cloudflare 5.1.0 → 6.0.0-beta.1

package/src/resources/zero-trust/access/applications/applications.ts

@@ -1667,7 +1667,10 @@ export type ApplicationType =
   | 'bookmark'
   | 'dash_sso'
   | 'infrastructure'
-  | 'rdp';
+  | 'rdp'
+  | 'mcp'
+  | 'mcp_portal'
+  | 'proxy_endpoint';
 
 /**
  * The application type.
@@ -1683,7 +1686,10 @@ export type ApplicationTypeParam =
   | 'bookmark'
   | 'dash_sso'
   | 'infrastructure'
-  | 'rdp';
+  | 'rdp'
+  | 'mcp'
+  | 'mcp_portal'
+  | 'proxy_endpoint';
 
 export interface CORSHeaders {
   /**
@@ -1817,8 +1823,6 @@ export interface OIDCSaaSApp {
    */
   client_secret?: string;
 
-  created_at?: string;
-
   custom_claims?: Array<OIDCSaaSApp.CustomClaim>;
 
   /**
@@ -1853,8 +1857,6 @@ export interface OIDCSaaSApp {
    * automatically enabled if refresh tokens are enabled
    */
   scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
-
-  updated_at?: string;
 }
 
 export namespace OIDCSaaSApp {
@@ -2060,8 +2062,6 @@ export interface SAMLSaaSApp {
    */
   consumer_service_url?: string;
 
-  created_at?: string;
-
   custom_attributes?: Array<SAMLSaaSApp.CustomAttribute>;
 
   /**
@@ -2111,8 +2111,6 @@ export interface SAMLSaaSApp {
    * The endpoint where your SaaS application will send login requests.
    */
   sso_endpoint?: string;
-
-  updated_at?: string;
 }
 
 export namespace SAMLSaaSApp {
@@ -2591,6 +2589,7 @@ export type ApplicationCreateResponse =
   | ApplicationCreateResponse.AppLauncherApplication
   | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationCreateResponse.BrowserIsolationPermissionsApplication
+  | ApplicationCreateResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationCreateResponse.BookmarkApplication
   | ApplicationCreateResponse.InfrastructureApplication
   | ApplicationCreateResponse.BrowserRdpApplication;
@@ -2650,8 +2649,6 @@ export namespace ApplicationCreateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -2680,7 +2677,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -2771,8 +2772,6 @@ export namespace ApplicationCreateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace SelfHostedApplication {
@@ -2791,10 +2790,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2826,6 +2821,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -3035,8 +3043,6 @@ export namespace ApplicationCreateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom pages that will be displayed when applicable for this application
      */
@@ -3072,8 +3078,6 @@ export namespace ApplicationCreateResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export namespace SaaSApplication {
@@ -3279,7 +3283,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -3323,8 +3330,6 @@ export namespace ApplicationCreateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -3353,7 +3358,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -3444,8 +3453,6 @@ export namespace ApplicationCreateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserSSHApplication {
@@ -3464,10 +3471,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3499,6 +3502,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -3701,7 +3717,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -3745,8 +3764,6 @@ export namespace ApplicationCreateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -3775,7 +3792,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -3866,8 +3887,6 @@ export namespace ApplicationCreateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserVNCApplication {
@@ -3886,10 +3905,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3921,6 +3936,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -4117,7 +4145,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -4151,8 +4182,6 @@ export namespace ApplicationCreateResponse {
      */
     bg_color?: string;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -4209,8 +4238,6 @@ export namespace ApplicationCreateResponse {
      * Determines when to skip the App Launcher landing page.
      */
     skip_app_launcher_login_page?: boolean;
-
-    updated_at?: string;
   }
 
   export namespace AppLauncherApplication {
@@ -4366,8 +4393,6 @@ export namespace ApplicationCreateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -4404,8 +4429,6 @@ export namespace ApplicationCreateResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace DeviceEnrollmentPermissionsApplication {
@@ -4519,8 +4542,6 @@ export namespace ApplicationCreateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -4557,8 +4578,6 @@ export namespace ApplicationCreateResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace BrowserIsolationPermissionsApplication {
@@ -4644,6 +4663,155 @@ export namespace ApplicationCreateResponse {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * The custom pages that will be displayed when applicable for this application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
   export interface BookmarkApplication {
     /**
      * UUID.
@@ -4660,8 +4828,6 @@ export namespace ApplicationCreateResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The URL or domain of the bookmark.
      */
@@ -4687,8 +4853,6 @@ export namespace ApplicationCreateResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export interface InfrastructureApplication {
@@ -4709,16 +4873,12 @@ export namespace ApplicationCreateResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The name of the application.
      */
     name?: string;
 
