cloudflare 5.1.0 → 6.0.0-beta.1

package/src/resources/zero-trust/access/bookmarks.ts

@@ -107,8 +107,6 @@ export interface Bookmark {
    */
   app_launcher_visible?: boolean;
 
-  created_at?: string;
-
   /**
    * The domain of the Bookmark application.
    */
@@ -123,8 +121,6 @@ export interface Bookmark {
    * The name of the Bookmark application.
    */
   name?: string;
-
-  updated_at?: string;
 }
 
 export interface BookmarkDeleteResponse {

package/src/resources/zero-trust/access/certificates/certificates.ts

@@ -277,8 +277,6 @@ export interface Certificate {
    */
   associated_hostnames?: Array<AssociatedHostnames>;
 
-  created_at?: string;
-
   expires_on?: string;
 
   /**
@@ -290,8 +288,6 @@ export interface Certificate {
    * The name of the certificate.
    */
   name?: string;
-
-  updated_at?: string;
 }
 
 export interface CertificateDeleteResponse {

package/src/resources/zero-trust/access/custom-pages.ts

@@ -161,19 +161,10 @@ export interface CustomPage {
    */
   type: 'identity_denied' | 'forbidden';
 
-  /**
-   * Number of apps the custom page is assigned to.
-   */
-  app_count?: number;
-
-  created_at?: string;
-
   /**
    * UUID.
    */
   uid?: string;
-
-  updated_at?: string;
 }
 
 export interface CustomPageWithoutHTML {
@@ -187,19 +178,10 @@ export interface CustomPageWithoutHTML {
    */
   type: 'identity_denied' | 'forbidden';
 
-  /**
-   * Number of apps the custom page is assigned to.
-   */
-  app_count?: number;
-
-  created_at?: string;
-
   /**
    * UUID.
    */
   uid?: string;
-
-  updated_at?: string;
 }
 
 export interface CustomPageDeleteResponse {
@@ -229,11 +211,6 @@ export interface CustomPageCreateParams {
    * Body param: Custom page type.
    */
   type: 'identity_denied' | 'forbidden';
-
-  /**
-   * Body param: Number of apps the custom page is assigned to.
-   */
-  app_count?: number;
 }
 
 export interface CustomPageUpdateParams {
@@ -256,11 +233,6 @@ export interface CustomPageUpdateParams {
    * Body param: Custom page type.
    */
   type: 'identity_denied' | 'forbidden';
-
-  /**
-   * Body param: Number of apps the custom page is assigned to.
-   */
-  app_count?: number;
 }
 
 export interface CustomPageListParams extends V4PagePaginationArrayParams {

package/src/resources/zero-trust/access/groups.ts

@@ -307,8 +307,6 @@ export interface GroupCreateResponse {
    */
   id?: string;
 
-  created_at?: string;
-
   /**
    * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
    * meet any of the Exclude rules.
@@ -337,8 +335,6 @@ export interface GroupCreateResponse {
    * meet all of the Require rules.
    */
   require?: Array<PoliciesAPI.AccessRule>;
-
-  updated_at?: string;
 }
 
 export interface GroupUpdateResponse {
@@ -347,8 +343,6 @@ export interface GroupUpdateResponse {
    */
   id?: string;
 
-  created_at?: string;
-
   /**
    * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
    * meet any of the Exclude rules.
@@ -377,8 +371,6 @@ export interface GroupUpdateResponse {
    * meet all of the Require rules.
    */
   require?: Array<PoliciesAPI.AccessRule>;
-
-  updated_at?: string;
 }
 
 export interface GroupListResponse {
@@ -387,8 +379,6 @@ export interface GroupListResponse {
    */
   id?: string;
 
-  created_at?: string;
-
   /**
    * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
    * meet any of the Exclude rules.
@@ -417,8 +407,6 @@ export interface GroupListResponse {
    * meet all of the Require rules.
    */
   require?: Array<PoliciesAPI.AccessRule>;
-
-  updated_at?: string;
 }
 
 export interface GroupDeleteResponse {
@@ -434,8 +422,6 @@ export interface GroupGetResponse {
    */
   id?: string;
 
