
+     * const application =
+     *   await client.zeroTrust.access.applications.delete(
+     *     '023e105f4ecef8ad9ca31a8372d0c353',
+     *     { account_id: 'account_id' },
+     *   );
+     * ```
      */
     delete(appId: AppIDParam, params?: ApplicationDeleteParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
     delete(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationDeleteResponse>;
     /**
      * Fetches information about an Access application.
+     *
+     * @example
+     * ```ts
+     * const application =
+     *   await client.zeroTrust.access.applications.get(
+     *     '023e105f4ecef8ad9ca31a8372d0c353',
+     *     { account_id: 'account_id' },
+     *   );
+     * ```
      */
     get(appId: AppIDParam, params?: ApplicationGetParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationGetResponse>;
     get(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationGetResponse>;
     /**
      * Revokes all tokens issued for an application.
+     *
+     * @example
+     * ```ts
+     * const response =
+     *   await client.zeroTrust.access.applications.revokeTokens(
+     *     '023e105f4ecef8ad9ca31a8372d0c353',
+     *     { account_id: 'account_id' },
+     *   );
+     * ```
      */
     revokeTokens(appId: AppIDParam, params?: ApplicationRevokeTokensParams, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
     revokeTokens(appId: AppIDParam, options?: Core.RequestOptions): Core.APIPromise<ApplicationRevokeTokensResponse | null>;
@@ -62,11 +125,11 @@ export type AllowedMethodsParam = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'DELETE' | '
 export type AllowedOrigins = string;
 export type AllowedOriginsParam = string;
 /**
- * Identifier
+ * Identifier.
  */
 export type AppID = string;
 /**
- * Identifier
+ * Identifier.
  */
 export type AppIDParam = string;
 export type Application = Application.SelfHostedApplication | Application.SaaSApplication | Application.BrowserSSHApplication | Application.BrowserVNCApplication | Application.AppLauncherApplication | Application.DeviceEnrollmentPermissionsApplication | Application.BrowserIsolationPermissionsApplication | Application.BookmarkApplication;
@@ -81,9 +144,13 @@ export declare namespace Application {
          */
         type: string;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -202,7 +269,7 @@ export declare namespace Application {
     }
     interface SaaSApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -445,9 +512,13 @@ export declare namespace Application {
          */
         type: string;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -574,9 +645,13 @@ export declare namespace Application {
          */
         type: string;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -699,7 +774,7 @@ export declare namespace Application {
          */
         type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -744,7 +819,7 @@ export declare namespace Application {
          */
         type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -789,7 +864,7 @@ export declare namespace Application {
          */
         type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -838,7 +913,7 @@ export declare namespace Application {
          */
         type: string;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         app_launcher_visible?: unknown;
@@ -1784,9 +1859,9 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -1796,6 +1871,10 @@ export declare namespace ApplicationCreateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -1870,6 +1949,16 @@ export declare namespace ApplicationCreateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<SelfHostedApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -1894,7 +1983,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -1951,12 +2040,71 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -2038,7 +2186,7 @@ export declare namespace ApplicationCreateResponse {
     }
     interface SaaSApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -2087,16 +2235,75 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -2185,9 +2392,9 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -2197,6 +2404,10 @@ export declare namespace ApplicationCreateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -2271,6 +2482,16 @@ export declare namespace ApplicationCreateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserSSHApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -2295,7 +2516,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -2352,12 +2573,71 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -2446,9 +2726,9 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -2458,6 +2738,10 @@ export declare namespace ApplicationCreateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -2532,6 +2816,16 @@ export declare namespace ApplicationCreateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserVNCApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -2556,7 +2850,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -2613,54 +2907,113 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
             /**
-             * The order of execution for this policy. Must be unique for each policy within an
-             * app.
+             * The UUID of the policy
              */
-            precedence?: number;
-        }
-        /**
-         * Configuration for provisioning to this application via SCIM. This is currently
-         * in closed beta.
-         */
-        interface SCIMConfig {
+            id?: string;
             /**
-             * The UID of the IdP to use as the source for SCIM resources to provision to this
-             * application.
+             * Administrators who can approve a temporary authentication request.
              */
-            idp_uid: string;
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
             /**
-             * The base URI for the application's SCIM-compatible API.
+             * Requires the user to request access from an administrator at the start of each
+             * session.