     policies?: Array<InfrastructureApplication.Policy>;
-
-    updated_at?: string;
   }
 
   export namespace InfrastructureApplication {
@@ -4875,8 +5035,6 @@ export namespace ApplicationCreateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -4905,7 +5063,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -4996,8 +5158,6 @@ export namespace ApplicationCreateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserRdpApplication {
@@ -5034,10 +5194,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5069,6 +5225,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -5259,6 +5428,7 @@ export type ApplicationUpdateResponse =
   | ApplicationUpdateResponse.AppLauncherApplication
   | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationUpdateResponse.BookmarkApplication
   | ApplicationUpdateResponse.InfrastructureApplication
   | ApplicationUpdateResponse.BrowserRdpApplication;
@@ -5318,8 +5488,6 @@ export namespace ApplicationUpdateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -5348,7 +5516,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -5439,8 +5611,6 @@ export namespace ApplicationUpdateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace SelfHostedApplication {
@@ -5459,10 +5629,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5494,6 +5660,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -5703,8 +5882,6 @@ export namespace ApplicationUpdateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom pages that will be displayed when applicable for this application
      */
@@ -5740,8 +5917,6 @@ export namespace ApplicationUpdateResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export namespace SaaSApplication {
@@ -5947,7 +6122,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -5991,8 +6169,6 @@ export namespace ApplicationUpdateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -6021,7 +6197,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -6112,8 +6292,6 @@ export namespace ApplicationUpdateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserSSHApplication {
@@ -6132,10 +6310,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6167,6 +6341,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -6369,7 +6556,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -6413,8 +6603,6 @@ export namespace ApplicationUpdateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -6443,7 +6631,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -6534,8 +6726,6 @@ export namespace ApplicationUpdateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserVNCApplication {
@@ -6554,10 +6744,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6589,6 +6775,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -6785,7 +6984,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -6819,8 +7021,6 @@ export namespace ApplicationUpdateResponse {
      */
     bg_color?: string;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -6877,8 +7077,6 @@ export namespace ApplicationUpdateResponse {
      * Determines when to skip the App Launcher landing page.
      */
     skip_app_launcher_login_page?: boolean;
-
-    updated_at?: string;
   }
 
   export namespace AppLauncherApplication {
@@ -7034,8 +7232,6 @@ export namespace ApplicationUpdateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -7072,8 +7268,6 @@ export namespace ApplicationUpdateResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace DeviceEnrollmentPermissionsApplication {
@@ -7187,8 +7381,6 @@ export namespace ApplicationUpdateResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -7225,8 +7417,6 @@ export namespace ApplicationUpdateResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace BrowserIsolationPermissionsApplication {
@@ -7312,6 +7502,155 @@ export namespace ApplicationUpdateResponse {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * The custom pages that will be displayed when applicable for this application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
   export interface BookmarkApplication {
     /**
      * UUID.
@@ -7328,8 +7667,6 @@ export namespace ApplicationUpdateResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The URL or domain of the bookmark.
      */
@@ -7355,8 +7692,6 @@ export namespace ApplicationUpdateResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export interface InfrastructureApplication {
@@ -7377,16 +7712,12 @@ export namespace ApplicationUpdateResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The name of the application.
      */
     name?: string;
 
     policies?: Array<InfrastructureApplication.Policy>;
-
-    updated_at?: string;
   }
 
