cloudflare 5.1.0 → 5.2.0

package/resources/zero-trust/gateway/rules.d.ts

@@ -4,7 +4,7 @@ import * as RulesAPI from "./rules.js";
 import { SinglePage } from "../../../pagination.js";
 export declare class Rules extends APIResource {
     /**
-     * Creates a new Zero Trust Gateway rule.
+     * Create a new Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -18,7 +18,7 @@ export declare class Rules extends APIResource {
      */
     create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Updates a configured Zero Trust Gateway rule.
+     * Update a configured Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -35,7 +35,7 @@ export declare class Rules extends APIResource {
      */
     update(ruleId: string, params: RuleUpdateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Fetches the Zero Trust Gateway rules for an account.
+     * List Zero Trust Gateway rules for an account.
      *
      * @example
      * ```ts
@@ -49,7 +49,7 @@ export declare class Rules extends APIResource {
      */
     list(params: RuleListParams, options?: Core.RequestOptions): Core.PagePromise<GatewayRulesSinglePage, GatewayRule>;
     /**
-     * Deletes a Zero Trust Gateway rule.
+     * Delete a Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -61,7 +61,7 @@ export declare class Rules extends APIResource {
      */
     delete(ruleId: string, params: RuleDeleteParams, options?: Core.RequestOptions): Core.APIPromise<RuleDeleteResponse>;
     /**
-     * Fetches a single Zero Trust Gateway rule.
+     * Get a single Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -74,11 +74,9 @@ export declare class Rules extends APIResource {
      */
     get(ruleId: string, params: RuleGetParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Resets the expiration of a Zero Trust Gateway Rule if its duration has elapsed
-     * and it has a default duration.
-     *
-     * The Zero Trust Gateway Rule must have values for both `expiration.expires_at`
-     * and `expiration.duration`.
+     * Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and
+     * it has a default duration. The Zero Trust Gateway Rule must have values for both
+     * `expiration.expires_at` and `expiration.duration`.
      *
      * @example
      * ```ts
@@ -95,364 +93,393 @@ export declare class GatewayRulesSinglePage extends SinglePage<GatewayRule> {
 }
 export interface DNSResolverSettingsV4 {
     /**
-     * IPv4 address of upstream resolver.
+     * Specify the IPv4 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV4Param {
     /**
-     * IPv4 address of upstream resolver.
+     * Specify the IPv4 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV6 {
     /**
-     * IPv6 address of upstream resolver.
+     * Specify the IPv6 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV6Param {
     /**
-     * IPv6 address of upstream resolver.
+     * Specify the IPv6 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilterParam = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 export interface GatewayRule {
     /**
-     * The action to perform when the associated traffic, identity, and device posture
-     * expressions are either absent or evaluate to `true`.
+     * Specify the action to perform when the associated traffic, identity, and device
+     * posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * True if the rule is enabled.
+     * Specify whether the rule is enabled.
      */
     enabled: boolean;
     /**
-     * The protocol or layer to evaluate the traffic, identity, and device. posture
-     * expressions.
+     * Specify the protocol or layer to evaluate the traffic, identity, and device
+     * posture expressions.
      */
     filters: Array<GatewayFilter>;
     /**
-     * The name of the rule.
+     * Specify the rule name.
      */
     name: string;
     /**
-     * Precedence sets the order of your rules. Lower values indicate higher
-     * precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Set the order of your rules. Lower values indicate higher precedence. At each
+     * processing phase, evaluate applicable rules in ascending order of this value.
+     * Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence: number;
     /**
-     * The wirefilter expression used for traffic matching. The API automatically
-     * formats and sanitizes this expression. This returns a normalized version that
-     * may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic: string;
     /**
-     * The API resource UUID.
+     * Identify the API resource with a UUID.
      */
     id?: string;
     created_at?: string;
     /**
-     * Date of deletion, if any.
+     * Indicate the date of deletion, if any.
      */
     deleted_at?: string | null;
     /**
-     * The description of the rule.
+     * Specify the rule description.
      */
     description?: string;
     /**
-     * The wirefilter expression used for device posture check matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for device posture check. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: GatewayRule.Expiration | null;
     /**
-     * The wirefilter expression used for identity matching. The API automatically
-     * formats and sanitizes this expression. This returns a normalized version that
-     * may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for identity matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * The rule cannot be shared via the Orgs API.
