cloudflare 5.1.0 → 6.0.0-beta.1

package/resources/zero-trust/gateway/rules.d.ts

@@ -4,7 +4,7 @@ import * as RulesAPI from "./rules.js";
 import { SinglePage } from "../../../pagination.js";
 export declare class Rules extends APIResource {
     /**
-     * Creates a new Zero Trust Gateway rule.
+     * Create a new Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -18,7 +18,7 @@ export declare class Rules extends APIResource {
      */
     create(params: RuleCreateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Updates a configured Zero Trust Gateway rule.
+     * Update a configured Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -35,7 +35,7 @@ export declare class Rules extends APIResource {
      */
     update(ruleId: string, params: RuleUpdateParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Fetches the Zero Trust Gateway rules for an account.
+     * List Zero Trust Gateway rules for an account.
      *
      * @example
      * ```ts
@@ -49,7 +49,7 @@ export declare class Rules extends APIResource {
      */
     list(params: RuleListParams, options?: Core.RequestOptions): Core.PagePromise<GatewayRulesSinglePage, GatewayRule>;
     /**
-     * Deletes a Zero Trust Gateway rule.
+     * Delete a Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -61,7 +61,7 @@ export declare class Rules extends APIResource {
      */
     delete(ruleId: string, params: RuleDeleteParams, options?: Core.RequestOptions): Core.APIPromise<RuleDeleteResponse>;
     /**
-     * Fetches a single Zero Trust Gateway rule.
+     * Get a single Zero Trust Gateway rule.
      *
      * @example
      * ```ts
@@ -74,11 +74,24 @@ export declare class Rules extends APIResource {
      */
     get(ruleId: string, params: RuleGetParams, options?: Core.RequestOptions): Core.APIPromise<GatewayRule>;
     /**
-     * Resets the expiration of a Zero Trust Gateway Rule if its duration has elapsed
-     * and it has a default duration.
+     * List Zero Trust Gateway rules for the parent account of an account in the MSP
+     * configuration.
      *
-     * The Zero Trust Gateway Rule must have values for both `expiration.expires_at`
-     * and `expiration.duration`.
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const gatewayRule of client.zeroTrust.gateway.rules.listTenant(
+     *   { account_id: '699d98642c564d2e855e9661899b7252' },
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    listTenant(params: RuleListTenantParams, options?: Core.RequestOptions): Core.PagePromise<GatewayRulesSinglePage, GatewayRule>;
+    /**
+     * Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and
+     * it has a default duration. The Zero Trust Gateway Rule must have values for both
+     * `expiration.expires_at` and `expiration.duration`.
      *
      * @example
      * ```ts
@@ -95,364 +108,394 @@ export declare class GatewayRulesSinglePage extends SinglePage<GatewayRule> {
 }
 export interface DNSResolverSettingsV4 {
     /**
-     * IPv4 address of upstream resolver.
+     * Specify the IPv4 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV4Param {
     /**
-     * IPv4 address of upstream resolver.
+     * Specify the IPv4 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV6 {
     /**
-     * IPv6 address of upstream resolver.
+     * Specify the IPv6 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 export interface DNSResolverSettingsV6Param {
     /**
-     * IPv6 address of upstream resolver.
+     * Specify the IPv6 address of the upstream resolver.
      */
     ip: string;
     /**
-     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+     * Specify a port number to use for the upstream resolver. Defaults to 53 if
+     * unspecified.
      */
     port?: number;
     /**
-     * Whether to connect to this resolver over a private network. Must be set when
-     * vnet_id is set.
+     * Indicate whether to connect to this resolver over a private network. Must set
+     * when vnet_id set.
      */
     route_through_private_network?: boolean;
     /**
-     * Optionally specify a virtual network for this resolver. Uses default virtual
+     * Specify an optional virtual network for this resolver. Uses default virtual
      * network id if omitted.
      */
     vnet_id?: string;
 }
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilterParam = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 export interface GatewayRule {
     /**
-     * The action to perform when the associated traffic, identity, and device posture
-     * expressions are either absent or evaluate to `true`.
+     * Specify the action to perform when the associated traffic, identity, and device
+     * posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * True if the rule is enabled.
+     * Specify whether the rule is enabled.
      */
     enabled: boolean;
     /**
-     * The protocol or layer to evaluate the traffic, identity, and device. posture
-     * expressions.
+     * Specify the protocol or layer to evaluate the traffic, identity, and device
+     * posture expressions. Can only contain a single value.
      */
     filters: Array<GatewayFilter>;
     /**
-     * The name of the rule.
+     * Specify the rule name.
      */
     name: string;
     /**
-     * Precedence sets the order of your rules. Lower values indicate higher
-     * precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Set the order of your rules. Lower values indicate higher precedence. At each
+     * processing phase, evaluate applicable rules in ascending order of this value.
+     * Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence: number;
     /**
-     * The wirefilter expression used for traffic matching. The API automatically
-     * formats and sanitizes this expression. This returns a normalized version that
-     * may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic: string;
     /**
-     * The API resource UUID.
+     * Identify the API resource with a UUID.
      */
     id?: string;
     created_at?: string;
     /**
-     * Date of deletion, if any.
+     * Indicate the date of deletion, if any.
      */
     deleted_at?: string | null;
     /**
-     * The description of the rule.
+     * Specify the rule description.
      */
     description?: string;
     /**
-     * The wirefilter expression used for device posture check matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for device posture check. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: GatewayRule.Expiration | null;
     /**
-     * The wirefilter expression used for identity matching. The API automatically
-     * formats and sanitizes this expression. This returns a normalized version that
-     * may differ from your input and cause Terraform state drift.