   export namespace InfrastructureApplication {
@@ -7543,8 +7874,6 @@ export namespace ApplicationUpdateResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -7573,7 +7902,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -7664,8 +7997,6 @@ export namespace ApplicationUpdateResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserRdpApplication {
@@ -7702,10 +8033,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -7737,6 +8064,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -7927,6 +8267,7 @@ export type ApplicationListResponse =
   | ApplicationListResponse.AppLauncherApplication
   | ApplicationListResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationListResponse.BrowserIsolationPermissionsApplication
+  | ApplicationListResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationListResponse.BookmarkApplication
   | ApplicationListResponse.InfrastructureApplication
   | ApplicationListResponse.BrowserRdpApplication;
@@ -7986,8 +8327,6 @@ export namespace ApplicationListResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -8016,7 +8355,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -8107,8 +8450,6 @@ export namespace ApplicationListResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace SelfHostedApplication {
@@ -8127,10 +8468,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8162,6 +8499,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -8371,8 +8721,6 @@ export namespace ApplicationListResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom pages that will be displayed when applicable for this application
      */
@@ -8408,8 +8756,6 @@ export namespace ApplicationListResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export namespace SaaSApplication {
@@ -8615,7 +8961,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -8659,8 +9008,6 @@ export namespace ApplicationListResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -8689,7 +9036,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -8780,8 +9131,6 @@ export namespace ApplicationListResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserSSHApplication {
@@ -8800,10 +9149,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8835,6 +9180,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -9037,7 +9395,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -9081,8 +9442,6 @@ export namespace ApplicationListResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -9111,7 +9470,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -9202,8 +9565,6 @@ export namespace ApplicationListResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserVNCApplication {
@@ -9222,10 +9583,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -9257,6 +9614,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -9453,7 +9823,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -9487,8 +9860,6 @@ export namespace ApplicationListResponse {
      */
     bg_color?: string;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -9545,8 +9916,6 @@ export namespace ApplicationListResponse {
      * Determines when to skip the App Launcher landing page.
      */
     skip_app_launcher_login_page?: boolean;
-
-    updated_at?: string;
   }
 
   export namespace AppLauncherApplication {
@@ -9702,8 +10071,6 @@ export namespace ApplicationListResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -9740,8 +10107,6 @@ export namespace ApplicationListResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace DeviceEnrollmentPermissionsApplication {
@@ -9855,8 +10220,6 @@ export namespace ApplicationListResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -9893,8 +10256,6 @@ export namespace ApplicationListResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace BrowserIsolationPermissionsApplication {
@@ -9980,6 +10341,155 @@ export namespace ApplicationListResponse {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * The custom pages that will be displayed when applicable for this application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
   export interface BookmarkApplication {
     /**
      * UUID.
@@ -9996,8 +10506,6 @@ export namespace ApplicationListResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The URL or domain of the bookmark.
      */
@@ -10023,8 +10531,6 @@ export namespace ApplicationListResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export interface InfrastructureApplication {
@@ -10045,16 +10551,12 @@ export namespace ApplicationListResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The name of the application.
      */
     name?: string;
 
     policies?: Array<InfrastructureApplication.Policy>;
-
-    updated_at?: string;
   }
 
   export namespace InfrastructureApplication {
@@ -10211,8 +10713,6 @@ export namespace ApplicationListResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -10241,7 +10741,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -10332,8 +10836,6 @@ export namespace ApplicationListResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserRdpApplication {
@@ -10370,10 +10872,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10405,6 +10903,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -10602,6 +11113,7 @@ export type ApplicationGetResponse =
   | ApplicationGetResponse.AppLauncherApplication
   | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationGetResponse.BrowserIsolationPermissionsApplication
+  | ApplicationGetResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationGetResponse.BookmarkApplication
   | ApplicationGetResponse.InfrastructureApplication
   | ApplicationGetResponse.BrowserRdpApplication;
@@ -10661,8 +11173,6 @@ export namespace ApplicationGetResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -10691,7 +11201,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -10782,8 +11296,6 @@ export namespace ApplicationGetResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace SelfHostedApplication {
@@ -10802,10 +11314,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10837,6 +11345,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -11046,8 +11567,6 @@ export namespace ApplicationGetResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom pages that will be displayed when applicable for this application
      */
@@ -11083,8 +11602,6 @@ export namespace ApplicationGetResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export namespace SaaSApplication {
@@ -11290,7 +11807,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -11334,8 +11854,6 @@ export namespace ApplicationGetResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -11364,7 +11882,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -11455,8 +11977,6 @@ export namespace ApplicationGetResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserSSHApplication {
@@ -11475,10 +11995,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11510,6 +12026,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -11712,7 +12241,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -11756,8 +12288,6 @@ export namespace ApplicationGetResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -11786,7 +12316,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -11877,8 +12411,6 @@ export namespace ApplicationGetResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserVNCApplication {
@@ -11897,10 +12429,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11932,6 +12460,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -12128,7 +12669,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -12162,8 +12706,6 @@ export namespace ApplicationGetResponse {
      */
     bg_color?: string;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -12220,8 +12762,6 @@ export namespace ApplicationGetResponse {
      * Determines when to skip the App Launcher landing page.
      */
     skip_app_launcher_login_page?: boolean;
-
-    updated_at?: string;
   }
 
   export namespace AppLauncherApplication {
@@ -12377,8 +12917,6 @@ export namespace ApplicationGetResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -12415,8 +12953,6 @@ export namespace ApplicationGetResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace DeviceEnrollmentPermissionsApplication {
@@ -12530,8 +13066,6 @@ export namespace ApplicationGetResponse {
      */
     auto_redirect_to_identity?: boolean;
 