-  created_at?: string;
-
   /**
    * Rules evaluated with a NOT logical operator. To match a policy, a user cannot
    * meet any of the Exclude rules.
@@ -464,8 +450,6 @@ export interface GroupGetResponse {
    * meet all of the Require rules.
    */
   require?: Array<PoliciesAPI.AccessRule>;
-
-  updated_at?: string;
 }
 
 export interface GroupCreateParams {

package/src/resources/zero-trust/access/index.ts

@@ -1,5 +1,6 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
+export { AIControls } from './ai-controls/index';
 export { Access } from './access';
 export {
   AccessUsersV4PagePaginationArray,

package/src/resources/zero-trust/access/logs/access-requests.ts

@@ -43,6 +43,20 @@ export interface AccessRequestListParams {
    */
   direction?: 'desc' | 'asc';
 
+  /**
+   * Query param: Filter by user email. Defaults to substring matching. To force
+   * exact matching, set `email_exact=true`. Example (default): `email=@example.com`
+   * returns all events with that domain. Example (exact):
+   * `email=user@example.com&email_exact=true` returns only that user.
+   */
+  email?: string;
+
+  /**
+   * Query param: When true, `email` is matched exactly instead of substring
+   * matching.
+   */
+  email_exact?: boolean;
+
   /**
    * Query param: The maximum number of log entries to retrieve.
    */
@@ -67,6 +81,11 @@ export interface AccessRequestListParams {
    * Query param: The latest event timestamp to query.
    */
   until?: string;
+
+  /**
+   * Query param: Filter by user UUID.
+   */
+  user_id?: string;
 }
 
 export declare namespace AccessRequests {

package/src/resources/zero-trust/access/service-tokens.ts

@@ -286,12 +286,12 @@ export class ServiceTokens extends APIResource {
     params: ServiceTokenRotateParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<ServiceTokenRotateResponse> {
-    const { account_id } = params;
+    const { account_id, ...body } = params;
     return (
-      this._client.post(
-        `/accounts/${account_id}/access/service_tokens/${serviceTokenId}/rotate`,
-        options,
-      ) as Core.APIPromise<{ result: ServiceTokenRotateResponse }>
+      this._client.post(`/accounts/${account_id}/access/service_tokens/${serviceTokenId}/rotate`, {
+        body,
+        ...options,
+      }) as Core.APIPromise<{ result: ServiceTokenRotateResponse }>
     )._thenUnwrap((obj) => obj.result);
   }
 }
@@ -310,8 +310,6 @@ export interface ServiceToken {
    */
   client_id?: string;
 
-  created_at?: string;
-
   /**
    * The duration for how long the service token will be valid. Must be in the format
    * `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
@@ -321,14 +319,10 @@ export interface ServiceToken {
 
   expires_at?: string;
 
-  last_seen_at?: string;
-
   /**
    * The name of the service token.
    */
   name?: string;
-
-  updated_at?: string;
 }
 
 export interface ServiceTokenCreateResponse {
@@ -349,8 +343,6 @@ export interface ServiceTokenCreateResponse {
    */
   client_secret?: string;
 
-  created_at?: string;
-
   /**
    * The duration for how long the service token will be valid. Must be in the format
    * `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
@@ -362,8 +354,6 @@ export interface ServiceTokenCreateResponse {
    * The name of the service token.
    */
   name?: string;
-
-  updated_at?: string;
 }
 
 export interface ServiceTokenRotateResponse {
@@ -384,8 +374,6 @@ export interface ServiceTokenRotateResponse {
    */
   client_secret?: string;
 
-  created_at?: string;
-
   /**
    * The duration for how long the service token will be valid. Must be in the format
    * `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
@@ -397,8 +385,6 @@ export interface ServiceTokenRotateResponse {
    * The name of the service token.
    */
   name?: string;
-
-  updated_at?: string;
 }
 
 export interface ServiceTokenCreateParams {
@@ -419,12 +405,29 @@ export interface ServiceTokenCreateParams {
    */
   zone_id?: string;
 
