cloudflare 5.1.0 → 6.0.0-beta.1

package/resources/zero-trust/access/applications/applications.d.ts

@@ -1109,11 +1109,11 @@ export declare namespace ApplicationSCIMConfig {
 /**
  * The application type.
  */
-export type ApplicationType = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+export type ApplicationType = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
 /**
  * The application type.
  */
-export type ApplicationTypeParam = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+export type ApplicationTypeParam = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
 export interface CORSHeaders {
     /**
      * Allows all HTTP request headers.
@@ -1222,7 +1222,6 @@ export interface OIDCSaaSApp {
      * The application client secret, only returned on POST request.
      */
     client_secret?: string;
-    created_at?: string;
     custom_claims?: Array<OIDCSaaSApp.CustomClaim>;
     /**
      * The OIDC flows supported by this application
@@ -1248,7 +1247,6 @@ export interface OIDCSaaSApp {
      * automatically enabled if refresh tokens are enabled
      */
     scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
-    updated_at?: string;
 }
 export declare namespace OIDCSaaSApp {
     interface CustomClaim {
@@ -1419,7 +1417,6 @@ export interface SAMLSaaSApp {
      * SAML assertion.
      */
     consumer_service_url?: string;
-    created_at?: string;
     custom_attributes?: Array<SAMLSaaSApp.CustomAttribute>;
     /**
      * The URL that the user will be redirected to after a successful login for IDP
@@ -1461,7 +1458,6 @@ export interface SAMLSaaSApp {
      * The endpoint where your SaaS application will send login requests.
      */
     sso_endpoint?: string;
-    updated_at?: string;
 }
 export declare namespace SAMLSaaSApp {
     interface CustomAttribute {
@@ -1854,7 +1850,7 @@ export type SelfHostedDomains = string;
  * A domain that Access will secure.
  */
 export type SelfHostedDomainsParam = string;
-export type ApplicationCreateResponse = ApplicationCreateResponse.SelfHostedApplication | ApplicationCreateResponse.SaaSApplication | ApplicationCreateResponse.BrowserSSHApplication | ApplicationCreateResponse.BrowserVNCApplication | ApplicationCreateResponse.AppLauncherApplication | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication | ApplicationCreateResponse.BrowserIsolationPermissionsApplication | ApplicationCreateResponse.BookmarkApplication | ApplicationCreateResponse.InfrastructureApplication | ApplicationCreateResponse.BrowserRdpApplication;
+export type ApplicationCreateResponse = ApplicationCreateResponse.SelfHostedApplication | ApplicationCreateResponse.SaaSApplication | ApplicationCreateResponse.BrowserSSHApplication | ApplicationCreateResponse.BrowserVNCApplication | ApplicationCreateResponse.AppLauncherApplication | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication | ApplicationCreateResponse.BrowserIsolationPermissionsApplication | ApplicationCreateResponse.GatewayIdentityProxyEndpointApplication | ApplicationCreateResponse.BookmarkApplication | ApplicationCreateResponse.InfrastructureApplication | ApplicationCreateResponse.BrowserRdpApplication;
 export declare namespace ApplicationCreateResponse {
     interface SelfHostedApplication {
         /**
@@ -1900,7 +1896,6 @@ export declare namespace ApplicationCreateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -1925,7 +1920,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2001,7 +1996,6 @@ export declare namespace ApplicationCreateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace SelfHostedApplication {
         /**
@@ -2017,10 +2011,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2046,6 +2036,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -2213,7 +2214,6 @@ export declare namespace ApplicationCreateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom pages that will be displayed when applicable for this application
          */
@@ -2242,7 +2242,6 @@ export declare namespace ApplicationCreateResponse {
          * The application type.
          */
         type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
     }
     namespace SaaSApplication {
         interface Policy {
@@ -2398,7 +2397,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -2433,7 +2432,6 @@ export declare namespace ApplicationCreateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -2458,7 +2456,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2534,7 +2532,6 @@ export declare namespace ApplicationCreateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserSSHApplication {
         /**
@@ -2550,10 +2547,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2579,6 +2572,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -2732,7 +2736,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -2767,7 +2771,6 @@ export declare namespace ApplicationCreateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -2792,7 +2795,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2868,7 +2871,6 @@ export declare namespace ApplicationCreateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserVNCApplication {
         /**
@@ -2884,10 +2886,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2913,6 +2911,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -3061,7 +3070,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -3088,7 +3097,6 @@ export declare namespace ApplicationCreateResponse {
          * The background color of the App Launcher page.