-    created_at?: string;
-
     /**
      * The custom URL a user is redirected to when they are denied access to the
      * application when failing identity-based rules.
@@ -12568,8 +13102,6 @@ export namespace ApplicationGetResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    updated_at?: string;
   }
 
   export namespace BrowserIsolationPermissionsApplication {
@@ -12655,42 +13187,189 @@ export namespace ApplicationGetResponse {
     }
   }
 
-  export interface BookmarkApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
     /**
      * UUID.
      */
     id?: string;
 
     /**
-     * Displays the application in the App Launcher.
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    app_launcher_visible?: boolean;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
-     * The URL or domain of the bookmark.
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
      */
-    domain?: string;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * The image URL for the logo shown in the App Launcher dashboard.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
      */
-    logo_url?: string;
+    custom_deny_url?: string;
 
     /**
-     * The name of the application.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
      */
-    name?: string;
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The tags you want assigned to an application. Tags are used to filter
-     * applications in the App Launcher dashboard.
+     * The custom pages that will be displayed when applicable for this application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
+  export interface BookmarkApplication {
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * The URL or domain of the bookmark.
+     */
+    domain?: string;
+
+    /**
+     * The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    /**
+     * The tags you want assigned to an application. Tags are used to filter
+     * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
 
@@ -12698,8 +13377,6 @@ export namespace ApplicationGetResponse {
      * The application type.
      */
     type?: ApplicationsAPI.ApplicationType;
-
-    updated_at?: string;
   }
 
   export interface InfrastructureApplication {
@@ -12720,16 +13397,12 @@ export namespace ApplicationGetResponse {
      */
     aud?: string;
 
-    created_at?: string;
-
     /**
      * The name of the application.
      */
     name?: string;
 
     policies?: Array<InfrastructureApplication.Policy>;
-
-    updated_at?: string;
   }
 
   export namespace InfrastructureApplication {
@@ -12886,8 +13559,6 @@ export namespace ApplicationGetResponse {
 
     cors_headers?: ApplicationsAPI.CORSHeaders;
 
-    created_at?: string;
-
     /**
      * The custom error message shown to a user when they are denied access to the
      * application.
@@ -12916,7 +13587,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -13007,8 +13682,6 @@ export namespace ApplicationGetResponse {
      * applications in the App Launcher dashboard.
      */
     tags?: Array<string>;
-
-    updated_at?: string;
   }
 
   export namespace BrowserRdpApplication {
@@ -13045,10 +13718,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13080,6 +13749,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -13272,6 +13954,7 @@ export type ApplicationCreateParams =
   | ApplicationCreateParams.AppLauncherApplication
   | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication
   | ApplicationCreateParams.BrowserIsolationPermissionsApplication
+  | ApplicationCreateParams.GatewayIdentityProxyEndpointApplication
   | ApplicationCreateParams.AccessBookmarkProps
   | ApplicationCreateParams.InfrastructureApplication
   | ApplicationCreateParams.BrowserRdpApplication;
@@ -13366,7 +14049,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -13481,10 +14168,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13516,6 +14199,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -13942,7 +14638,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14021,7 +14720,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -14136,10 +14839,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14171,6 +14870,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14356,7 +15068,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14435,7 +15150,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -14550,10 +15269,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14585,6 +15300,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14764,7 +15492,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14870,35 +15601,168 @@ export declare namespace ApplicationCreateParams {
     }
 
     /**
-     * The design of the App Launcher landing page shown to users when they log in.
+     * The design of the App Launcher landing page shown to users when they log in.
+     */
+    export interface LandingPageDesign {
+      /**
+       * The background color of the log in button on the landing page.
+       */
+      button_color?: string;
+
+      /**
+       * The color of the text in the log in button on the landing page.
+       */
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    /**
+     * A JSON that links a reusable policy to an application.
+     */
+    export interface AccessAppPolicyLink {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+    }
+
+    export interface UnionMember2 {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+    }
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: ApplicationTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdPsParam>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: The policies that Access applies to the application, in ascending
+     * order of precedence. Items can reference existing policies or create new
+     * policies exclusive to the application.
      */
-    export interface LandingPageDesign {
-      /**
-       * The background color of the log in button on the landing page.
-       */
-      button_color?: string;
-
-      /**
-       * The color of the text in the log in button on the landing page.
-       */
-      button_text_color?: string;
-
-      /**
-       * The URL of the image shown on the landing page.
-       */
-      image_url?: string;
-
-      /**
-       * The message shown on the landing page.
-       */
-      message?: string;
+    policies?: Array<
+      | DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink
+      | string
+      | DeviceEnrollmentPermissionsApplication.UnionMember2
+    >;
 