+  /**
+   * Body param: A version number identifying the current `client_secret` associated
+   * with the service token. Incrementing it triggers a rotation; the previous secret
+   * will still be accepted until the time indicated by
+   * `previous_client_secret_expires_at`.
+   */
+  client_secret_version?: number;
+
   /**
    * Body param: The duration for how long the service token will be valid. Must be
    * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
    * m, h. The default is 1 year in hours (8760h).
    */
   duration?: string;
+
+  /**
+   * Body param: The expiration of the previous `client_secret`. This can be modified
+   * at any point after a rotation. For example, you may extend it further into the
+   * future if you need more time to update services with the new secret; or move it
+   * into the past to immediately invalidate the previous token in case of
+   * compromise.
+   */
+  previous_client_secret_expires_at?: string;
 }
 
 export interface ServiceTokenUpdateParams {
@@ -440,6 +443,14 @@ export interface ServiceTokenUpdateParams {
    */
   zone_id?: string;
 
+  /**
+   * Body param: A version number identifying the current `client_secret` associated
+   * with the service token. Incrementing it triggers a rotation; the previous secret
+   * will still be accepted until the time indicated by
+   * `previous_client_secret_expires_at`.
+   */
+  client_secret_version?: number;
+
   /**
    * Body param: The duration for how long the service token will be valid. Must be
    * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
@@ -451,6 +462,15 @@ export interface ServiceTokenUpdateParams {
    * Body param: The name of the service token.
    */
   name?: string;
+
+  /**
+   * Body param: The expiration of the previous `client_secret`. This can be modified
+   * at any point after a rotation. For example, you may extend it further into the
+   * future if you need more time to update services with the new secret; or move it
+   * into the past to immediately invalidate the previous token in case of
+   * compromise.
+   */
+  previous_client_secret_expires_at?: string;
 }
 
 export interface ServiceTokenListParams extends V4PagePaginationArrayParams {
@@ -510,9 +530,16 @@ export interface ServiceTokenRefreshParams {
 
 export interface ServiceTokenRotateParams {
   /**
-   * Identifier.
+   * Path param: Identifier.
    */
   account_id: string;
+
+  /**
+   * Body param: The expiration of the previous `client_secret`. If not provided, it
+   * defaults to the current timestamp in order to immediately expire the previous
+   * secret.
+   */
+  previous_client_secret_expires_at?: string;
 }
 
 ServiceTokens.ServiceTokensV4PagePaginationArray = ServiceTokensV4PagePaginationArray;

package/src/resources/zero-trust/access/tags.ts

@@ -127,15 +127,6 @@ export interface Tag {
    * The name of the tag
    */
   name: string;
-
-  /**
-   * The number of applications that have this tag
-   */
-  app_count?: number;
-
-  created_at?: string;
-
-  updated_at?: string;
 }
 
 export interface TagDeleteResponse {

package/src/resources/zero-trust/devices/devices.ts

@@ -253,7 +253,9 @@ export interface Device {
   os_version?: string;
 
   /**
-   * The operating system version extra parameter.
+   * Additional operating system version details. For Windows, the UBR (Update Build
+   * Revision). For Mac or iOS, the Product Version Extra. For Linux, the
+   * distribution name and version.
    */
   os_version_extra?: string;
 

package/src/resources/zero-trust/devices/devices_.ts

@@ -72,12 +72,12 @@ export class Devices extends APIResource {
     params: DeviceGetParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<DeviceGetResponse> {
-    const { account_id } = params;
+    const { account_id, ...query } = params;
     return (
-      this._client.get(
-        `/accounts/${account_id}/devices/physical-devices/${deviceId}`,
-        options,
-      ) as Core.APIPromise<{ result: DeviceGetResponse }>
+      this._client.get(`/accounts/${account_id}/devices/physical-devices/${deviceId}`, {
+        query,
+        ...options,
+      }) as Core.APIPromise<{ result: DeviceGetResponse }>
     )._thenUnwrap((obj) => obj.result);
   }
 
@@ -165,6 +165,11 @@ export interface DeviceListResponse {
    */
   hardware_id?: string | null;
 
+  /**
+   * The last seen registration for the device.
+   */
+  last_seen_registration?: DeviceListResponse.LastSeenRegistration | null;
+
   /**
    * The last user to use the WARP device.
    */
@@ -191,13 +196,15 @@ export interface DeviceListResponse {
   os_version?: string | null;
 