+     * Specify the wirefilter expression used for identity matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * The rule cannot be shared via the Orgs API.
-     */
-    not_sharable?: boolean;
-    /**
-     * The rule was shared via the Orgs API and cannot be edited by the current
-     * account.
+     * Indicate that this rule is shared via the Orgs API and read only.
      */
     read_only?: boolean;
     /**
-     * Additional settings that modify the rule's action.
+     * Defines settings for this rule. Settings apply only to specific rule types and
+     * must use compatible selectors. If Terraform detects drift, confirm the setting
+     * supports your rule type and check whether the API modifies the value. Use
+     * API-returned values in your configuration to prevent drift.
      */
     rule_settings?: RuleSetting;
     /**
-     * The schedule for activating DNS policies. This does not apply to HTTP or network
-     * policies.
+     * Defines the schedule for activating DNS policies. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     schedule?: Schedule | null;
     /**
-     * account tag of account that created the rule.
+     * Indicate that this rule is sharable via the Orgs API.
+     */
+    sharable?: boolean;
+    /**
+     * Provide the account tag of the account that created the rule.
      */
     source_account?: string;
     updated_at?: string;
     /**
-     * version number of the rule.
+     * Indicate the version number of the rule(read-only).
      */
     version?: number;
     /**
-     * Warning for a misconfigured rule, if any.
+     * Indicate a warning for a misconfigured rule, if any.
      */
     warning_status?: string | null;
 }
 export declare namespace GatewayRule {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;
         /**
-         * Whether the policy has expired.
+         * Indicates whether the policy is expired.
          */
         expired?: boolean;
     }
 }
 /**
- * Additional settings that modify the rule's action.
+ * Defines settings for this rule. Settings apply only to specific rule types and
+ * must use compatible selectors. If Terraform detects drift, confirm the setting
+ * supports your rule type and check whether the API modifies the value. Use
+ * API-returned values in your configuration to prevent drift.
  */
 export interface RuleSetting {
     /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
+     * Add custom headers to allowed requests as key-value pairs. Use header names as
+     * keys that map to arrays of header values. Settable only for `http` rules with
+     * the action set to `allow`.
      */
     add_headers?: {
         [key: string]: Array<string>;
     } | null;
     /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
+     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+     * this. this rule. Settable for all types of rules.
      */
     allow_child_bypass?: boolean | null;
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     audit_ssh?: RuleSetting.AuditSSH | null;
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     biso_admin_controls?: RuleSetting.BISOAdminControls;
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     block_page?: RuleSetting.BlockPage | null;
     /**
-     * Enable the custom block page.
+     * Enable the custom block page. Settable only for `dns` rules with action `block`.
      */
     block_page_enabled?: boolean;
     /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
+     * Explain why the rule blocks the request. The custom block page shows this text
+     * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+     * set to `block`.
      */
     block_reason?: string | null;
     /**
-     * Set by children MSP accounts to bypass their parent's rules.
+     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+     * accounts can set this. Settable for all types of rules.
      */
     bypass_parent_rule?: boolean | null;
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     check_session?: RuleSetting.CheckSession | null;
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     dns_resolvers?: RuleSetting.DNSResolvers | null;
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     egress?: RuleSetting.Egress | null;
     /**
-     * Set to true, to ignore the category matches at CNAME domains in a response. If
-     * unchecked, the categories in this rule will be checked against all the CNAME
-     * domain categories in a response.
+     * Configure whether a copy of the HTTP request will be sent to storage when the
+     * rule matches.
+     */
+    forensic_copy?: RuleSetting.ForensicCopy | null;
+    /**
+     * Ignore category matches at CNAME domains in a response. When off, evaluate
+     * categories in this rule against all CNAME domain categories in the response.
+     * Settable only for `dns` and `dns_resolver` rules.
      */
     ignore_cname_category_matches?: boolean;
     /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
+     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+     * Settable only for `dns` rules.
      */
     insecure_disable_dnssec_validation?: boolean;
     /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
+     * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+     * categories unless you enable this setting. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_categories?: boolean;
     /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
+     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+     * indicator feeds block only domain names. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_indicator_feeds?: boolean;
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     l4override?: RuleSetting.L4override | null;
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     notification_settings?: RuleSetting.NotificationSettings | null;
     /**
-     * Override matching DNS queries with a hostname.
+     * Defines a hostname for override, for the matching DNS queries. Settable only for
+     * `dns` rules with the action set to `override`.
      */
     override_host?: string;
     /**
-     * Override matching DNS queries with an IP or set of IPs.
+     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+     * for `dns` rules with the action set to `override`.
      */
     override_ips?: Array<string> | null;
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     payload_log?: RuleSetting.PayloadLog | null;
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     quarantine?: RuleSetting.Quarantine | null;
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     redirect?: RuleSetting.Redirect | null;
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     resolve_dns_internally?: RuleSetting.ResolveDNSInternally | null;
     /**
      * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when 'dns_resolvers' are specified or
-     * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-     * 'resolve'.
+     * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+     * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+     * `dns_resolver` rules.
      */
     resolve_dns_through_cloudflare?: boolean | null;
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     untrusted_cert?: RuleSetting.UntrustedCERT | null;
 }
 export declare namespace RuleSetting {
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     interface AuditSSH {
         /**
-         * Enable to turn on SSH command logging.
+         * Enable SSH command logging.