          */
         bg_color?: string;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -3135,7 +3143,6 @@ export declare namespace ApplicationCreateResponse {
          * Determines when to skip the App Launcher landing page.
          */
         skip_app_launcher_login_page?: boolean;
-        updated_at?: string;
     }
     namespace AppLauncherApplication {
         interface FooterLink {
@@ -3263,7 +3270,6 @@ export declare namespace ApplicationCreateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -3294,7 +3300,6 @@ export declare namespace ApplicationCreateResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace DeviceEnrollmentPermissionsApplication {
         interface Policy {
@@ -3387,7 +3392,6 @@ export declare namespace ApplicationCreateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -3418,7 +3422,6 @@ export declare namespace ApplicationCreateResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace BrowserIsolationPermissionsApplication {
         interface Policy {
@@ -3488,6 +3491,128 @@ export declare namespace ApplicationCreateResponse {
             updated_at?: string;
         }
     }
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * The custom pages that will be displayed when applicable for this application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
     interface BookmarkApplication {
         /**
          * UUID.
@@ -3501,7 +3626,6 @@ export declare namespace ApplicationCreateResponse {
          * Audience tag.
          */
         aud?: string;
-        created_at?: string;
         /**
          * The URL or domain of the bookmark.
          */
@@ -3523,7 +3647,6 @@ export declare namespace ApplicationCreateResponse {
          * The application type.
          */
         type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
     }
     interface InfrastructureApplication {
         target_criteria: Array<InfrastructureApplication.TargetCriterion>;
@@ -3539,13 +3662,11 @@ export declare namespace ApplicationCreateResponse {
          * Audience tag.
          */
         aud?: string;
-        created_at?: string;
         /**
          * The name of the application.
          */
         name?: string;
         policies?: Array<InfrastructureApplication.Policy>;
-        updated_at?: string;
     }
     namespace InfrastructureApplication {
         interface TargetCriterion {
@@ -3677,7 +3798,6 @@ export declare namespace ApplicationCreateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -3702,7 +3822,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -3778,7 +3898,6 @@ export declare namespace ApplicationCreateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserRdpApplication {
         interface TargetCriterion {
@@ -3811,10 +3930,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3840,6 +3955,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -3985,7 +4111,7 @@ export declare namespace ApplicationCreateResponse {
         }
     }
 }
-export type ApplicationUpdateResponse = ApplicationUpdateResponse.SelfHostedApplication | ApplicationUpdateResponse.SaaSApplication | ApplicationUpdateResponse.BrowserSSHApplication | ApplicationUpdateResponse.BrowserVNCApplication | ApplicationUpdateResponse.AppLauncherApplication | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication | ApplicationUpdateResponse.BookmarkApplication | ApplicationUpdateResponse.InfrastructureApplication | ApplicationUpdateResponse.BrowserRdpApplication;
+export type ApplicationUpdateResponse = ApplicationUpdateResponse.SelfHostedApplication | ApplicationUpdateResponse.SaaSApplication | ApplicationUpdateResponse.BrowserSSHApplication | ApplicationUpdateResponse.BrowserVNCApplication | ApplicationUpdateResponse.AppLauncherApplication | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication | ApplicationUpdateResponse.GatewayIdentityProxyEndpointApplication | ApplicationUpdateResponse.BookmarkApplication | ApplicationUpdateResponse.InfrastructureApplication | ApplicationUpdateResponse.BrowserRdpApplication;
 export declare namespace ApplicationUpdateResponse {
     interface SelfHostedApplication {
         /**
@@ -4031,7 +4157,6 @@ export declare namespace ApplicationUpdateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -4056,7 +4181,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4132,7 +4257,6 @@ export declare namespace ApplicationUpdateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace SelfHostedApplication {
         /**
@@ -4148,10 +4272,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -4177,6 +4297,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -4344,7 +4475,6 @@ export declare namespace ApplicationUpdateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom pages that will be displayed when applicable for this application
          */
@@ -4373,7 +4503,6 @@ export declare namespace ApplicationUpdateResponse {
          * The application type.
          */
         type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
     }
     namespace SaaSApplication {
         interface Policy {
@@ -4529,7 +4658,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -4564,7 +4693,6 @@ export declare namespace ApplicationUpdateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -4589,7 +4717,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4665,7 +4793,6 @@ export declare namespace ApplicationUpdateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserSSHApplication {
         /**
@@ -4681,10 +4808,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -4710,6 +4833,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -4863,7 +4997,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -4898,7 +5032,6 @@ export declare namespace ApplicationUpdateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -4923,7 +5056,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4999,7 +5132,6 @@ export declare namespace ApplicationUpdateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserVNCApplication {
         /**
@@ -5015,10 +5147,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5044,6 +5172,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -5192,7 +5331,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -5219,7 +5358,6 @@ export declare namespace ApplicationUpdateResponse {
          * The background color of the App Launcher page.