              */
-            remote_uri: string;
+            approval_required?: boolean;
+            created_at?: string;
             /**
-             * Attributes for configuring HTTP Basic authentication scheme for SCIM
-             * provisioning to an application.
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
              */
-            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            decision?: ApplicationsAPI.Decision;
             /**
-             * If false, propagates DELETE requests to the target application for SCIM
-             * resources. If true, sets 'active' to false on the SCIM resource. Note: Some
-             * targets do not support DELETE operations.
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
              */
-            deactivate_on_delete?: boolean;
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
             /**
-             * Whether SCIM provisioning is turned on for this application.
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
              */
-            enabled?: boolean;
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
             /**
-             * A list of mappings to apply to SCIM resources before provisioning them in this
-             * application. These can transform or filter the resources to be provisioned.
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
              */
-            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
-        }
-        namespace SCIMConfig {
+            isolation_required?: boolean;
             /**
-             * Attributes for configuring Access Service Token authentication scheme for SCIM
-             * provisioning to an application.
+             * The name of the Access policy.
              */
-            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | ApplicationsAPI.SCIMConfigAuthenticationOAuthBearerToken | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, propagates DELETE requests to the target application for SCIM
+             * resources. If true, sets 'active' to false on the SCIM resource. Note: Some
+             * targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
                 /**
                  * Client ID of the Access service token used to authenticate with the remote
                  * service.
@@ -2702,9 +3055,9 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: ApplicationsAPI.ApplicationType;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -2760,7 +3113,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -2805,12 +3158,71 @@ export declare namespace ApplicationCreateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -2896,7 +3308,7 @@ export declare namespace ApplicationCreateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -2952,7 +3364,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -2997,12 +3409,71 @@ export declare namespace ApplicationCreateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -3088,7 +3559,7 @@ export declare namespace ApplicationCreateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -3144,7 +3615,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -3189,12 +3660,71 @@ export declare namespace ApplicationCreateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -3276,7 +3806,7 @@ export declare namespace ApplicationCreateResponse {
     }
     interface BookmarkApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -3313,7 +3843,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace BookmarkApplication {
@@ -3402,7 +3932,7 @@ export declare namespace ApplicationCreateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -3432,7 +3962,7 @@ export declare namespace ApplicationCreateResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -3592,9 +4122,9 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -3604,6 +4134,10 @@ export declare namespace ApplicationCreateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -3678,6 +4212,16 @@ export declare namespace ApplicationCreateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserRdpApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -3702,7 +4246,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -3726,7 +4270,7 @@ export declare namespace ApplicationCreateResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -3774,12 +4318,71 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -3871,9 +4474,9 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -3883,6 +4486,10 @@ export declare namespace ApplicationUpdateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -3957,6 +4564,16 @@ export declare namespace ApplicationUpdateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<SelfHostedApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -3981,7 +4598,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -4038,12 +4655,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -4125,7 +4801,7 @@ export declare namespace ApplicationUpdateResponse {
     }
     interface SaaSApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -4174,16 +4850,75 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -4272,9 +5007,9 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -4284,6 +5019,10 @@ export declare namespace ApplicationUpdateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -4358,6 +5097,16 @@ export declare namespace ApplicationUpdateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserSSHApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -4382,7 +5131,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -4439,12 +5188,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -4533,9 +5341,9 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -4545,6 +5353,10 @@ export declare namespace ApplicationUpdateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -4619,6 +5431,16 @@ export declare namespace ApplicationUpdateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserVNCApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -4643,7 +5465,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -4700,12 +5522,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -4789,9 +5670,9 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: ApplicationsAPI.ApplicationType;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -4847,7 +5728,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -4892,12 +5773,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -4983,7 +5923,7 @@ export declare namespace ApplicationUpdateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5039,7 +5979,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -5084,12 +6024,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -5175,7 +6174,7 @@ export declare namespace ApplicationUpdateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5231,7 +6230,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -5276,12 +6275,71 @@ export declare namespace ApplicationUpdateResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -5363,7 +6421,7 @@ export declare namespace ApplicationUpdateResponse {
     }
     interface BookmarkApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5400,7 +6458,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace BookmarkApplication {
@@ -5489,7 +6547,7 @@ export declare namespace ApplicationUpdateResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5519,7 +6577,7 @@ export declare namespace ApplicationUpdateResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -5679,9 +6737,9 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5691,6 +6749,10 @@ export declare namespace ApplicationUpdateResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -5765,6 +6827,16 @@ export declare namespace ApplicationUpdateResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserRdpApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -5789,7 +6861,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -5813,7 +6885,7 @@ export declare namespace ApplicationUpdateResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -5861,14 +6933,73 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
             /**
-             * The order of execution for this policy. Must be unique for each policy within an
-             * app.