          */
         command_logging?: boolean;
     }
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     interface BISOAdminControls {
         /**
-         * Configure whether copy is enabled or not. When set with "remote_only", copying
-         * isolated content from the remote browser to the user's local clipboard is
-         * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+         * Configure copy behavior. If set to remote_only, users cannot copy isolated
+         * content from the remote browser to the local clipboard. If this field is absent,
+         * copying remains enabled. Applies only when version == "v2".
          */
         copy?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -468,8 +511,8 @@ export declare namespace RuleSetting {
          */
         dk?: boolean;
         /**
-         * Configure whether downloading enabled or not. When set with "remote_only",
-         * downloads are only available for viewing. Only applies when `version == "v2"`.
+         * Configure download behavior. When set to remote_only, users can view downloads
+         * but cannot save them. Applies only when version == "v2".
          */
         download?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -481,65 +524,66 @@ export declare namespace RuleSetting {
          */
         du?: boolean;
         /**
-         * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-         * is enabled. Only applies when `version == "v2"`.
+         * Configure keyboard usage behavior. If this field is absent, keyboard usage
+         * remains enabled. Applies only when version == "v2".
          */
         keyboard?: 'enabled' | 'disabled';
         /**
-         * Configure whether pasting is enabled or not. When set with "remote_only",
-         * pasting content from the user's local clipboard into isolated pages is disabled.
-         * When absent, paste is enabled. Only applies when `version == "v2"`.
+         * Configure paste behavior. If set to remote_only, users cannot paste content from
+         * the local clipboard into isolated pages. If this field is absent, pasting
+         * remains enabled. Applies only when version == "v2".
          */
         paste?: 'enabled' | 'disabled' | 'remote_only';
         /**
-         * Configure whether printing is enabled or not. When absent, printing is enabled.
-         * Only applies when `version == "v2"`.
+         * Configure print behavior. Default, Printing is enabled. Applies only when
+         * version == "v2".
          */
         printing?: 'enabled' | 'disabled';
         /**
-         * Configure whether uploading is enabled or not. When absent, uploading is
-         * enabled. Only applies when `version == "v2"`.
+         * Configure upload behavior. If this field is absent, uploading remains enabled.
+         * Applies only when version == "v2".
          */
         upload?: 'enabled' | 'disabled';
         /**
-         * Indicates which version of the browser isolation controls should apply.
+         * Indicate which version of the browser isolation controls should apply.
          */
         version?: 'v1' | 'v2';
     }
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     interface BlockPage {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
     }
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     interface CheckSession {
         /**
-         * Configure how fresh the session needs to be to be considered valid. The API
-         * automatically formats and sanitizes this expression. This returns a normalized
-         * version that may differ from your input and cause Terraform state drift.
+         * Sets the required session freshness threshold. The API returns a normalized
+         * version of this value.
          */
         duration?: string;
         /**
-         * Set to true to enable session enforcement.
+         * Enable session enforcement.
          */
         enforce?: boolean;
     }
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     interface DNSResolvers {
         ipv4?: Array<RulesAPI.DNSResolverSettingsV4>;
@@ -548,48 +592,58 @@ export declare namespace RuleSetting {
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     interface Egress {
         /**
-         * The IPv4 address to be used for egress.
+         * Specify the IPv4 address to use for egress.
          */
         ipv4?: string;
         /**
-         * The fallback IPv4 address to be used for egress in the event of an error
-         * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-         * WARP IPs.
+         * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+         * Set '0.0.0.0' to indicate local egress via WARP IPs.
          */
         ipv4_fallback?: string;
         /**
-         * The IPv6 range to be used for egress.
+         * Specify the IPv6 range to use for egress.
          */
         ipv6?: string;
     }
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Configure whether a copy of the HTTP request will be sent to storage when the
+     * rule matches.
+     */
+    interface ForensicCopy {
+        /**
+         * Enable sending the copy to storage.
+         */
+        enabled?: boolean;
+    }
+    /**
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     interface L4override {
         /**
-         * IPv4 or IPv6 address.
+         * Defines the IPv4 or IPv6 address.
          */
         ip?: string;
         /**
-         * A port number to use for TCP/UDP overrides.
+         * Defines a port number to use for TCP/UDP overrides.
          */
         port?: number;
     }
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     interface NotificationSettings {
         /**
-         * Set notification on.
+         * Enable notification.
          */
         enabled?: boolean;
         /**
-         * If true, context information will be passed as query parameters.
+         * Indicates whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
@@ -597,220 +651,250 @@ export declare namespace RuleSetting {
          */
         msg?: string;
         /**
-         * Optional URL to direct users to additional information. If not set, the
-         * notification will open a block page.
+         * Defines an optional URL to direct users to additional information. If unset, the
+         * notification opens a block page.
          */
         support_url?: string;
     }
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     interface PayloadLog {
         /**
-         * Set to true to enable DLP payload logging for this rule.
+         * Enable DLP payload logging for this rule.
          */
         enabled?: boolean;
     }
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     interface Quarantine {
         /**
-         * Types of files to sandbox.
+         * Specify the types of files to sandbox.
          */
         file_types?: Array<'exe' | 'pdf' | 'doc' | 'docm' | 'docx' | 'rtf' | 'ppt' | 'pptx' | 'xls' | 'xlsm' | 'xlsx' | 'zip' | 'rar'>;
     }
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     interface Redirect {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
-         * If true, the path and query parameters from the original request will be
-         * appended to target_uri.