          */
         bg_color?: string;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -5266,7 +5404,6 @@ export declare namespace ApplicationUpdateResponse {
          * Determines when to skip the App Launcher landing page.
          */
         skip_app_launcher_login_page?: boolean;
-        updated_at?: string;
     }
     namespace AppLauncherApplication {
         interface FooterLink {
@@ -5394,7 +5531,6 @@ export declare namespace ApplicationUpdateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -5425,7 +5561,6 @@ export declare namespace ApplicationUpdateResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace DeviceEnrollmentPermissionsApplication {
         interface Policy {
@@ -5518,7 +5653,6 @@ export declare namespace ApplicationUpdateResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -5549,7 +5683,6 @@ export declare namespace ApplicationUpdateResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace BrowserIsolationPermissionsApplication {
         interface Policy {
@@ -5619,64 +5752,182 @@ export declare namespace ApplicationUpdateResponse {
             updated_at?: string;
         }
     }
-    interface BookmarkApplication {
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID.
          */
         id?: string;
         /**
-         * Displays the application in the App Launcher.
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        app_launcher_visible?: boolean;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
         aud?: string;
-        created_at?: string;
-        /**
-         * The URL or domain of the bookmark.
-         */
-        domain?: string;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
-        /**
-         * The name of the application.
-         */
-        name?: string;
         /**
-         * The tags you want assigned to an application. Tags are used to filter
-         * applications in the App Launcher dashboard.
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
          */
-        tags?: Array<string>;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
          */
-        type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
-    }
-    interface InfrastructureApplication {
-        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        custom_deny_url?: string;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
          */
-        type: ApplicationsAPI.ApplicationType;
+        custom_non_identity_deny_url?: string;
         /**
-         * UUID.
+         * The custom pages that will be displayed when applicable for this application
          */
-        id?: string;
+        custom_pages?: Array<string>;
         /**
-         * Audience tag.
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
          */
-        aud?: string;
-        created_at?: string;
+        domain?: string;
         /**
          * The name of the application.
          */
         name?: string;
-        policies?: Array<InfrastructureApplication.Policy>;
-        updated_at?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
+    interface BookmarkApplication {
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * The tags you want assigned to an application. Tags are used to filter
+         * applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * The application type.
+         */
+        type?: ApplicationsAPI.ApplicationType;
+    }
+    interface InfrastructureApplication {
+        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<InfrastructureApplication.Policy>;
     }
     namespace InfrastructureApplication {
         interface TargetCriterion {
@@ -5808,7 +6059,6 @@ export declare namespace ApplicationUpdateResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -5833,7 +6083,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -5909,7 +6159,6 @@ export declare namespace ApplicationUpdateResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserRdpApplication {
         interface TargetCriterion {
@@ -5942,10 +6191,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5971,6 +6216,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6116,7 +6372,7 @@ export declare namespace ApplicationUpdateResponse {
         }
     }
 }
-export type ApplicationListResponse = ApplicationListResponse.SelfHostedApplication | ApplicationListResponse.SaaSApplication | ApplicationListResponse.BrowserSSHApplication | ApplicationListResponse.BrowserVNCApplication | ApplicationListResponse.AppLauncherApplication | ApplicationListResponse.DeviceEnrollmentPermissionsApplication | ApplicationListResponse.BrowserIsolationPermissionsApplication | ApplicationListResponse.BookmarkApplication | ApplicationListResponse.InfrastructureApplication | ApplicationListResponse.BrowserRdpApplication;
+export type ApplicationListResponse = ApplicationListResponse.SelfHostedApplication | ApplicationListResponse.SaaSApplication | ApplicationListResponse.BrowserSSHApplication | ApplicationListResponse.BrowserVNCApplication | ApplicationListResponse.AppLauncherApplication | ApplicationListResponse.DeviceEnrollmentPermissionsApplication | ApplicationListResponse.BrowserIsolationPermissionsApplication | ApplicationListResponse.GatewayIdentityProxyEndpointApplication | ApplicationListResponse.BookmarkApplication | ApplicationListResponse.InfrastructureApplication | ApplicationListResponse.BrowserRdpApplication;
 export declare namespace ApplicationListResponse {
     interface SelfHostedApplication {
         /**
@@ -6162,7 +6418,6 @@ export declare namespace ApplicationListResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -6187,7 +6442,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -6263,7 +6518,6 @@ export declare namespace ApplicationListResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace SelfHostedApplication {
         /**
@@ -6279,10 +6533,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6308,6 +6558,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6475,7 +6736,6 @@ export declare namespace ApplicationListResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom pages that will be displayed when applicable for this application
          */
@@ -6504,7 +6764,6 @@ export declare namespace ApplicationListResponse {
          * The application type.