+             * The UUID of the policy
              */
-            precedence?: number;
-        }
-        /**
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+        /**
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
@@ -5958,9 +7089,9 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -5970,6 +7101,10 @@ export declare namespace ApplicationListResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -6044,6 +7179,16 @@ export declare namespace ApplicationListResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<SelfHostedApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -6068,7 +7213,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -6125,12 +7270,71 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -6212,7 +7416,7 @@ export declare namespace ApplicationListResponse {
     }
     interface SaaSApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -6261,16 +7465,75 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -6359,9 +7622,9 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -6371,6 +7634,10 @@ export declare namespace ApplicationListResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -6445,6 +7712,16 @@ export declare namespace ApplicationListResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserSSHApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -6469,7 +7746,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -6526,12 +7803,71 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -6620,9 +7956,9 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -6632,6 +7968,10 @@ export declare namespace ApplicationListResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -6706,6 +8046,16 @@ export declare namespace ApplicationListResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserVNCApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -6730,7 +8080,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -6787,12 +8137,71 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -6876,9 +8285,9 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: ApplicationsAPI.ApplicationType;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -6934,7 +8343,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -6979,12 +8388,71 @@ export declare namespace ApplicationListResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -7070,7 +8538,7 @@ export declare namespace ApplicationListResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -7126,7 +8594,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -7153,30 +8621,89 @@ export declare namespace ApplicationListResponse {
             /**
              * The background color of the log in button on the landing page.
              */
-            button_color?: string;
+            button_color?: string;
+            /**
+             * The color of the text in the log in button on the landing page.
+             */
+            button_text_color?: string;
+            /**
+             * The URL of the image shown on the landing page.
+             */
+            image_url?: string;
+            /**
+             * The message shown on the landing page.
+             */
+            message?: string;
+            /**
+             * The title shown on the landing page.
+             */
+            title?: string;
+        }
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
-             * The color of the text in the log in button on the landing page.
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
              */
-            button_text_color?: string;
+            precedence?: number;
             /**
-             * The URL of the image shown on the landing page.
+             * A custom message that will appear on the purpose justification screen.
              */
-            image_url?: string;
+            purpose_justification_prompt?: string;
             /**
-             * The message shown on the landing page.
+             * Require users to enter a justification when they log in to the application.
              */
-            message?: string;
+            purpose_justification_required?: boolean;
             /**
-             * The title shown on the landing page.
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
              */
-            title?: string;
-        }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
             /**
-             * The order of execution for this policy. Must be unique for each policy within an
-             * app.
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
              */
-            precedence?: number;
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -7262,7 +8789,7 @@ export declare namespace ApplicationListResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -7318,7 +8845,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -7363,12 +8890,71 @@ export declare namespace ApplicationListResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -7450,7 +9036,7 @@ export declare namespace ApplicationListResponse {
     }
     interface BookmarkApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -7487,7 +9073,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace BookmarkApplication {
@@ -7576,7 +9162,7 @@ export declare namespace ApplicationListResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -7606,7 +9192,7 @@ export declare namespace ApplicationListResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -7766,9 +9352,9 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -7778,6 +9364,10 @@ export declare namespace ApplicationListResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -7852,6 +9442,16 @@ export declare namespace ApplicationListResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserRdpApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -7876,7 +9476,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -7900,7 +9500,7 @@ export declare namespace ApplicationListResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -7948,12 +9548,71 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -8036,7 +9695,7 @@ export declare namespace ApplicationListResponse {
 }
 export interface ApplicationDeleteResponse {
     /**
-     * UUID
+     * UUID.