   /**
-   * Additional operating system version data. For macOS or iOS, the Product Version
-   * Extra. For Linux, the kernel release version.
+   * Additional operating system version details. For Windows, the UBR (Update Build
+   * Revision). For Mac or iOS, the Product Version Extra. For Linux, the
+   * distribution name and version.
    */
   os_version_extra?: string | null;
 
   /**
-   * The public IP address of the WARP client.
+   * @deprecated **Deprecated**: IP information is provided by DEX - see
+   * https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
    */
   public_ip?: string | null;
 
@@ -208,6 +215,49 @@ export interface DeviceListResponse {
 }
 
 export namespace DeviceListResponse {
+  /**
+   * The last seen registration for the device.
+   */
+  export interface LastSeenRegistration {
+    /**
+     * A summary of the device profile evaluated for the registration.
+     */
+    policy?: LastSeenRegistration.Policy | null;
+  }
+
+  export namespace LastSeenRegistration {
+    /**
+     * A summary of the device profile evaluated for the registration.
+     */
+    export interface Policy {
+      /**
+       * The ID of the device settings profile.
+       */
+      id: string;
+
+      /**
+       * Whether the device settings profile is the default profile for the account.
+       */
+      default: boolean;
+
+      /**
+       * Whether the device settings profile was deleted.
+       */
+      deleted: boolean;
+
+      /**
+       * The name of the device settings profile.
+       */
+      name: string;
+
+      /**
+       * The RFC3339 timestamp of when the device settings profile last changed for the
+       * registration.
+       */
+      updated_at: string;
+    }
+  }
+
   /**
    * The last user to use the WARP device.
    */
@@ -286,6 +336,11 @@ export interface DeviceGetResponse {
    */
   hardware_id?: string | null;
 
+  /**
+   * The last seen registration for the device.
+   */
+  last_seen_registration?: DeviceGetResponse.LastSeenRegistration | null;
+
   /**
    * The last user to use the WARP device.
    */
@@ -312,13 +367,15 @@ export interface DeviceGetResponse {
   os_version?: string | null;
 
   /**
-   * Additional operating system version data. For macOS or iOS, the Product Version
-   * Extra. For Linux, the kernel release version.
+   * Additional operating system version details. For Windows, the UBR (Update Build
+   * Revision). For Mac or iOS, the Product Version Extra. For Linux, the
+   * distribution name and version.
    */
   os_version_extra?: string | null;
 
   /**
-   * The public IP address of the WARP client.
+   * @deprecated **Deprecated**: IP information is provided by DEX - see
+   * https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
    */
   public_ip?: string | null;
 
@@ -329,6 +386,49 @@ export interface DeviceGetResponse {
 }
 
 export namespace DeviceGetResponse {
+  /**
+   * The last seen registration for the device.
+   */
+  export interface LastSeenRegistration {
+    /**
+     * A summary of the device profile evaluated for the registration.
+     */
+    policy?: LastSeenRegistration.Policy | null;
+  }
+
+  export namespace LastSeenRegistration {
+    /**
+     * A summary of the device profile evaluated for the registration.
+     */
+    export interface Policy {
+      /**
+       * The ID of the device settings profile.
+       */
+      id: string;
+
+      /**
+       * Whether the device settings profile is the default profile for the account.
+       */
+      default: boolean;
+
+      /**
+       * Whether the device settings profile was deleted.
+       */
+      deleted: boolean;
+
+      /**
+       * The name of the device settings profile.
+       */
+      name: string;
+
+      /**
+       * The RFC3339 timestamp of when the device settings profile last changed for the
+       * registration.
+       */
+      updated_at: string;
+    }
+  }
+
   /**
    * The last user to use the WARP device.
    */
@@ -370,7 +470,9 @@ export interface DeviceListParams extends CursorPaginationParams {
   active_registrations?: 'include' | 'only' | 'exclude';
 
   /**
-   * Query param:
+   * Query param: Comma-separated list of additional information that should be
+   * included in the device response. Supported values are:
+   * "last_seen_registration.policy".
    */
   include?: string;
 