-     */
-    not_sharable?: boolean;
-    /**
-     * The rule was shared via the Orgs API and cannot be edited by the current
-     * account.
+     * Indicate that this rule is shared via the Orgs API and read only.
      */
     read_only?: boolean;
     /**
-     * Additional settings that modify the rule's action.
+     * Set settings related to this rule. Each setting is only valid for specific rule
+     * types and can only be used with the appropriate selectors. If Terraform drift is
+     * observed in these setting values, verify that the setting is supported for the
+     * given rule type and that the API response reflects the requested value. If the
+     * API response returns sanitized or modified values that differ from the request,
+     * use the API-provided values in Terraform to ensure consistency.
      */
     rule_settings?: RuleSetting;
     /**
-     * The schedule for activating DNS policies. This does not apply to HTTP or network
-     * policies.
+     * Defines the schedule for activating DNS policies. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     schedule?: Schedule | null;
     /**
-     * account tag of account that created the rule.
+     * Indicate that this rule is sharable via the Orgs API.
+     */
+    sharable?: boolean;
+    /**
+     * Provide the account tag of the account that created the rule.
      */
     source_account?: string;
     updated_at?: string;
     /**
-     * version number of the rule.
+     * Indicate the version number of the rule(read-only).
      */
     version?: number;
     /**
-     * Warning for a misconfigured rule, if any.
+     * Indicate a warning for a misconfigured rule, if any.
      */
     warning_status?: string | null;
 }
 export declare namespace GatewayRule {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;
         /**
-         * Whether the policy has expired.
+         * Indicates whether the policy is expired.
          */
         expired?: boolean;
     }
 }
 /**
- * Additional settings that modify the rule's action.
+ * Set settings related to this rule. Each setting is only valid for specific rule
+ * types and can only be used with the appropriate selectors. If Terraform drift is
+ * observed in these setting values, verify that the setting is supported for the
+ * given rule type and that the API response reflects the requested value. If the
+ * API response returns sanitized or modified values that differ from the request,
+ * use the API-provided values in Terraform to ensure consistency.
  */
 export interface RuleSetting {
     /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
+     * Add custom headers to allowed requests as key-value pairs. Use header names as
+     * keys that map to arrays of header values. Settable only for `http` rules with
+     * the action set to `allow`.
      */
     add_headers?: {
         [key: string]: Array<string>;
     } | null;
     /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
+     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+     * this. this rule. Settable for all types of rules.
      */
     allow_child_bypass?: boolean | null;
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     audit_ssh?: RuleSetting.AuditSSH | null;
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     biso_admin_controls?: RuleSetting.BISOAdminControls;
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     block_page?: RuleSetting.BlockPage | null;
     /**
-     * Enable the custom block page.
+     * Enable the custom block page. Settable only for `dns` rules with action `block`.
      */
     block_page_enabled?: boolean;
     /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
+     * Explain why the rule blocks the request. The custom block page shows this text
+     * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+     * set to `block`.
      */
     block_reason?: string | null;
     /**
-     * Set by children MSP accounts to bypass their parent's rules.
+     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+     * accounts can set this. Settable for all types of rules.
      */
     bypass_parent_rule?: boolean | null;
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     check_session?: RuleSetting.CheckSession | null;
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     dns_resolvers?: RuleSetting.DNSResolvers | null;
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     egress?: RuleSetting.Egress | null;
     /**
-     * Set to true, to ignore the category matches at CNAME domains in a response. If
-     * unchecked, the categories in this rule will be checked against all the CNAME
-     * domain categories in a response.
+     * Ignore category matches at CNAME domains in a response. When off, evaluate
+     * categories in this rule against all CNAME domain categories in the response.
+     * Settable only for `dns` and `dns_resolver` rules.
      */
     ignore_cname_category_matches?: boolean;
     /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
+     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+     * Settable only for `dns` rules.
      */
     insecure_disable_dnssec_validation?: boolean;
     /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
+     * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+     * categories unless you enable this setting. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_categories?: boolean;
     /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
+     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+     * indicator feeds block only domain names. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_indicator_feeds?: boolean;
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     l4override?: RuleSetting.L4override | null;
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     notification_settings?: RuleSetting.NotificationSettings | null;
     /**
-     * Override matching DNS queries with a hostname.