+         * Specify whether to append the path and query parameters from the original
+         * request to target_uri.
          */
         preserve_path_and_query?: boolean;
     }
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     interface ResolveDNSInternally {
         /**
-         * The fallback behavior to apply when the internal DNS response code is different
-         * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-         * 'AAAA' queries.
+         * Specify the fallback behavior to apply when the internal DNS response code
+         * differs from 'NOERROR' or when the response data contains only CNAME records for
+         * 'A' or 'AAAA' queries.
          */
         fallback?: 'none' | 'public_dns';
         /**
-         * The internal DNS view identifier that's passed to the internal DNS service.
+         * Specify the internal DNS view identifier to pass to the internal DNS service.
          */
         view_id?: string;
     }
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     interface UntrustedCERT {
         /**
-         * The action performed when an untrusted certificate is seen. The default action
-         * is an error with HTTP code 526.
+         * Defines the action performed when an untrusted certificate seen. The default
+         * action an error with HTTP code 526.
          */
         action?: 'pass_through' | 'block' | 'error';
     }
 }
 /**
- * Additional settings that modify the rule's action.
+ * Defines settings for this rule. Settings apply only to specific rule types and
+ * must use compatible selectors. If Terraform detects drift, confirm the setting
+ * supports your rule type and check whether the API modifies the value. Use
+ * API-returned values in your configuration to prevent drift.
  */
 export interface RuleSettingParam {
     /**
-     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-     * header names, pointing to an array with its header value(s).
+     * Add custom headers to allowed requests as key-value pairs. Use header names as
+     * keys that map to arrays of header values. Settable only for `http` rules with
+     * the action set to `allow`.
      */
     add_headers?: {
         [key: string]: Array<string>;
     } | null;
     /**
-     * Set by parent MSP accounts to enable their children to bypass this rule.
+     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+     * this. this rule. Settable for all types of rules.
      */
     allow_child_bypass?: boolean | null;
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     audit_ssh?: RuleSettingParam.AuditSSH | null;
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     biso_admin_controls?: RuleSettingParam.BISOAdminControls;
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     block_page?: RuleSettingParam.BlockPage | null;
     /**
-     * Enable the custom block page.
+     * Enable the custom block page. Settable only for `dns` rules with action `block`.
      */
     block_page_enabled?: boolean;
     /**
-     * The text describing why this block occurred, displayed on the custom block page
-     * (if enabled).
+     * Explain why the rule blocks the request. The custom block page shows this text
+     * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+     * set to `block`.
      */
     block_reason?: string | null;
     /**
-     * Set by children MSP accounts to bypass their parent's rules.
+     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+     * accounts can set this. Settable for all types of rules.
      */
     bypass_parent_rule?: boolean | null;
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     check_session?: RuleSettingParam.CheckSession | null;
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     dns_resolvers?: RuleSettingParam.DNSResolvers | null;
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     egress?: RuleSettingParam.Egress | null;
     /**
-     * Set to true, to ignore the category matches at CNAME domains in a response. If
-     * unchecked, the categories in this rule will be checked against all the CNAME
-     * domain categories in a response.
+     * Configure whether a copy of the HTTP request will be sent to storage when the
+     * rule matches.
+     */
+    forensic_copy?: RuleSettingParam.ForensicCopy | null;
+    /**
+     * Ignore category matches at CNAME domains in a response. When off, evaluate
+     * categories in this rule against all CNAME domain categories in the response.
+     * Settable only for `dns` and `dns_resolver` rules.
      */
     ignore_cname_category_matches?: boolean;
     /**
-     * INSECURE - disable DNSSEC validation (for Allow actions).
+     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+     * Settable only for `dns` rules.
      */
     insecure_disable_dnssec_validation?: boolean;
     /**
-     * Set to true to enable IPs in DNS resolver category blocks. By default categories
-     * only block based on domain names.
+     * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+     * categories unless you enable this setting. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_categories?: boolean;
     /**
-     * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-     * indicator feeds only block based on domain names.
+     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+     * indicator feeds block only domain names. Settable only for `dns` and
+     * `dns_resolver` rules.
      */
     ip_indicator_feeds?: boolean;
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     l4override?: RuleSettingParam.L4override | null;
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     notification_settings?: RuleSettingParam.NotificationSettings | null;
     /**
-     * Override matching DNS queries with a hostname.
+     * Defines a hostname for override, for the matching DNS queries. Settable only for
+     * `dns` rules with the action set to `override`.
      */
     override_host?: string;
     /**
-     * Override matching DNS queries with an IP or set of IPs.
+     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+     * for `dns` rules with the action set to `override`.
      */
     override_ips?: Array<string> | null;
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     payload_log?: RuleSettingParam.PayloadLog | null;
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     quarantine?: RuleSettingParam.Quarantine | null;
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     redirect?: RuleSettingParam.Redirect | null;
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     resolve_dns_internally?: RuleSettingParam.ResolveDNSInternally | null;
     /**
      * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-     * resolver. Cannot be set when 'dns_resolvers' are specified or
-     * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-     * 'resolve'.
+     * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+     * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+     * `dns_resolver` rules.
      */
     resolve_dns_through_cloudflare?: boolean | null;
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     untrusted_cert?: RuleSettingParam.UntrustedCERT | null;
 }
 export declare namespace RuleSettingParam {
     /**
-     * Settings for the Audit SSH action.
+     * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+     * `audit_ssh` action.
      */
     interface AuditSSH {
         /**
-         * Enable to turn on SSH command logging.
+         * Enable SSH command logging.