@@ -428,7 +530,17 @@ export interface DeviceDeleteParams {
 }
 
 export interface DeviceGetParams {
+  /**
+   * Path param:
+   */
   account_id: string;
+
+  /**
+   * Query param: Comma-separated list of additional information that should be
+   * included in the device response. Supported values are:
+   * "last_seen_registration.policy".
+   */
+  include?: string;
 }
 
 export interface DeviceRevokeParams {

package/src/resources/zero-trust/devices/posture/integrations.ts

@@ -17,7 +17,7 @@ export class Integrations extends APIResource {
    *       config: {
    *         api_url: 'https://as123.awmdm.com/API',
    *         auth_url:
-   *           'https://na.uemauth.vmwservices.com/connect/token',
+   *           'https://na.uemauth.workspaceone.com/connect/token',
    *         client_id: 'example client id',
    *         client_secret: 'example client secret',
    *       },

package/src/resources/zero-trust/devices/posture/posture.ts

@@ -290,6 +290,7 @@ export type DeviceInput =
   | DeviceInput.TeamsDevicesApplicationInputRequest
   | ClientCertificateInput
   | DeviceInput.TeamsDevicesClientCertificateV2InputRequest
+  | DeviceInput.TeamsDevicesAntivirusInputRequest
   | WorkspaceOneInput
   | CrowdstrikeInput
   | IntuneInput
@@ -401,6 +402,13 @@ export namespace DeviceInput {
     }
   }
 
+  export interface TeamsDevicesAntivirusInputRequest {
+    /**
+     * Number of days that the antivirus should be updated within.
+     */
+    update_window_days?: number;
+  }
+
   export interface TeamsDevicesCustomS2sInputRequest {
     /**
      * Posture Integration ID.
@@ -435,6 +443,7 @@ export type DeviceInputParam =
   | DeviceInputParam.TeamsDevicesApplicationInputRequest
   | ClientCertificateInputParam
   | DeviceInputParam.TeamsDevicesClientCertificateV2InputRequest
+  | DeviceInputParam.TeamsDevicesAntivirusInputRequest
   | WorkspaceOneInputParam
   | CrowdstrikeInputParam
   | IntuneInputParam
@@ -546,6 +555,13 @@ export namespace DeviceInputParam {
     }
   }
 
+  export interface TeamsDevicesAntivirusInputRequest {
+    /**
+     * Number of days that the antivirus should be updated within.
+     */
+    update_window_days?: number;
+  }
+
   export interface TeamsDevicesCustomS2sInputRequest {
     /**
      * Posture Integration ID.
@@ -628,6 +644,7 @@ export interface DevicePostureRule {
     | 'domain_joined'
     | 'client_certificate'
     | 'client_certificate_v2'
+    | 'antivirus'
     | 'unique_client_id'
     | 'kolide'
     | 'tanium_s2s'
@@ -849,8 +866,9 @@ export interface OSVersionInput {
   os_distro_revision?: string;
 
   /**
-   * Additional version data. For Mac or iOS, the Product Version Extra. For Linux,
-   * the kernel release version. (Mac, iOS, and Linux only).
+   * Additional operating system version details. For Windows, the UBR (Update Build
+   * Revision). For Mac or iOS, the Product Version Extra. For Linux, the
+   * distribution name and version.
    */
   os_version_extra?: string;
 }
@@ -882,8 +900,9 @@ export interface OSVersionInputParam {
   os_distro_revision?: string;
 
   /**
-   * Additional version data. For Mac or iOS, the Product Version Extra. For Linux,
-   * the kernel release version. (Mac, iOS, and Linux only).
+   * Additional operating system version details. For Windows, the UBR (Update Build
+   * Revision). For Mac or iOS, the Product Version Extra. For Linux, the
+   * distribution name and version.
    */
   os_version_extra?: string;
 }
@@ -1168,6 +1187,7 @@ export interface PostureCreateParams {
     | 'domain_joined'
     | 'client_certificate'
     | 'client_certificate_v2'
+    | 'antivirus'
     | 'unique_client_id'
     | 'kolide'
     | 'tanium_s2s'
@@ -1234,6 +1254,7 @@ export interface PostureUpdateParams {
     | 'domain_joined'
     | 'client_certificate'
     | 'client_certificate_v2'
+    | 'antivirus'
     | 'unique_client_id'
     | 'kolide'
     | 'tanium_s2s'