+     * Defines a hostname for override, for the matching DNS queries. Settable only for
+     * `dns` rules with the action set to `override`.
      */
     override_host?: string;
     /**
-     * Override matching DNS queries with an IP or set of IPs.
+     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+     * for `dns` rules with the action set to `override`.
      */
     override_ips?: Array<string> | null;
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     payload_log?: RuleSetting.PayloadLog | null;
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     quarantine?: RuleSetting.Quarantine | null;
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     redirect?: RuleSetting.Redirect | null;
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     resolve_dns_internally?: RuleSetting.ResolveDNSInternally | null;
     /**
      * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when 'dns_resolvers' are specified or
-     * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-     * 'resolve'.
+     * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+     * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+     * `dns_resolver` rules.
      */
     resolve_dns_through_cloudflare?: boolean | null;
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     untrusted_cert?: RuleSetting.UntrustedCERT | null;
 }
 export declare namespace RuleSetting {
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     interface AuditSSH {
         /**
-         * Enable to turn on SSH command logging.
+         * Enable SSH command logging.
          */
         command_logging?: boolean;
     }
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     interface BISOAdminControls {
         /**
-         * Configure whether copy is enabled or not. When set with "remote_only", copying
-         * isolated content from the remote browser to the user's local clipboard is
-         * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+         * Configure copy behavior. If set to remote_only, users cannot copy isolated
+         * content from the remote browser to the local clipboard. If this field is absent,
+         * copying remains enabled. Applies only when version == "v2".
          */
         copy?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -468,8 +495,8 @@ export declare namespace RuleSetting {
          */
         dk?: boolean;
         /**
-         * Configure whether downloading enabled or not. When set with "remote_only",
-         * downloads are only available for viewing. Only applies when `version == "v2"`.
+         * Configure download behavior. When set to remote_only, users can view downloads
+         * but cannot save them. Applies only when version == "v2".
          */
         download?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -481,65 +508,66 @@ export declare namespace RuleSetting {
          */
         du?: boolean;
         /**
-         * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-         * is enabled. Only applies when `version == "v2"`.
+         * Configure keyboard usage behavior. If this field is absent, keyboard usage
+         * remains enabled. Applies only when version == "v2".
          */
         keyboard?: 'enabled' | 'disabled';
         /**
-         * Configure whether pasting is enabled or not. When set with "remote_only",
-         * pasting content from the user's local clipboard into isolated pages is disabled.
-         * When absent, paste is enabled. Only applies when `version == "v2"`.
+         * Configure paste behavior. If set to remote_only, users cannot paste content from
+         * the local clipboard into isolated pages. If this field is absent, pasting
+         * remains enabled. Applies only when version == "v2".
          */
         paste?: 'enabled' | 'disabled' | 'remote_only';
         /**
-         * Configure whether printing is enabled or not. When absent, printing is enabled.
-         * Only applies when `version == "v2"`.
+         * Configure print behavior. Default, Printing is enabled. Applies only when
+         * version == "v2".
          */
         printing?: 'enabled' | 'disabled';
         /**
-         * Configure whether uploading is enabled or not. When absent, uploading is
-         * enabled. Only applies when `version == "v2"`.
+         * Configure upload behavior. If this field is absent, uploading remains enabled.
+         * Applies only when version == "v2".
          */
         upload?: 'enabled' | 'disabled';
         /**
-         * Indicates which version of the browser isolation controls should apply.
+         * Indicate which version of the browser isolation controls should apply.
          */
         version?: 'v1' | 'v2';
     }
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     interface BlockPage {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
     }
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     interface CheckSession {
         /**
-         * Configure how fresh the session needs to be to be considered valid. The API
-         * automatically formats and sanitizes this expression. This returns a normalized
-         * version that may differ from your input and cause Terraform state drift.
+         * Sets the required session freshness threshold. The API returns a normalized
+         * version of this value.
          */
         duration?: string;
         /**
-         * Set to true to enable session enforcement.
+         * Enable session enforcement.