          */
         command_logging?: boolean;
     }
     /**
-     * Configure how browser isolation behaves.
+     * Configure browser isolation behavior. Settable only for `http` rules with the
+     * action set to `isolate`.
      */
     interface BISOAdminControls {
         /**
-         * Configure whether copy is enabled or not. When set with "remote_only", copying
-         * isolated content from the remote browser to the user's local clipboard is
-         * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+         * Configure copy behavior. If set to remote_only, users cannot copy isolated
+         * content from the remote browser to the local clipboard. If this field is absent,
+         * copying remains enabled. Applies only when version == "v2".
          */
         copy?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -826,8 +910,8 @@ export declare namespace RuleSettingParam {
          */
         dk?: boolean;
         /**
-         * Configure whether downloading enabled or not. When set with "remote_only",
-         * downloads are only available for viewing. Only applies when `version == "v2"`.
+         * Configure download behavior. When set to remote_only, users can view downloads
+         * but cannot save them. Applies only when version == "v2".
          */
         download?: 'enabled' | 'disabled' | 'remote_only';
         /**
@@ -839,65 +923,66 @@ export declare namespace RuleSettingParam {
          */
         du?: boolean;
         /**
-         * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-         * is enabled. Only applies when `version == "v2"`.
+         * Configure keyboard usage behavior. If this field is absent, keyboard usage
+         * remains enabled. Applies only when version == "v2".
          */
         keyboard?: 'enabled' | 'disabled';
         /**
-         * Configure whether pasting is enabled or not. When set with "remote_only",
-         * pasting content from the user's local clipboard into isolated pages is disabled.
-         * When absent, paste is enabled. Only applies when `version == "v2"`.
+         * Configure paste behavior. If set to remote_only, users cannot paste content from
+         * the local clipboard into isolated pages. If this field is absent, pasting
+         * remains enabled. Applies only when version == "v2".
          */
         paste?: 'enabled' | 'disabled' | 'remote_only';
         /**
-         * Configure whether printing is enabled or not. When absent, printing is enabled.
-         * Only applies when `version == "v2"`.
+         * Configure print behavior. Default, Printing is enabled. Applies only when
+         * version == "v2".
          */
         printing?: 'enabled' | 'disabled';
         /**
-         * Configure whether uploading is enabled or not. When absent, uploading is
-         * enabled. Only applies when `version == "v2"`.
+         * Configure upload behavior. If this field is absent, uploading remains enabled.
+         * Applies only when version == "v2".
          */
         upload?: 'enabled' | 'disabled';
         /**
-         * Indicates which version of the browser isolation controls should apply.
+         * Indicate which version of the browser isolation controls should apply.
          */
         version?: 'v1' | 'v2';
     }
     /**
-     * Custom block page settings. If missing/null, blocking will use the the account
-     * settings.
+     * Configure custom block page settings. If missing or null, use the account
+     * settings. Settable only for `http` rules with the action set to `block`.
      */
     interface BlockPage {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
     }
     /**
-     * Configure how session check behaves.
+     * Configure session check behavior. Settable only for `l4` and `http` rules with
+     * the action set to `allow`.
      */
     interface CheckSession {
         /**
-         * Configure how fresh the session needs to be to be considered valid. The API
-         * automatically formats and sanitizes this expression. This returns a normalized
-         * version that may differ from your input and cause Terraform state drift.
+         * Sets the required session freshness threshold. The API returns a normalized
+         * version of this value.
          */
         duration?: string;
         /**
-         * Set to true to enable session enforcement.
+         * Enable session enforcement.
          */
         enforce?: boolean;
     }
     /**
-     * Add your own custom resolvers to route queries that match the resolver policy.
-     * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-     * are set. DNS queries will route to the address closest to their origin. Only
-     * valid when a rule's action is set to 'resolve'.
+     * Configure custom resolvers to route queries that match the resolver policy.
+     * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+     * settings. DNS queries get routed to the address closest to their origin. Only
+     * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+     * rules.
      */
     interface DNSResolvers {
         ipv4?: Array<RulesAPI.DNSResolverSettingsV4Param>;
@@ -906,48 +991,58 @@ export declare namespace RuleSettingParam {
     /**
      * Configure how Gateway Proxy traffic egresses. You can enable this setting for
      * rules with Egress actions and filters, or omit it to indicate local egress via
-     * WARP IPs.
+     * WARP IPs. Settable only for `egress` rules.
      */
     interface Egress {
         /**
-         * The IPv4 address to be used for egress.
+         * Specify the IPv4 address to use for egress.
          */
         ipv4?: string;
         /**
-         * The fallback IPv4 address to be used for egress in the event of an error
-         * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-         * WARP IPs.
+         * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+         * Set '0.0.0.0' to indicate local egress via WARP IPs.
          */
         ipv4_fallback?: string;
         /**
-         * The IPv6 range to be used for egress.
+         * Specify the IPv6 range to use for egress.
          */
         ipv6?: string;
     }
     /**
-     * Send matching traffic to the supplied destination IP address. and port.
+     * Configure whether a copy of the HTTP request will be sent to storage when the
+     * rule matches.
+     */
+    interface ForensicCopy {
+        /**
+         * Enable sending the copy to storage.
+         */
+        enabled?: boolean;
+    }
+    /**
+     * Send matching traffic to the supplied destination IP address and port. Settable
+     * only for `l4` rules with the action set to `l4_override`.
      */
     interface L4override {
         /**
-         * IPv4 or IPv6 address.