      */
     id?: string;
 }
@@ -8051,9 +9710,9 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -8063,6 +9722,10 @@ export declare namespace ApplicationGetResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -8137,6 +9800,16 @@ export declare namespace ApplicationGetResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<SelfHostedApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -8161,7 +9834,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -8218,12 +9891,71 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -8305,7 +10037,7 @@ export declare namespace ApplicationGetResponse {
     }
     interface SaaSApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -8354,16 +10086,75 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -8452,9 +10243,9 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -8464,6 +10255,10 @@ export declare namespace ApplicationGetResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -8538,6 +10333,16 @@ export declare namespace ApplicationGetResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserSSHApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -8562,7 +10367,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -8619,12 +10424,71 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -8713,9 +10577,9 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -8725,6 +10589,10 @@ export declare namespace ApplicationGetResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -8799,6 +10667,16 @@ export declare namespace ApplicationGetResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserVNCApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -8823,7 +10701,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -8880,12 +10758,71 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -8969,9 +10906,9 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: ApplicationsAPI.ApplicationType;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9027,7 +10964,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -9072,12 +11009,71 @@ export declare namespace ApplicationGetResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -9163,7 +11159,7 @@ export declare namespace ApplicationGetResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9219,7 +11215,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -9237,39 +11233,98 @@ export declare namespace ApplicationGetResponse {
             /**
              * the hyperlink in the footer link.
              */
-            url: string;
-        }
-        /**
-         * The design of the App Launcher landing page shown to users when they log in.
-         */
-        interface LandingPageDesign {
+            url: string;
+        }
+        /**
+         * The design of the App Launcher landing page shown to users when they log in.
+         */
+        interface LandingPageDesign {
+            /**
+             * The background color of the log in button on the landing page.
+             */
+            button_color?: string;
+            /**
+             * The color of the text in the log in button on the landing page.
+             */
+            button_text_color?: string;
+            /**
+             * The URL of the image shown on the landing page.
+             */
+            image_url?: string;
+            /**
+             * The message shown on the landing page.
+             */
+            message?: string;
+            /**
+             * The title shown on the landing page.
+             */
+            title?: string;
+        }
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
             /**
-             * The background color of the log in button on the landing page.
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
              */
-            button_color?: string;
+            decision?: ApplicationsAPI.Decision;
             /**
-             * The color of the text in the log in button on the landing page.
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
              */
-            button_text_color?: string;
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
             /**
-             * The URL of the image shown on the landing page.
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
              */
-            image_url?: string;
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
             /**
-             * The message shown on the landing page.
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
              */
-            message?: string;
+            isolation_required?: boolean;
             /**
-             * The title shown on the landing page.
+             * The name of the Access policy.
              */
-            title?: string;
-        }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -9355,7 +11410,7 @@ export declare namespace ApplicationGetResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9411,7 +11466,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -9456,12 +11511,71 @@ export declare namespace ApplicationGetResponse {
              */
             title?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -9543,7 +11657,7 @@ export declare namespace ApplicationGetResponse {
     }
     interface BookmarkApplication {
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9580,7 +11694,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type?: string;
+        type?: ApplicationsAPI.ApplicationType;
         updated_at?: string;
     }
     namespace BookmarkApplication {
@@ -9669,7 +11783,7 @@ export declare namespace ApplicationGetResponse {
          */
         type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9699,7 +11813,7 @@ export declare namespace ApplicationGetResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -9859,9 +11973,9 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: string;
+        type: ApplicationsAPI.ApplicationType;
         /**
-         * UUID
+         * UUID.
          */
         id?: string;
         /**
@@ -9871,6 +11985,10 @@ export declare namespace ApplicationGetResponse {
          * authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -9945,6 +12063,16 @@ export declare namespace ApplicationGetResponse {
          */
         path_cookie_attribute?: boolean;
         policies?: Array<BrowserRdpApplication.Policy>;
+        /**
+         * Allows matching Access Service Tokens passed HTTP in a single header with this
+         * name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Sets the SameSite cookie setting, which provides increased security against CSRF
          * attacks.
@@ -9969,7 +12097,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
+         * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -9993,7 +12121,7 @@ export declare namespace ApplicationGetResponse {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -10041,12 +12169,71 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
-        interface Policy extends ApplicationsAPI.ApplicationPolicy {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
             /**
              * The order of execution for this policy. Must be unique for each policy within an
              * app.
              */
             precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
         }
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
@@ -10139,7 +12326,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -10157,6 +12344,10 @@ export declare namespace ApplicationCreateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -10236,6 +12427,16 @@ export declare namespace ApplicationCreateParams {
          * policies exclusive to the application.