          */
         enforce?: boolean;
     }
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     interface DNSResolvers {
         ipv4?: Array<RulesAPI.DNSResolverSettingsV4>;
@@ -548,48 +576,48 @@ export declare namespace RuleSetting {
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     interface Egress {
         /**
-         * The IPv4 address to be used for egress.
+         * Specify the IPv4 address to use for egress.
          */
         ipv4?: string;
         /**
-         * The fallback IPv4 address to be used for egress in the event of an error
-         * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-         * WARP IPs.
+         * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+         * Set '0.0.0.0' to indicate local egress via WARP IPs.
          */
         ipv4_fallback?: string;
         /**
-         * The IPv6 range to be used for egress.
+         * Specify the IPv6 range to use for egress.
          */
         ipv6?: string;
     }
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     interface L4override {
         /**
-         * IPv4 or IPv6 address.
+         * Defines the IPv4 or IPv6 address.
          */
         ip?: string;
         /**
-         * A port number to use for TCP/UDP overrides.
+         * Defines a port number to use for TCP/UDP overrides.
          */
         port?: number;
     }
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     interface NotificationSettings {
         /**
-         * Set notification on.
+         * Enable notification.
          */
         enabled?: boolean;
         /**
-         * If true, context information will be passed as query parameters.
+         * Indicates whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
@@ -597,220 +625,247 @@ export declare namespace RuleSetting {
          */
         msg?: string;
         /**
-         * Optional URL to direct users to additional information. If not set, the
-         * notification will open a block page.
+         * Defines an optional URL to direct users to additional information. If unset, the
+         * notification opens a block page.
          */
         support_url?: string;
     }
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     interface PayloadLog {
         /**
-         * Set to true to enable DLP payload logging for this rule.
+         * Enable DLP payload logging for this rule.
          */
         enabled?: boolean;
     }
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     interface Quarantine {
         /**
-         * Types of files to sandbox.
+         * Specify the types of files to sandbox.
          */
         file_types?: Array<'exe' | 'pdf' | 'doc' | 'docm' | 'docx' | 'rtf' | 'ppt' | 'pptx' | 'xls' | 'xlsm' | 'xlsx' | 'zip' | 'rar'>;
     }
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     interface Redirect {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
-         * If true, the path and query parameters from the original request will be
-         * appended to target_uri.
+         * Specify whether to append the path and query parameters from the original
+         * request to target_uri.
          */
         preserve_path_and_query?: boolean;
     }
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     interface ResolveDNSInternally {
         /**
-         * The fallback behavior to apply when the internal DNS response code is different
-         * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-         * 'AAAA' queries.
+         * Specify the fallback behavior to apply when the internal DNS response code
+         * differs from 'NOERROR' or when the response data contains only CNAME records for
+         * 'A' or 'AAAA' queries.
          */
         fallback?: 'none' | 'public_dns';
         /**
-         * The internal DNS view identifier that's passed to the internal DNS service.
+         * Specify the internal DNS view identifier to pass to the internal DNS service.
          */
         view_id?: string;
     }
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     interface UntrustedCERT {
         /**
-         * The action performed when an untrusted certificate is seen. The default action
-         * is an error with HTTP code 526.
+         * Defines the action performed when an untrusted certificate seen. The default
+         * action an error with HTTP code 526.
          */
         action?: 'pass_through' | 'block' | 'error';
     }
 }
 /**
- * Additional settings that modify the rule's action.
+ * Set settings related to this rule. Each setting is only valid for specific rule
+ * types and can only be used with the appropriate selectors. If Terraform drift is
+ * observed in these setting values, verify that the setting is supported for the
+ * given rule type and that the API response reflects the requested value. If the
+ * API response returns sanitized or modified values that differ from the request,
+ * use the API-provided values in Terraform to ensure consistency.
  */
 export interface RuleSettingParam {
     /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
+     * Add custom headers to allowed requests as key-value pairs. Use header names as
+     * keys that map to arrays of header values. Settable only for `http` rules with
+     * the action set to `allow`.
      */
     add_headers?: {
         [key: string]: Array<string>;
     } | null;
     /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
+     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+     * this. this rule. Settable for all types of rules.