+         * Defines the IPv4 or IPv6 address.
          */
         ip?: string;
         /**
-         * A port number to use for TCP/UDP overrides.
+         * Defines a port number to use for TCP/UDP overrides.
          */
         port?: number;
     }
     /**
-     * Configure a notification to display on the user's device when this rule is
-     * matched.
+     * Configure a notification to display on the user's device when this rule matched.
+     * Settable for all types of rules with the action set to `block`.
      */
     interface NotificationSettings {
         /**
-         * Set notification on.
+         * Enable notification.
          */
         enabled?: boolean;
         /**
-         * If true, context information will be passed as query parameters.
+         * Indicates whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
@@ -955,189 +1050,204 @@ export declare namespace RuleSettingParam {
          */
         msg?: string;
         /**
-         * Optional URL to direct users to additional information. If not set, the
-         * notification will open a block page.
+         * Defines an optional URL to direct users to additional information. If unset, the
+         * notification opens a block page.
          */
         support_url?: string;
     }
     /**
-     * Configure DLP payload logging.
+     * Configure DLP payload logging. Settable only for `http` rules.
      */
     interface PayloadLog {
         /**
-         * Set to true to enable DLP payload logging for this rule.
+         * Enable DLP payload logging for this rule.
          */
         enabled?: boolean;
     }
     /**
-     * Settings that apply to quarantine rules.
+     * Configure settings that apply to quarantine rules. Settable only for `http`
+     * rules.
      */
     interface Quarantine {
         /**
-         * Types of files to sandbox.
+         * Specify the types of files to sandbox.
          */
         file_types?: Array<'exe' | 'pdf' | 'doc' | 'docm' | 'docx' | 'rtf' | 'ppt' | 'pptx' | 'xls' | 'xlsm' | 'xlsx' | 'zip' | 'rar'>;
     }
     /**
-     * Settings that apply to redirect rules.
+     * Apply settings to redirect rules. Settable only for `http` rules with the action
+     * set to `redirect`.
      */
     interface Redirect {
         /**
-         * URI to which the user will be redirected.
+         * Specify the URI to which the user is redirected.
          */
         target_uri: string;
         /**
-         * If true, context information will be passed as query parameters.
+         * Specify whether to pass the context information as query parameters.
          */
         include_context?: boolean;
         /**
-         * If true, the path and query parameters from the original request will be
-         * appended to target_uri.
+         * Specify whether to append the path and query parameters from the original
+         * request to target_uri.
          */
         preserve_path_and_query?: boolean;
     }
     /**
      * Configure to forward the query to the internal DNS service, passing the
-     * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-     * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-     * set to 'resolve'.
+     * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+     * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+     * 'resolve'. Settable only for `dns_resolver` rules.
      */
     interface ResolveDNSInternally {
         /**
-         * The fallback behavior to apply when the internal DNS response code is different
-         * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-         * 'AAAA' queries.
+         * Specify the fallback behavior to apply when the internal DNS response code
+         * differs from 'NOERROR' or when the response data contains only CNAME records for
+         * 'A' or 'AAAA' queries.
          */
         fallback?: 'none' | 'public_dns';
         /**
-         * The internal DNS view identifier that's passed to the internal DNS service.
+         * Specify the internal DNS view identifier to pass to the internal DNS service.
          */
         view_id?: string;
     }
     /**
-     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+     * Configure behavior when an upstream certificate is invalid or an SSL error
+     * occurs. Settable only for `http` rules with the action set to `allow`.
      */
     interface UntrustedCERT {
         /**
-         * The action performed when an untrusted certificate is seen. The default action
-         * is an error with HTTP code 526.
+         * Defines the action performed when an untrusted certificate seen. The default
+         * action an error with HTTP code 526.
          */
         action?: 'pass_through' | 'block' | 'error';
     }
 }
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface Schedule {
     /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
+     * Specify the time intervals when the rule is active on Fridays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Fridays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     fri?: string;
     /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
+     * Specify the time intervals when the rule is active on Mondays, in the increasing
+     * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+     * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+     * this string, which may cause Terraform drift if a unformatted value is used.
      */
     mon?: string;
     /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
+     * Specify the time intervals when the rule is active on Saturdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Saturdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     sat?: string;
     /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
+     * Specify the time intervals when the rule is active on Sundays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Sundays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     sun?: string;
     /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
+     * Specify the time intervals when the rule is active on Thursdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Thursdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     thu?: string;
     /**
-     * The time zone the rule will be evaluated against. If a
+     * Specify the time zone for rule evaluation. When a
      * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
+     * is provided, Gateway always uses the current time for that time zone. When this
+     * parameter is omitted, Gateway uses the time zone determined from the user's IP
+     * address. Colo time zone is used when the user's IP address does not resolve to a
+     * location.
      */
     time_zone?: string;
     /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
+     * Specify the time intervals when the rule is active on Tuesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Tuesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     tue?: string;
     /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
+     * Specify the time intervals when the rule is active on Wednesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Wednesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     wed?: string;
 }
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface ScheduleParam {
     /**
-     * The time intervals when the rule will be active on Fridays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Fridays.
+     * Specify the time intervals when the rule is active on Fridays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Fridays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     fri?: string;
     /**
-     * The time intervals when the rule will be active on Mondays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Mondays.
+     * Specify the time intervals when the rule is active on Mondays, in the increasing
+     * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+     * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+     * this string, which may cause Terraform drift if a unformatted value is used.
      */
     mon?: string;
     /**
-     * The time intervals when the rule will be active on Saturdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Saturdays.