          */
         policies?: Array<SelfHostedApplication.AccessAppPolicyLink | string | SelfHostedApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -10247,10 +12448,10 @@ export declare namespace ApplicationCreateParams {
          */
         scim_config?: SelfHostedApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -10261,7 +12462,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -10510,7 +12711,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type?: string;
+        type?: ApplicationTypeParam;
     }
     namespace SaaSApplication {
         /**
@@ -10654,7 +12855,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -10672,6 +12873,10 @@ export declare namespace ApplicationCreateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -10751,6 +12956,16 @@ export declare namespace ApplicationCreateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserSSHApplication.AccessAppPolicyLink | string | BrowserSSHApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -10762,10 +12977,10 @@ export declare namespace ApplicationCreateParams {
          */
         scim_config?: BrowserSSHApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -10776,7 +12991,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -10973,7 +13188,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -10991,6 +13206,10 @@ export declare namespace ApplicationCreateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -11070,6 +13289,16 @@ export declare namespace ApplicationCreateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserVNCApplication.AccessAppPolicyLink | string | BrowserVNCApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -11081,10 +13310,10 @@ export declare namespace ApplicationCreateParams {
          */
         scim_config?: BrowserVNCApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -11095,7 +13324,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -11287,7 +13516,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: ApplicationTypeParam;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -11343,7 +13572,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -11579,7 +13808,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -11815,7 +14044,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -12031,7 +14260,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type?: string;
+        type?: ApplicationTypeParam;
     }
     namespace BookmarkApplication {
         /**
@@ -12150,7 +14379,7 @@ export declare namespace ApplicationCreateParams {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -12230,7 +14459,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -12248,6 +14477,10 @@ export declare namespace ApplicationCreateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -12327,6 +14560,16 @@ export declare namespace ApplicationCreateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserRdpApplication.AccessAppPolicyLink | string | BrowserRdpApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -12338,10 +14581,10 @@ export declare namespace ApplicationCreateParams {
          */
         scim_config?: BrowserRdpApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -12352,7 +14595,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -12375,7 +14618,7 @@ export declare namespace ApplicationCreateParams {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -12567,7 +14810,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -12585,6 +14828,10 @@ export declare namespace ApplicationUpdateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -12664,6 +14911,16 @@ export declare namespace ApplicationUpdateParams {
          * policies exclusive to the application.
          */
         policies?: Array<SelfHostedApplication.AccessAppPolicyLink | string | SelfHostedApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -12675,10 +14932,10 @@ export declare namespace ApplicationUpdateParams {
          */
         scim_config?: SelfHostedApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -12689,7 +14946,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -12938,7 +15195,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type?: string;
+        type?: ApplicationTypeParam;
     }
     namespace SaaSApplication {
         /**
@@ -13082,7 +15339,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13100,6 +15357,10 @@ export declare namespace ApplicationUpdateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -13179,6 +15440,16 @@ export declare namespace ApplicationUpdateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserSSHApplication.AccessAppPolicyLink | string | BrowserSSHApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -13190,10 +15461,10 @@ export declare namespace ApplicationUpdateParams {
          */
         scim_config?: BrowserSSHApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -13204,7 +15475,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -13401,7 +15672,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13419,6 +15690,10 @@ export declare namespace ApplicationUpdateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -13498,6 +15773,16 @@ export declare namespace ApplicationUpdateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserVNCApplication.AccessAppPolicyLink | string | BrowserVNCApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -13509,10 +15794,10 @@ export declare namespace ApplicationUpdateParams {
          */
         scim_config?: BrowserVNCApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -13523,7 +15808,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -13715,7 +16000,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: ApplicationTypeParam;
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13771,7 +16056,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -14007,7 +16292,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -14243,7 +16528,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -14459,7 +16744,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type?: string;
+        type?: ApplicationTypeParam;
     }
     namespace BookmarkApplication {
         /**
@@ -14578,7 +16863,7 @@ export declare namespace ApplicationUpdateParams {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -14658,7 +16943,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: string;
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -14676,6 +16961,10 @@ export declare namespace ApplicationUpdateParams {
          * setting for WARP authentication.
          */
         allow_authenticate_via_warp?: boolean;
+        /**
+         * Body param: Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
         /**
          * Body param: The identity providers your users can select when connecting to this
          * application. Defaults to all IdPs configured in your account.