          */
         type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
     }
     namespace SaaSApplication {
         interface Policy {
@@ -6660,7 +6919,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -6695,7 +6954,6 @@ export declare namespace ApplicationListResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -6720,7 +6978,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -6796,7 +7054,6 @@ export declare namespace ApplicationListResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserSSHApplication {
         /**
@@ -6812,10 +7069,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6841,6 +7094,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6994,7 +7258,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -7029,7 +7293,6 @@ export declare namespace ApplicationListResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -7054,7 +7317,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -7130,7 +7393,6 @@ export declare namespace ApplicationListResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserVNCApplication {
         /**
@@ -7146,10 +7408,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -7175,6 +7433,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -7323,7 +7592,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -7350,7 +7619,6 @@ export declare namespace ApplicationListResponse {
          * The background color of the App Launcher page.
          */
         bg_color?: string;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -7397,7 +7665,6 @@ export declare namespace ApplicationListResponse {
          * Determines when to skip the App Launcher landing page.
          */
         skip_app_launcher_login_page?: boolean;
-        updated_at?: string;
     }
     namespace AppLauncherApplication {
         interface FooterLink {
@@ -7525,7 +7792,6 @@ export declare namespace ApplicationListResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -7556,7 +7822,6 @@ export declare namespace ApplicationListResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace DeviceEnrollmentPermissionsApplication {
         interface Policy {
@@ -7649,7 +7914,6 @@ export declare namespace ApplicationListResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -7680,7 +7944,6 @@ export declare namespace ApplicationListResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace BrowserIsolationPermissionsApplication {
         interface Policy {
@@ -7750,94 +8013,212 @@ export declare namespace ApplicationListResponse {
             updated_at?: string;
         }
     }
-    interface BookmarkApplication {
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID.
          */
         id?: string;
         /**
-         * Displays the application in the App Launcher.
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        app_launcher_visible?: boolean;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
         aud?: string;
-        created_at?: string;
-        /**
-         * The URL or domain of the bookmark.
-         */
-        domain?: string;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
         /**
-         * The name of the application.
-         */
-        name?: string;
-        /**
-         * The tags you want assigned to an application. Tags are used to filter
-         * applications in the App Launcher dashboard.
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
          */
-        tags?: Array<string>;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
          */
-        type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
-    }
-    interface InfrastructureApplication {
-        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        custom_deny_url?: string;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
          */
-        type: ApplicationsAPI.ApplicationType;
+        custom_non_identity_deny_url?: string;
         /**
-         * UUID.
+         * The custom pages that will be displayed when applicable for this application
          */
-        id?: string;
+        custom_pages?: Array<string>;
         /**
-         * Audience tag.
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
          */
-        aud?: string;
-        created_at?: string;
+        domain?: string;
         /**
          * The name of the application.
          */
         name?: string;
-        policies?: Array<InfrastructureApplication.Policy>;
-        updated_at?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
     }
-    namespace InfrastructureApplication {
-        interface TargetCriterion {
-            /**
-             * The port that the targets use for the chosen communication protocol. A port
-             * cannot be assigned to multiple protocols.
-             */
-            port: number;
-            /**
-             * The communication protocol your application secures.
-             */
-            protocol: 'SSH';
-            /**
-             * Contains a map of target attribute keys to target attribute values.
-             */
-            target_attributes: {
-                [key: string]: Array<string>;
-            };
-        }
+    namespace GatewayIdentityProxyEndpointApplication {
         interface Policy {
             /**
              * The UUID of the policy
              */
             id?: string;
             /**
-             * The rules that define how users may connect to the targets secured by your
-             * application.
+             * Administrators who can approve a temporary authentication request.
              */
-            connection_rules?: Policy.ConnectionRules;
-            created_at?: string;
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
+    interface BookmarkApplication {
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * The tags you want assigned to an application. Tags are used to filter
+         * applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * The application type.