+     * Specify the time intervals when the rule is active on Saturdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Saturdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     sat?: string;
     /**
-     * The time intervals when the rule will be active on Sundays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Sundays.
+     * Specify the time intervals when the rule is active on Sundays, in the increasing
+     * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+     * Sundays. API returns a formatted version of this string, which may cause
+     * Terraform drift if a unformatted value is used.
      */
     sun?: string;
     /**
-     * The time intervals when the rule will be active on Thursdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Thursdays.
+     * Specify the time intervals when the rule is active on Thursdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Thursdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     thu?: string;
     /**
-     * The time zone the rule will be evaluated against. If a
+     * Specify the time zone for rule evaluation. When a
      * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-     * is provided, Gateway will always use the current time at that time zone. If this
-     * parameter is omitted, then Gateway will use the time zone inferred from the
-     * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-     * from the IP, we will fall back to the time zone of the user's connected data
-     * center.
+     * is provided, Gateway always uses the current time for that time zone. When this
+     * parameter is omitted, Gateway uses the time zone determined from the user's IP
+     * address. Colo time zone is used when the user's IP address does not resolve to a
+     * location.
      */
     time_zone?: string;
     /**
-     * The time intervals when the rule will be active on Tuesdays, in increasing order
-     * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-     * Tuesdays.
+     * Specify the time intervals when the rule is active on Tuesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Tuesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     tue?: string;
     /**
-     * The time intervals when the rule will be active on Wednesdays, in increasing
-     * order from 00:00-24:00. If this parameter is omitted, the rule will be
-     * deactivated on Wednesdays.
+     * Specify the time intervals when the rule is active on Wednesdays, in the
+     * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+     * deactivated on Wednesdays. API returns a formatted version of this string, which
+     * may cause Terraform drift if a unformatted value is used.
      */
     wed?: string;
 }
@@ -1148,93 +1258,92 @@ export interface RuleCreateParams {
      */
     account_id: string;
     /**
-     * Body param: The action to perform when the associated traffic, identity, and
-     * device posture expressions are either absent or evaluate to `true`.
+     * Body param: Specify the action to perform when the associated traffic, identity,
+     * and device posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * Body param: The name of the rule.
+     * Body param: Specify the rule name.
      */
     name: string;
     /**
-     * Body param: The description of the rule.
+     * Body param: Specify the rule description.
      */
     description?: string;
     /**
-     * Body param: The wirefilter expression used for device posture check matching.
-     * The API automatically formats and sanitizes this expression. This returns a
-     * normalized version that may differ from your input and cause Terraform state
-     * drift.
+     * Body param: Specify the wirefilter expression used for device posture check. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * Body param: True if the rule is enabled.
+     * Body param: Specify whether the rule is enabled.
      */
     enabled?: boolean;
     /**
-     * Body param: The expiration time stamp and default duration of a DNS policy.
-     * Takes precedence over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Body param: Defines the expiration time stamp and default duration of a DNS
+     * policy. Takes precedence over the policy's `schedule` configuration, if any.
+     * This does not apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: RuleCreateParams.Expiration | null;
     /**
-     * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-     * posture expressions.
+     * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+     * device posture expressions. Can only contain a single value.
      */
     filters?: Array<GatewayFilterParam>;
     /**
-     * Body param: The wirefilter expression used for identity matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for identity matching. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * Body param: Precedence sets the order of your rules. Lower values indicate
-     * higher precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Body param: Set the order of your rules. Lower values indicate higher
+     * precedence. At each processing phase, evaluate applicable rules in ascending
+     * order of this value. Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence?: number;
     /**
-     * Body param: Additional settings that modify the rule's action.
+     * Body param: Defines settings for this rule. Settings apply only to specific rule
+     * types and must use compatible selectors. If Terraform detects drift, confirm the
+     * setting supports your rule type and check whether the API modifies the value.
+     * Use API-returned values in your configuration to prevent drift.
      */
     rule_settings?: RuleSettingParam;
     /**
-     * Body param: The schedule for activating DNS policies. This does not apply to
-     * HTTP or network policies.
+     * Body param: Defines the schedule for activating DNS policies. Settable only for
+     * `dns` and `dns_resolver` rules.
      */
     schedule?: ScheduleParam | null;
     /**
-     * Body param: The wirefilter expression used for traffic matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic?: string;
 }
 export declare namespace RuleCreateParams {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;
@@ -1246,93 +1355,92 @@ export interface RuleUpdateParams {
      */
     account_id: string;
     /**
-     * Body param: The action to perform when the associated traffic, identity, and
-     * device posture expressions are either absent or evaluate to `true`.
+     * Body param: Specify the action to perform when the associated traffic, identity,
+     * and device posture expressions either absent or evaluate to `true`.
      */
     action: 'on' | 'off' | 'allow' | 'block' | 'scan' | 'noscan' | 'safesearch' | 'ytrestricted' | 'isolate' | 'noisolate' | 'override' | 'l4_override' | 'egress' | 'resolve' | 'quarantine' | 'redirect';
     /**
-     * Body param: The name of the rule.
+     * Body param: Specify the rule name.
      */
     name: string;
     /**
-     * Body param: The description of the rule.
+     * Body param: Specify the rule description.
      */
     description?: string;
     /**
-     * Body param: The wirefilter expression used for device posture check matching.
-     * The API automatically formats and sanitizes this expression. This returns a
-     * normalized version that may differ from your input and cause Terraform state
-     * drift.