-      /**
-       * The title shown on the landing page.
-       */
-      title?: string;
-    }
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
 
+  export namespace DeviceEnrollmentPermissionsApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14964,7 +15828,7 @@ export declare namespace ApplicationCreateParams {
     }
   }
 
-  export interface DeviceEnrollmentPermissionsApplication {
+  export interface BrowserIsolationPermissionsApplication {
     /**
      * Body param: The application type.
      */
@@ -15018,9 +15882,9 @@ export declare namespace ApplicationCreateParams {
      * policies exclusive to the application.
      */
     policies?: Array<
-      | DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink
+      | BrowserIsolationPermissionsApplication.AccessAppPolicyLink
       | string
-      | DeviceEnrollmentPermissionsApplication.UnionMember2
+      | BrowserIsolationPermissionsApplication.UnionMember2
     >;
 
     /**
@@ -15031,7 +15895,7 @@ export declare namespace ApplicationCreateParams {
     session_duration?: string;
   }
 
-  export namespace DeviceEnrollmentPermissionsApplication {
+  export namespace BrowserIsolationPermissionsApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -15097,7 +15961,7 @@ export declare namespace ApplicationCreateParams {
     }
   }
 
-  export interface BrowserIsolationPermissionsApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
     /**
      * Body param: The application type.
      */
@@ -15145,15 +16009,26 @@ export declare namespace ApplicationCreateParams {
      */
     custom_pages?: Array<string>;
 
+    /**
+     * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+     * followed by .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
     /**
      * Body param: The policies that Access applies to the application, in ascending
      * order of precedence. Items can reference existing policies or create new
      * policies exclusive to the application.
      */
     policies?: Array<
-      | BrowserIsolationPermissionsApplication.AccessAppPolicyLink
+      | GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink
       | string
-      | BrowserIsolationPermissionsApplication.UnionMember2
+      | GatewayIdentityProxyEndpointApplication.UnionMember2
     >;
 
     /**
@@ -15164,7 +16039,7 @@ export declare namespace ApplicationCreateParams {
     session_duration?: string;
   }
 
-  export namespace BrowserIsolationPermissionsApplication {
+  export namespace GatewayIdentityProxyEndpointApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -15492,7 +16367,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -15625,10 +16504,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -15660,6 +16535,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -15833,6 +16721,7 @@ export type ApplicationUpdateParams =
   | ApplicationUpdateParams.AppLauncherApplication
   | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication
   | ApplicationUpdateParams.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateParams.GatewayIdentityProxyEndpointApplication
   | ApplicationUpdateParams.AccessBookmarkProps
   | ApplicationUpdateParams.InfrastructureApplication
   | ApplicationUpdateParams.BrowserRdpApplication;
@@ -15927,7 +16816,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -16042,10 +16935,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -16077,6 +16966,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -16503,7 +17405,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -16582,7 +17487,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -16697,10 +17606,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -16732,6 +17637,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -16917,7 +17835,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -16996,7 +17917,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -17111,10 +18036,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -17146,6 +18067,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -17325,7 +18259,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -17791,6 +18728,150 @@ export declare namespace ApplicationUpdateParams {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: ApplicationTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdPsParam>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+     * followed by .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: The policies that Access applies to the application, in ascending
+     * order of precedence. Items can reference existing policies or create new
+     * policies exclusive to the application.
+     */
+    policies?: Array<
+      | GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink
+      | string
+      | GatewayIdentityProxyEndpointApplication.UnionMember2
+    >;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    /**
+     * A JSON that links a reusable policy to an application.
+     */
+    export interface AccessAppPolicyLink {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+    }
+
+    export interface UnionMember2 {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+    }
+  }
+
   export interface AccessBookmarkProps {
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -18053,7 +19134,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -18186,10 +19271,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -18221,6 +19302,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -18424,6 +19518,11 @@ export interface ApplicationListParams extends V4PagePaginationArrayParams {
    * Query param: Search for apps by other listed query parameters.
    */
   search?: string;
+
+  /**
+   * Query param: Target Criteria attributes in key=value format.
+   */
+  target_attributes?: string;
 }
 
 export interface ApplicationDeleteParams {