+         */
+        type?: ApplicationsAPI.ApplicationType;
+    }
+    interface InfrastructureApplication {
+        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<InfrastructureApplication.Policy>;
+    }
+    namespace InfrastructureApplication {
+        interface TargetCriterion {
+            /**
+             * The port that the targets use for the chosen communication protocol. A port
+             * cannot be assigned to multiple protocols.
+             */
+            port: number;
+            /**
+             * The communication protocol your application secures.
+             */
+            protocol: 'SSH';
+            /**
+             * Contains a map of target attribute keys to target attribute values.
+             */
+            target_attributes: {
+                [key: string]: Array<string>;
+            };
+        }
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The rules that define how users may connect to the targets secured by your
+             * application.
+             */
+            connection_rules?: Policy.ConnectionRules;
+            created_at?: string;
             /**
              * The action Access will take if a user matches this policy. Infrastructure
              * application policies can only use the Allow action.
@@ -7939,7 +8320,6 @@ export declare namespace ApplicationListResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -7964,7 +8344,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8040,7 +8420,6 @@ export declare namespace ApplicationListResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserRdpApplication {
         interface TargetCriterion {
@@ -8073,10 +8452,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8102,6 +8477,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -8253,7 +8639,7 @@ export interface ApplicationDeleteResponse {
      */
     id?: string;
 }
-export type ApplicationGetResponse = ApplicationGetResponse.SelfHostedApplication | ApplicationGetResponse.SaaSApplication | ApplicationGetResponse.BrowserSSHApplication | ApplicationGetResponse.BrowserVNCApplication | ApplicationGetResponse.AppLauncherApplication | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication | ApplicationGetResponse.BrowserIsolationPermissionsApplication | ApplicationGetResponse.BookmarkApplication | ApplicationGetResponse.InfrastructureApplication | ApplicationGetResponse.BrowserRdpApplication;
+export type ApplicationGetResponse = ApplicationGetResponse.SelfHostedApplication | ApplicationGetResponse.SaaSApplication | ApplicationGetResponse.BrowserSSHApplication | ApplicationGetResponse.BrowserVNCApplication | ApplicationGetResponse.AppLauncherApplication | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication | ApplicationGetResponse.BrowserIsolationPermissionsApplication | ApplicationGetResponse.GatewayIdentityProxyEndpointApplication | ApplicationGetResponse.BookmarkApplication | ApplicationGetResponse.InfrastructureApplication | ApplicationGetResponse.BrowserRdpApplication;
 export declare namespace ApplicationGetResponse {
     interface SelfHostedApplication {
         /**
@@ -8299,7 +8685,6 @@ export declare namespace ApplicationGetResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -8324,7 +8709,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8400,7 +8785,6 @@ export declare namespace ApplicationGetResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace SelfHostedApplication {
         /**
@@ -8416,10 +8800,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8445,6 +8825,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -8612,7 +9003,6 @@ export declare namespace ApplicationGetResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom pages that will be displayed when applicable for this application
          */
@@ -8641,7 +9031,6 @@ export declare namespace ApplicationGetResponse {
          * The application type.
          */
         type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
     }
     namespace SaaSApplication {
         interface Policy {
@@ -8797,7 +9186,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -8832,7 +9221,6 @@ export declare namespace ApplicationGetResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -8857,7 +9245,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8933,7 +9321,6 @@ export declare namespace ApplicationGetResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserSSHApplication {
         /**
@@ -8949,10 +9336,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8978,6 +9361,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -9131,7 +9525,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -9166,7 +9560,6 @@ export declare namespace ApplicationGetResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -9191,7 +9584,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -9267,7 +9660,6 @@ export declare namespace ApplicationGetResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserVNCApplication {
         /**
@@ -9283,10 +9675,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -9312,6 +9700,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -9460,7 +9859,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -9487,7 +9886,6 @@ export declare namespace ApplicationGetResponse {
          * The background color of the App Launcher page.
          */
         bg_color?: string;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -9534,7 +9932,6 @@ export declare namespace ApplicationGetResponse {
          * Determines when to skip the App Launcher landing page.
          */
         skip_app_launcher_login_page?: boolean;
-        updated_at?: string;
     }
     namespace AppLauncherApplication {
         interface FooterLink {
@@ -9662,7 +10059,6 @@ export declare namespace ApplicationGetResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -9693,7 +10089,6 @@ export declare namespace ApplicationGetResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace DeviceEnrollmentPermissionsApplication {
         interface Policy {
@@ -9786,7 +10181,6 @@ export declare namespace ApplicationGetResponse {
          * login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        created_at?: string;
         /**
          * The custom URL a user is redirected to when they are denied access to the
          * application when failing identity-based rules.