+     * Body param: Specify the wirefilter expression used for device posture check. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     device_posture?: string;
     /**
-     * Body param: True if the rule is enabled.
+     * Body param: Specify whether the rule is enabled.
      */
     enabled?: boolean;
     /**
-     * Body param: The expiration time stamp and default duration of a DNS policy.
-     * Takes precedence over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Body param: Defines the expiration time stamp and default duration of a DNS
+     * policy. Takes precedence over the policy's `schedule` configuration, if any.
+     * This does not apply to HTTP or network policies. Settable only for `dns` rules.
      */
     expiration?: RuleUpdateParams.Expiration | null;
     /**
-     * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-     * posture expressions.
+     * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+     * device posture expressions. Can only contain a single value.
      */
     filters?: Array<GatewayFilterParam>;
     /**
-     * Body param: The wirefilter expression used for identity matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for identity matching. The
+     * API automatically formats and sanitizes expressions before storing them. To
+     * prevent Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     identity?: string;
     /**
-     * Body param: Precedence sets the order of your rules. Lower values indicate
-     * higher precedence. At each processing phase, applicable rules are evaluated in
-     * ascending order of this value. Refer to
+     * Body param: Set the order of your rules. Lower values indicate higher
+     * precedence. At each processing phase, evaluate applicable rules in ascending
+     * order of this value. Refer to
      * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-     * docs on how to manage precedence via Terraform.
+     * to manage precedence via Terraform.
      */
     precedence?: number;
     /**
-     * Body param: Additional settings that modify the rule's action.
+     * Body param: Defines settings for this rule. Settings apply only to specific rule
+     * types and must use compatible selectors. If Terraform detects drift, confirm the
+     * setting supports your rule type and check whether the API modifies the value.
+     * Use API-returned values in your configuration to prevent drift.
      */
     rule_settings?: RuleSettingParam;
     /**
-     * Body param: The schedule for activating DNS policies. This does not apply to
-     * HTTP or network policies.
+     * Body param: Defines the schedule for activating DNS policies. Settable only for
+     * `dns` and `dns_resolver` rules.
      */
     schedule?: ScheduleParam | null;
     /**
-     * Body param: The wirefilter expression used for traffic matching. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Body param: Specify the wirefilter expression used for traffic matching. The API
+     * automatically formats and sanitizes expressions before storing them. To prevent
+     * Terraform state drift, use the formatted expression returned in the API
+     * response.
      */
     traffic?: string;
 }
 export declare namespace RuleUpdateParams {
     /**
-     * The expiration time stamp and default duration of a DNS policy. Takes precedence
-     * over the policy's `schedule` configuration, if any.
-     *
-     * This does not apply to HTTP or network policies.
+     * Defines the expiration time stamp and default duration of a DNS policy. Takes
+     * precedence over the policy's `schedule` configuration, if any. This does not
+     * apply to HTTP or network policies. Settable only for `dns` rules.
      */
     interface Expiration {
         /**
-         * The time stamp at which the policy will expire and cease to be applied.
-         *
-         * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-         * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-         * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-         *
-         * Policies with an expiration do not consider the timezone of clients they are
-         * applied to, and expire "globally" at the point given by their `expires_at`
-         * value.
+         * Show the timestamp when the policy expires and stops applying. The value must
+         * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+         * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+         * a trailing Z. Expiration policies ignore client timezones and expire globally at
+         * the specified expires_at time.
          */
         expires_at: string;
         /**
-         * The default duration a policy will be active in minutes. Must be set in order to
+         * Defines the default duration a policy active in minutes. Must set in order to
          * use the `reset_expiration` endpoint on this rule.
          */
         duration?: number;
@@ -1347,10 +1455,13 @@ export interface RuleDeleteParams {
 export interface RuleGetParams {
     account_id: string;
 }
+export interface RuleListTenantParams {
+    account_id: string;
+}
 export interface RuleResetExpirationParams {
     account_id: string;
 }
 export declare namespace Rules {
-    export { type DNSResolverSettingsV4 as DNSResolverSettingsV4, type DNSResolverSettingsV6 as DNSResolverSettingsV6, type GatewayFilter as GatewayFilter, type GatewayRule as GatewayRule, type RuleSetting as RuleSetting, type Schedule as Schedule, type RuleDeleteResponse as RuleDeleteResponse, GatewayRulesSinglePage as GatewayRulesSinglePage, type RuleCreateParams as RuleCreateParams, type RuleUpdateParams as RuleUpdateParams, type RuleListParams as RuleListParams, type RuleDeleteParams as RuleDeleteParams, type RuleGetParams as RuleGetParams, type RuleResetExpirationParams as RuleResetExpirationParams, };
+    export { type DNSResolverSettingsV4 as DNSResolverSettingsV4, type DNSResolverSettingsV6 as DNSResolverSettingsV6, type GatewayFilter as GatewayFilter, type GatewayRule as GatewayRule, type RuleSetting as RuleSetting, type Schedule as Schedule, type RuleDeleteResponse as RuleDeleteResponse, GatewayRulesSinglePage as GatewayRulesSinglePage, type RuleCreateParams as RuleCreateParams, type RuleUpdateParams as RuleUpdateParams, type RuleListParams as RuleListParams, type RuleDeleteParams as RuleDeleteParams, type RuleGetParams as RuleGetParams, type RuleListTenantParams as RuleListTenantParams, type RuleResetExpirationParams as RuleResetExpirationParams, };
 }
 //# sourceMappingURL=rules.d.ts.map