      */
     allow_child_bypass?: boolean | null;
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     audit_ssh?: RuleSettingParam.AuditSSH | null;
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     biso_admin_controls?: RuleSettingParam.BISOAdminControls;
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     block_page?: RuleSettingParam.BlockPage | null;
     /**
-     * Enable the custom block page.
+     * Enable the custom block page. Settable only for `dns` rules with action `block`.
      */
     block_page_enabled?: boolean;
     /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
+     * Explain why the rule blocks the request. The custom block page shows this text
+     * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+     * set to `block`.
      */
     block_reason?: string | null;
     /**
-     * Set by children MSP accounts to bypass their parent's rules.
+     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+     * accounts can set this. Settable for all types of rules.
      */
     bypass_parent_rule?: boolean | null;
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     check_session?: RuleSettingParam.CheckSession | null;
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     dns_resolvers?: RuleSettingParam.DNSResolvers | null;
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     egress?: RuleSettingParam.Egress | null;
     /**
-     * Set to true, to ignore the category matches at CNAME domains in a response. If
-     * unchecked, the categories in this rule will be checked against all the CNAME
-     * domain categories in a response.
+     * Ignore category matches at CNAME domains in a response. When off, evaluate
+     * categories in this rule against all CNAME domain categories in the response.
+     * Settable only for `dns` and `dns_resolver` rules.
      */
     ignore_cname_category_matches?: boolean;
     /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
+     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+     * Settable only for `dns` rules.
      */
     insecure_disable_dnssec_validation?: boolean;
     /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
+     * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+     * categories unless you enable this setting. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_categories?: boolean;
     /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
+     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+     * indicator feeds block only domain names. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_indicator_feeds?: boolean;
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     l4override?: RuleSettingParam.L4override | null;
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     notification_settings?: RuleSettingParam.NotificationSettings | null;
     /**
-     * Override matching DNS queries with a hostname.
+     * Defines a hostname for override, for the matching DNS queries. Settable only for
+     * `dns` rules with the action set to `override`.
      */
     override_host?: string;
     /**
-     * Override matching DNS queries with an IP or set of IPs.
+     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+     * for `dns` rules with the action set to `override`.
      */
     override_ips?: Array<string> | null;
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     payload_log?: RuleSettingParam.PayloadLog | null;
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     quarantine?: RuleSettingParam.Quarantine | null;
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     redirect?: RuleSettingParam.Redirect | null;
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     resolve_dns_internally?: RuleSettingParam.ResolveDNSInternally | null;
     /**
      * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when 'dns_resolvers' are specified or
-     * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-     * 'resolve'.
+     * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+     * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+     * `dns_resolver` rules.
      */
     resolve_dns_through_cloudflare?: boolean | null;
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     untrusted_cert?: RuleSettingParam.UntrustedCERT | null;
 }
 export declare namespace RuleSettingParam {
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     interface AuditSSH {
         /**
-         * Enable to turn on SSH command logging.
+         * Enable SSH command logging.
          */
         command_logging?: boolean;
     }
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     interface BISOAdminControls {
         /**
-         * Configure whether copy is enabled or not. When set with "remote_only", copying
-         * isolated content from the remote browser to the user's local clipboard is
-         * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+         * Configure copy behavior. If set to remote_only, users cannot copy isolated
+         * content from the remote browser to the local clipboard. If this field is absent,
+         * copying remains enabled. Applies only when version == "v2".
          */
         copy?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -826,8 +881,8 @@ export declare namespace RuleSettingParam {
          */
         dk?: boolean;
         /**
-         * Configure whether downloading enabled or not. When set with "remote_only",
-         * downloads are only available for viewing. Only applies when `version == "v2"`.
+         * Configure download behavior. When set to remote_only, users can view downloads
+         * but cannot save them. Applies only when version == "v2".
          */
         download?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -839,65 +894,66 @@ export declare namespace RuleSettingParam {
          */
         du?: boolean;
         /**
-         * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-         * is enabled. Only applies when `version == "v2"`.
+         * Configure keyboard usage behavior. If this field is absent, keyboard usage
+         * remains enabled. Applies only when version == "v2".
          */
         keyboard?: 'enabled' | 'disabled';
         /**
-         * Configure whether pasting is enabled or not. When set with "remote_only",
-         * pasting content from the user's local clipboard into isolated pages is disabled.
-         * When absent, paste is enabled. Only applies when `version == "v2"`.