@@ -9817,7 +10211,6 @@ export declare namespace ApplicationGetResponse {
          * s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        updated_at?: string;
     }
     namespace BrowserIsolationPermissionsApplication {
         interface Policy {
@@ -9887,76 +10280,194 @@ export declare namespace ApplicationGetResponse {
             updated_at?: string;
         }
     }
-    interface BookmarkApplication {
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID.
          */
         id?: string;
         /**
-         * Displays the application in the App Launcher.
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        app_launcher_visible?: boolean;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
         aud?: string;
-        created_at?: string;
-        /**
-         * The URL or domain of the bookmark.
-         */
-        domain?: string;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
-        /**
-         * The name of the application.
-         */
-        name?: string;
         /**
-         * The tags you want assigned to an application. Tags are used to filter
-         * applications in the App Launcher dashboard.
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
          */
-        tags?: Array<string>;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
          */
-        type?: ApplicationsAPI.ApplicationType;
-        updated_at?: string;
-    }
-    interface InfrastructureApplication {
-        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        custom_deny_url?: string;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
          */
-        type: ApplicationsAPI.ApplicationType;
+        custom_non_identity_deny_url?: string;
         /**
-         * UUID.
+         * The custom pages that will be displayed when applicable for this application
          */
-        id?: string;
+        custom_pages?: Array<string>;
         /**
-         * Audience tag.
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
          */
-        aud?: string;
-        created_at?: string;
+        domain?: string;
         /**
          * The name of the application.
          */
         name?: string;
-        policies?: Array<InfrastructureApplication.Policy>;
-        updated_at?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
     }
-    namespace InfrastructureApplication {
-        interface TargetCriterion {
+    namespace GatewayIdentityProxyEndpointApplication {
+        interface Policy {
             /**
-             * The port that the targets use for the chosen communication protocol. A port
-             * cannot be assigned to multiple protocols.
+             * The UUID of the policy
              */
-            port: number;
+            id?: string;
             /**
-             * The communication protocol your application secures.
+             * Administrators who can approve a temporary authentication request.
              */
-            protocol: 'SSH';
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
+    interface BookmarkApplication {
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * The tags you want assigned to an application. Tags are used to filter
+         * applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * The application type.
+         */
+        type?: ApplicationsAPI.ApplicationType;
+    }
+    interface InfrastructureApplication {
+        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<InfrastructureApplication.Policy>;
+    }
+    namespace InfrastructureApplication {
+        interface TargetCriterion {
+            /**
+             * The port that the targets use for the chosen communication protocol. A port
+             * cannot be assigned to multiple protocols.
+             */
+            port: number;
+            /**
+             * The communication protocol your application secures.
+             */
+            protocol: 'SSH';
             /**
              * Contains a map of target attribute keys to target attribute values.
              */
@@ -10076,7 +10587,6 @@ export declare namespace ApplicationGetResponse {
          */
         auto_redirect_to_identity?: boolean;
         cors_headers?: ApplicationsAPI.CORSHeaders;
-        created_at?: string;
         /**
          * The custom error message shown to a user when they are denied access to the
          * application.
@@ -10101,7 +10611,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -10177,7 +10687,6 @@ export declare namespace ApplicationGetResponse {
          * applications in the App Launcher dashboard.
          */
         tags?: Array<string>;
-        updated_at?: string;
     }
     namespace BrowserRdpApplication {
         interface TargetCriterion {
@@ -10210,10 +10719,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10239,6 +10744,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -10385,7 +10901,7 @@ export declare namespace ApplicationGetResponse {
     }
 }
 export type ApplicationRevokeTokensResponse = unknown;
-export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVNCApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.AccessBookmarkProps | ApplicationCreateParams.InfrastructureApplication | ApplicationCreateParams.BrowserRdpApplication;
+export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVNCApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.GatewayIdentityProxyEndpointApplication | ApplicationCreateParams.AccessBookmarkProps | ApplicationCreateParams.InfrastructureApplication | ApplicationCreateParams.BrowserRdpApplication;
 export declare namespace ApplicationCreateParams {
     interface SelfHostedApplication {
         /**
@@ -10462,7 +10978,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -10559,10 +11075,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10588,6 +11100,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -10925,7 +11448,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -10991,7 +11514,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -11088,10 +11611,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11117,6 +11636,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11258,7 +11788,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -11324,7 +11854,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -11421,10 +11951,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11450,6 +11976,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11561,32 +12098,201 @@ export declare namespace ApplicationCreateParams {
                 scheme: 'access_service_token';
             }
             /**
-             * Attributes for configuring Access Service Token authentication scheme for SCIM
-             * provisioning to an application.