@@ -14755,6 +17044,16 @@ export declare namespace ApplicationUpdateParams {
          * policies exclusive to the application.
          */
         policies?: Array<BrowserRdpApplication.AccessAppPolicyLink | string | BrowserRdpApplication.UnionMember2>;
+        /**
+         * Body param: Allows matching Access Service Tokens passed HTTP in a single header
+         * with this name. This works as an alternative to the (CF-Access-Client-Id,
+         * CF-Access-Client-Secret) pair of headers. The header value will be interpreted
+         * as a json object similar to: { "cf-access-client-id":
+         * "88bf3b6d86161464f6509f7219099e57.access.example.com",
+         * "cf-access-client-secret":
+         * "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
+         */
+        read_service_tokens_from_header?: string;
         /**
          * Body param: Sets the SameSite cookie setting, which provides increased security
          * against CSRF attacks.
@@ -14766,10 +17065,10 @@ export declare namespace ApplicationUpdateParams {
          */
         scim_config?: BrowserRdpApplication.SCIMConfig;
         /**
-         * Body param: List of public domains that Access will secure. This field is
-         * deprecated in favor of `destinations` and will be supported until **November
-         * 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be
-         * ignored.
+         * @deprecated Body param: List of public domains that Access will secure. This
+         * field is deprecated in favor of `destinations` and will be supported until
+         * **November 21, 2025.** If `destinations` are provided, then
+         * `self_hosted_domains` will be ignored.
          */
         self_hosted_domains?: Array<SelfHostedDomainsParam>;
         /**
@@ -14780,7 +17079,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-         * (or µs), ms, s, m, h.
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
         /**
@@ -14803,7 +17102,7 @@ export declare namespace ApplicationUpdateParams {
             /**
              * The communication protocol your application secures.
              */
-            protocol: 'ssh';
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -15048,5 +17347,6 @@ export declare namespace Applications {
     export { UserPolicyChecks as UserPolicyChecks, type UserPolicyCheckGeo as UserPolicyCheckGeo, type UserPolicyCheckListResponse as UserPolicyCheckListResponse, type UserPolicyCheckListParams as UserPolicyCheckListParams, };
     export { Policies as Policies, type AccessDevicePostureRule as AccessDevicePostureRule, type AccessRule as AccessRule, type AnyValidServiceTokenRule as AnyValidServiceTokenRule, type AuthenticationMethodRule as AuthenticationMethodRule, type AzureGroupRule as AzureGroupRule, type CertificateRule as CertificateRule, type CountryRule as CountryRule, type DomainRule as DomainRule, type EmailListRule as EmailListRule, type EmailRule as EmailRule, type EveryoneRule as EveryoneRule, type ExternalEvaluationRule as ExternalEvaluationRule, type GitHubOrganizationRule as GitHubOrganizationRule, type GroupRule as GroupRule, type GSuiteGroupRule as GSuiteGroupRule, type IPListRule as IPListRule, type IPRule as IPRule, type OktaGroupRule as OktaGroupRule, type SAMLGroupRule as SAMLGroupRule, type ServiceTokenRule as ServiceTokenRule, type PolicyCreateResponse as PolicyCreateResponse, type PolicyUpdateResponse as PolicyUpdateResponse, type PolicyListResponse as PolicyListResponse, type PolicyDeleteResponse as PolicyDeleteResponse, type PolicyGetResponse as PolicyGetResponse, PolicyListResponsesSinglePage as PolicyListResponsesSinglePage, type PolicyCreateParams as PolicyCreateParams, type PolicyUpdateParams as PolicyUpdateParams, type PolicyListParams as PolicyListParams, type PolicyDeleteParams as PolicyDeleteParams, type PolicyGetParams as PolicyGetParams, };
     export { PolicyTests as PolicyTests, type PolicyTestCreateResponse as PolicyTestCreateResponse, type PolicyTestGetResponse as PolicyTestGetResponse, type PolicyTestCreateParams as PolicyTestCreateParams, type PolicyTestGetParams as PolicyTestGetParams, };
+    export { Settings as Settings, type SettingUpdateResponse as SettingUpdateResponse, type SettingEditResponse as SettingEditResponse, type SettingUpdateParams as SettingUpdateParams, type SettingEditParams as SettingEditParams, };
 }
 //# sourceMappingURL=applications.d.ts.map