+         * Configure paste behavior. If set to remote_only, users cannot paste content from
+         * the local clipboard into isolated pages. If this field is absent, pasting
+         * remains enabled. Applies only when version == "v2".
          */
         paste?: 'enabled' | 'disabled' | 'remote_only';
         /**
-         * Configure whether printing is enabled or not. When absent, printing is enabled.
-         * Only applies when `version == "v2"`.
+         * Configure print behavior. Default, Printing is enabled. Applies only when
+         * version == "v2".
          */
         printing?: 'enabled' | 'disabled';
         /**
-         * Configure whether uploading is enabled or not. When absent, uploading is
-         * enabled. Only applies when `version == "v2"`.
+         * Configure upload behavior. If this field is absent, uploading remains enabled.
+         * Applies only when version == "v2".
          */
         upload?: 'enabled' | 'disabled';
         /**
-         * Indicates which version of the browser isolation controls should apply.
+         * Indicate which version of the browser isolation controls should apply.
          */
         version?: 'v1' | 'v2';
     }
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     interface BlockPage {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
     }
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     interface CheckSession {
         /**
-         * Configure how fresh the session needs to be to be considered valid. The API
-         * automatically formats and sanitizes this expression. This returns a normalized
-         * version that may differ from your input and cause Terraform state drift.
+         * Sets the required session freshness threshold. The API returns a normalized
+         * version of this value.
          */
         duration?: string;
         /**
-         * Set to true to enable session enforcement.
+         * Enable session enforcement.
          */
         enforce?: boolean;
     }
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     interface DNSResolvers {
         ipv4?: Array<RulesAPI.DNSResolverSettingsV4Param>;
@@ -906,48 +962,48 @@ export declare namespace RuleSettingParam {
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     interface Egress {
         /**
-         * The IPv4 address to be used for egress.
+         * Specify the IPv4 address to use for egress.
          */
         ipv4?: string;
         /**
-         * The fallback IPv4 address to be used for egress in the event of an error
-         * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-         * WARP IPs.
+         * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+         * Set '0.0.0.0' to indicate local egress via WARP IPs.
          */
         ipv4_fallback?: string;
         /**
-         * The IPv6 range to be used for egress.
+         * Specify the IPv6 range to use for egress.
          */
         ipv6?: string;
     }
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     interface L4override {
         /**
-         * IPv4 or IPv6 address.
+         * Defines the IPv4 or IPv6 address.
          */
         ip?: string;
         /**
-         * A port number to use for TCP/UDP overrides.
+         * Defines a port number to use for TCP/UDP overrides.
          */
         port?: number;
     }
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     interface NotificationSettings {
         /**
-         * Set notification on.
+         * Enable notification.
          */
         enabled?: boolean;
         /**
-         * If true, context information will be passed as query parameters.
+         * Indicates whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
@@ -955,189 +1011,204 @@ export declare namespace RuleSettingParam {
          */
         msg?: string;
         /**
-         * Optional URL to direct users to additional information. If not set, the
-         * notification will open a block page.
+         * Defines an optional URL to direct users to additional information. If unset, the
+         * notification opens a block page.
          */
         support_url?: string;
     }
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     interface PayloadLog {
         /**
-         * Set to true to enable DLP payload logging for this rule.
+         * Enable DLP payload logging for this rule.
          */
         enabled?: boolean;
     }
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     interface Quarantine {
         /**
-         * Types of files to sandbox.
+         * Specify the types of files to sandbox.
          */
         file_types?: Array<'exe' | 'pdf' | 'doc' | 'docm' | 'docx' | 'rtf' | 'ppt' | 'pptx' | 'xls' | 'xlsm' | 'xlsx' | 'zip' | 'rar'>;
     }
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     interface Redirect {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
-         * If true, the path and query parameters from the original request will be
-         * appended to target_uri.
+         * Specify whether to append the path and query parameters from the original
+         * request to target_uri.
          */
         preserve_path_and_query?: boolean;
     }
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     interface ResolveDNSInternally {
         /**
-         * The fallback behavior to apply when the internal DNS response code is different
-         * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-         * 'AAAA' queries.