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
+    interface AppLauncherApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdPsParam>;
+        /**
+         * Body param: The image URL of the logo shown in the App Launcher header.
+         */
+        app_launcher_logo_url?: string;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The background color of the App Launcher page.
+         */
+        bg_color?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: The links in the App Launcher footer.
+         */
+        footer_links?: Array<AppLauncherApplication.FooterLink>;
+        /**
+         * Body param: The background color of the App Launcher header.
+         */
+        header_bg_color?: string;
+        /**
+         * Body param: The design of the App Launcher landing page shown to users when they
+         * log in.
+         */
+        landing_page_design?: AppLauncherApplication.LandingPageDesign;
+        /**
+         * Body param: The policies that Access applies to the application, in ascending
+         * order of precedence. Items can reference existing policies or create new
+         * policies exclusive to the application.
+         */
+        policies?: Array<AppLauncherApplication.AccessAppPolicyLink | string | AppLauncherApplication.UnionMember2>;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Determines when to skip the App Launcher landing page.
+         */
+        skip_app_launcher_login_page?: boolean;
+    }
+    namespace AppLauncherApplication {
+        interface FooterLink {
+            /**
+             * The hypertext in the footer link.
+             */
+            name: string;
+            /**
+             * the hyperlink in the footer link.
+             */
+            url: string;
+        }
+        /**
+         * The design of the App Launcher landing page shown to users when they log in.
+         */
+        interface LandingPageDesign {
+            /**
+             * The background color of the log in button on the landing page.
+             */
+            button_color?: string;
+            /**
+             * The color of the text in the log in button on the landing page.
+             */
+            button_text_color?: string;
+            /**
+             * The URL of the image shown on the landing page.
+             */
+            image_url?: string;
+            /**
+             * The message shown on the landing page.
+             */
+            message?: string;
+            /**
+             * The title shown on the landing page.
+             */
+            title?: string;
+        }
+        /**
+         * A JSON that links a reusable policy to an application.
+         */
+        interface AccessAppPolicyLink {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+        }
+        interface UnionMember2 {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
              */
-            interface AccessSCIMConfigAuthenticationAccessServiceToken {
-                /**
-                 * Client ID of the Access service token used to authenticate with the remote
-                 * service.
-                 */
-                client_id: string;
-                /**
-                 * Client secret of the Access service token used to authenticate with the remote
-                 * service.
-                 */
-                client_secret: string;
-                /**
-                 * The authentication scheme to use when making SCIM requests to this application.
-                 */
-                scheme: 'access_service_token';
-            }
+            session_duration?: string;
         }
     }
-    interface AppLauncherApplication {
+    interface DeviceEnrollmentPermissionsApplication {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -11602,19 +12308,11 @@ export declare namespace ApplicationCreateParams {
          * application. Defaults to all IdPs configured in your account.
          */
         allowed_idps?: Array<AllowedIdPsParam>;
-        /**
-         * Body param: The image URL of the logo shown in the App Launcher header.
-         */
-        app_launcher_logo_url?: string;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        /**
-         * Body param: The background color of the App Launcher page.
-         */
-        bg_color?: string;
         /**
          * Body param: The custom URL a user is redirected to when they are denied access
          * to the application when failing identity-based rules.
@@ -11630,72 +12328,20 @@ export declare namespace ApplicationCreateParams {
          * application
          */
         custom_pages?: Array<string>;
-        /**
-         * Body param: The links in the App Launcher footer.
-         */
-        footer_links?: Array<AppLauncherApplication.FooterLink>;
-        /**
-         * Body param: The background color of the App Launcher header.
-         */
-        header_bg_color?: string;
-        /**
-         * Body param: The design of the App Launcher landing page shown to users when they
-         * log in.
-         */
-        landing_page_design?: AppLauncherApplication.LandingPageDesign;
         /**
          * Body param: The policies that Access applies to the application, in ascending
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<AppLauncherApplication.AccessAppPolicyLink | string | AppLauncherApplication.UnionMember2>;
+        policies?: Array<DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink | string | DeviceEnrollmentPermissionsApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
          * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        /**
-         * Body param: Determines when to skip the App Launcher landing page.
-         */
-        skip_app_launcher_login_page?: boolean;
     }
-    namespace AppLauncherApplication {
-        interface FooterLink {
-            /**
-             * The hypertext in the footer link.
-             */
-            name: string;
-            /**
-             * the hyperlink in the footer link.
-             */
-            url: string;
-        }
-        /**
-         * The design of the App Launcher landing page shown to users when they log in.