+         * Specify the fallback behavior to apply when the internal DNS response code
+         * differs from 'NOERROR' or when the response data contains only CNAME records for
+         * 'A' or 'AAAA' queries.
          */
         fallback?: 'none' | 'public_dns';
         /**
-         * The internal DNS view identifier that's passed to the internal DNS service.
+         * Specify the internal DNS view identifier to pass to the internal DNS service.
          */
         view_id?: string;
     }
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     interface UntrustedCERT {
         /**
-         * The action performed when an untrusted certificate is seen. The default action
-         * is an error with HTTP code 526.
+         * Defines the action performed when an untrusted certificate seen. The default
+         * action an error with HTTP code 526.
          */
         action?: 'pass_through' | 'block' | 'error';
     }
 }
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface Schedule {
     /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
+     * Specify the time intervals when the rule is active on Fridays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Fridays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     fri?: string;
     /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
+     * Specify the time intervals when the rule is active on Mondays, in the increasing
+     * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+     * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+     * this string, which may cause Terraform drift if a unformatted value is used.
      */
     mon?: string;
     /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
+     * Specify the time intervals when the rule is active on Saturdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Saturdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     sat?: string;
     /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
+     * Specify the time intervals when the rule is active on Sundays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Sundays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     sun?: string;
     /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
+     * Specify the time intervals when the rule is active on Thursdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Thursdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     thu?: string;
     /**
-     * The time zone the rule will be evaluated against. If a
+     * Specify the time zone for rule evaluation. When a
      * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
+     * is provided, Gateway always uses the current time for that time zone. When this
+     * parameter is omitted, Gateway uses the time zone determined from the user's IP
+     * address. Colo time zone is used when the user's IP address does not resolve to a
+     * location.
      */
     time_zone?: string;
     /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
+     * Specify the time intervals when the rule is active on Tuesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Tuesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     tue?: string;
     /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
+     * Specify the time intervals when the rule is active on Wednesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Wednesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     wed?: string;
 }
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface ScheduleParam {
     /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
+     * Specify the time intervals when the rule is active on Fridays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Fridays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     fri?: string;
     /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
+     * Specify the time intervals when the rule is active on Mondays, in the increasing
+     * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+     * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+     * this string, which may cause Terraform drift if a unformatted value is used.
      */
     mon?: string;
     /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
+     * Specify the time intervals when the rule is active on Saturdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Saturdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     sat?: string;
     /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
+     * Specify the time intervals when the rule is active on Sundays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Sundays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     sun?: string;
     /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
+     * Specify the time intervals when the rule is active on Thursdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Thursdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     thu?: string;
     /**
-     * The time zone the rule will be evaluated against. If a
+     * Specify the time zone for rule evaluation. When a
      * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
+     * is provided, Gateway always uses the current time for that time zone. When this
+     * parameter is omitted, Gateway uses the time zone determined from the user's IP
+     * address. Colo time zone is used when the user's IP address does not resolve to a
+     * location.
      */
     time_zone?: string;
     /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
+     * Specify the time intervals when the rule is active on Tuesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Tuesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     tue?: string;
     /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
+     * Specify the time intervals when the rule is active on Wednesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Wednesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     wed?: string;
 }
@@ -1148,93 +1219,95 @@ export interface RuleCreateParams {
      */
     account_id: string;
     /**
-     * Body param: The action to perform when the associated traffic, identity, and
-     * device posture expressions are either absent or evaluate to `true`.
+     * Body param: Specify the action to perform when the associated traffic, identity,
+     * and device posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * Body param: The name of the rule.
+     * Body param: Specify the rule name.
      */
     name: string;
     /**
-     * Body param: The description of the rule.
+     * Body param: Specify the rule description.
      */
     description?: string;
     /**
-     * Body param: The wirefilter expression used for device posture check matching.
-     * The API automatically formats and sanitizes this expression. This returns a
-     * normalized version that may differ from your input and cause Terraform state
-     * drift.
+     * Body param: Specify the wirefilter expression used for device posture check. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * Body param: True if the rule is enabled.
+     * Body param: Specify whether the rule is enabled.
      */
     enabled?: boolean;
     /**
-     * Body param: The expiration time stamp and default duration of a DNS policy.
-     * Takes precedence over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Body param: Defines the expiration time stamp and default duration of a DNS
+     * policy. Takes precedence over the policy's `schedule` configuration, if any.
+     * This does not apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: RuleCreateParams.Expiration | null;
     /**
-     * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-     * posture expressions.
+     * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+     * device posture expressions.
      */
     filters?: Array<GatewayFilterParam>;
     /**
-     * Body param: The wirefilter expression used for identity matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for identity matching. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * Body param: Precedence sets the order of your rules. Lower values indicate
-     * higher precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Body param: Set the order of your rules. Lower values indicate higher
+     * precedence. At each processing phase, evaluate applicable rules in ascending
+     * order of this value. Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence?: number;
     /**
-     * Body param: Additional settings that modify the rule's action.
+     * Body param: Set settings related to this rule. Each setting is only valid for
+     * specific rule types and can only be used with the appropriate selectors. If
+     * Terraform drift is observed in these setting values, verify that the setting is
+     * supported for the given rule type and that the API response reflects the
+     * requested value. If the API response returns sanitized or modified values that
+     * differ from the request, use the API-provided values in Terraform to ensure
+     * consistency.
      */
     rule_settings?: RuleSettingParam;
     /**
-     * Body param: The schedule for activating DNS policies. This does not apply to
-     * HTTP or network policies.
+     * Body param: Defines the schedule for activating DNS policies. Settable only for
+     * `dns` and `dns_resolver` rules.
      */
     schedule?: ScheduleParam | null;
     /**
-     * Body param: The wirefilter expression used for traffic matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic?: string;
 }
 export declare namespace RuleCreateParams {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;
@@ -1246,93 +1319,95 @@ export interface RuleUpdateParams {
      */
     account_id: string;
     /**
-     * Body param: The action to perform when the associated traffic, identity, and
-     * device posture expressions are either absent or evaluate to `true`.
+     * Body param: Specify the action to perform when the associated traffic, identity,
+     * and device posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * Body param: The name of the rule.
+     * Body param: Specify the rule name.
      */
     name: string;
     /**
-     * Body param: The description of the rule.
+     * Body param: Specify the rule description.
      */
     description?: string;
     /**
-     * Body param: The wirefilter expression used for device posture check matching.
-     * The API automatically formats and sanitizes this expression. This returns a
-     * normalized version that may differ from your input and cause Terraform state
-     * drift.
+     * Body param: Specify the wirefilter expression used for device posture check. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * Body param: True if the rule is enabled.
+     * Body param: Specify whether the rule is enabled.
      */
     enabled?: boolean;
     /**
-     * Body param: The expiration time stamp and default duration of a DNS policy.
-     * Takes precedence over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Body param: Defines the expiration time stamp and default duration of a DNS
+     * policy. Takes precedence over the policy's `schedule` configuration, if any.
+     * This does not apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: RuleUpdateParams.Expiration | null;
     /**
-     * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-     * posture expressions.
+     * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+     * device posture expressions.
      */
     filters?: Array<GatewayFilterParam>;
     /**
-     * Body param: The wirefilter expression used for identity matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for identity matching. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * Body param: Precedence sets the order of your rules. Lower values indicate
-     * higher precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Body param: Set the order of your rules. Lower values indicate higher
+     * precedence. At each processing phase, evaluate applicable rules in ascending
+     * order of this value. Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence?: number;
     /**
-     * Body param: Additional settings that modify the rule's action.
+     * Body param: Set settings related to this rule. Each setting is only valid for
+     * specific rule types and can only be used with the appropriate selectors. If
+     * Terraform drift is observed in these setting values, verify that the setting is
+     * supported for the given rule type and that the API response reflects the
+     * requested value. If the API response returns sanitized or modified values that
+     * differ from the request, use the API-provided values in Terraform to ensure
+     * consistency.
      */
     rule_settings?: RuleSettingParam;
     /**
-     * Body param: The schedule for activating DNS policies. This does not apply to
-     * HTTP or network policies.
+     * Body param: Defines the schedule for activating DNS policies. Settable only for
+     * `dns` and `dns_resolver` rules.
      */
     schedule?: ScheduleParam | null;
     /**
-     * Body param: The wirefilter expression used for traffic matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic?: string;
 }
 export declare namespace RuleUpdateParams {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;