-         */
-        interface LandingPageDesign {
-            /**
-             * The background color of the log in button on the landing page.
-             */
-            button_color?: string;
-            /**
-             * The color of the text in the log in button on the landing page.
-             */
-            button_text_color?: string;
-            /**
-             * The URL of the image shown on the landing page.
-             */
-            image_url?: string;
-            /**
-             * The message shown on the landing page.
-             */
-            message?: string;
-            /**
-             * The title shown on the landing page.
-             */
-            title?: string;
-        }
+    namespace DeviceEnrollmentPermissionsApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11751,7 +12397,7 @@ export declare namespace ApplicationCreateParams {
             session_duration?: string;
         }
     }
-    interface DeviceEnrollmentPermissionsApplication {
+    interface BrowserIsolationPermissionsApplication {
         /**
          * Body param: The application type.
          */
@@ -11796,7 +12442,7 @@ export declare namespace ApplicationCreateParams {
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink | string | DeviceEnrollmentPermissionsApplication.UnionMember2>;
+        policies?: Array<BrowserIsolationPermissionsApplication.AccessAppPolicyLink | string | BrowserIsolationPermissionsApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -11804,7 +12450,7 @@ export declare namespace ApplicationCreateParams {
          */
         session_duration?: string;
     }
-    namespace DeviceEnrollmentPermissionsApplication {
+    namespace BrowserIsolationPermissionsApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11860,7 +12506,7 @@ export declare namespace ApplicationCreateParams {
             session_duration?: string;
         }
     }
-    interface BrowserIsolationPermissionsApplication {
+    interface GatewayIdentityProxyEndpointApplication {
         /**
          * Body param: The application type.
          */
@@ -11900,12 +12546,21 @@ export declare namespace ApplicationCreateParams {
          * application
          */
         custom_pages?: Array<string>;
+        /**
+         * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+         * followed by .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
         /**
          * Body param: The policies that Access applies to the application, in ascending
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<BrowserIsolationPermissionsApplication.AccessAppPolicyLink | string | BrowserIsolationPermissionsApplication.UnionMember2>;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink | string | GatewayIdentityProxyEndpointApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -11913,7 +12568,7 @@ export declare namespace ApplicationCreateParams {
          */
         session_duration?: string;
     }
-    namespace BrowserIsolationPermissionsApplication {
+    namespace GatewayIdentityProxyEndpointApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -12192,7 +12847,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -12306,10 +12961,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -12335,6 +12986,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -12468,7 +13130,7 @@ export declare namespace ApplicationCreateParams {
         }
     }
 }
-export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVNCApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.AccessBookmarkProps | ApplicationUpdateParams.InfrastructureApplication | ApplicationUpdateParams.BrowserRdpApplication;
+export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVNCApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.GatewayIdentityProxyEndpointApplication | ApplicationUpdateParams.AccessBookmarkProps | ApplicationUpdateParams.InfrastructureApplication | ApplicationUpdateParams.BrowserRdpApplication;
 export declare namespace ApplicationUpdateParams {
     interface SelfHostedApplication {
         /**
@@ -12545,7 +13207,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -12642,10 +13304,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -12671,6 +13329,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -13008,7 +13677,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13074,7 +13743,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -13171,10 +13840,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13200,6 +13865,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -13341,7 +14017,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13407,7 +14083,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -13504,10 +14180,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13533,6 +14205,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -13669,7 +14352,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -14052,6 +14735,124 @@ export declare namespace ApplicationUpdateParams {
             session_duration?: string;
         }
     }
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: ApplicationTypeParam;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdPsParam>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+         * followed by .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: The policies that Access applies to the application, in ascending
+         * order of precedence. Items can reference existing policies or create new
+         * policies exclusive to the application.
+         */
+        policies?: Array<GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink | string | GatewayIdentityProxyEndpointApplication.UnionMember2>;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        /**
+         * A JSON that links a reusable policy to an application.
+         */
+        interface AccessAppPolicyLink {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+        }
+        interface UnionMember2 {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+        }
+    }
     interface AccessBookmarkProps {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14275,7 +15076,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -14389,10 +15190,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14418,6 +15215,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -14583,6 +15391,10 @@ export interface ApplicationListParams extends V4PagePaginationArrayParams {
      * Query param: Search for apps by other listed query parameters.
      */
     search?: string;
+    /**
+     * Query param: Target Criteria attributes in key=value format.
+     */
+    target_attributes?: string;
 }
 export interface ApplicationDeleteParams {
     /**