cloudflare 5.1.0 → 6.0.0-beta.1

package/src/resources/zero-trust/gateway/rules.ts

@@ -7,7 +7,7 @@ import { SinglePage } from '../../../pagination';
 
 export class Rules extends APIResource {
   /**
-   * Creates a new Zero Trust Gateway rule.
+   * Create a new Zero Trust Gateway rule.
    *
    * @example
    * ```ts
@@ -29,7 +29,7 @@ export class Rules extends APIResource {
   }
 
   /**
-   * Updates a configured Zero Trust Gateway rule.
+   * Update a configured Zero Trust Gateway rule.
    *
    * @example
    * ```ts
@@ -59,7 +59,7 @@ export class Rules extends APIResource {
   }
 
   /**
-   * Fetches the Zero Trust Gateway rules for an account.
+   * List Zero Trust Gateway rules for an account.
    *
    * @example
    * ```ts
@@ -80,7 +80,7 @@ export class Rules extends APIResource {
   }
 
   /**
-   * Deletes a Zero Trust Gateway rule.
+   * Delete a Zero Trust Gateway rule.
    *
    * @example
    * ```ts
@@ -104,7 +104,7 @@ export class Rules extends APIResource {
   }
 
   /**
-   * Fetches a single Zero Trust Gateway rule.
+   * Get a single Zero Trust Gateway rule.
    *
    * @example
    * ```ts
@@ -125,11 +125,35 @@ export class Rules extends APIResource {
   }
 
   /**
-   * Resets the expiration of a Zero Trust Gateway Rule if its duration has elapsed
-   * and it has a default duration.
+   * List Zero Trust Gateway rules for the parent account of an account in the MSP
+   * configuration.
    *
-   * The Zero Trust Gateway Rule must have values for both `expiration.expires_at`
-   * and `expiration.duration`.
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const gatewayRule of client.zeroTrust.gateway.rules.listTenant(
+   *   { account_id: '699d98642c564d2e855e9661899b7252' },
+   * )) {
+   *   // ...
+   * }
+   * ```
+   */
+  listTenant(
+    params: RuleListTenantParams,
+    options?: Core.RequestOptions,
+  ): Core.PagePromise<GatewayRulesSinglePage, GatewayRule> {
+    const { account_id } = params;
+    return this._client.getAPIList(
+      `/accounts/${account_id}/gateway/rules/tenant`,
+      GatewayRulesSinglePage,
+      options,
+    );
+  }
+
+  /**
+   * Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and
+   * it has a default duration. The Zero Trust Gateway Rule must have values for both
+   * `expiration.expires_at` and `expiration.duration`.
    *
    * @example
    * ```ts
@@ -159,23 +183,24 @@ export class GatewayRulesSinglePage extends SinglePage<GatewayRule> {}
 
 export interface DNSResolverSettingsV4 {
   /**
-   * IPv4 address of upstream resolver.
+   * Specify the IPv4 address of the upstream resolver.
    */
   ip: string;
 
   /**
-   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   * Specify a port number to use for the upstream resolver. Defaults to 53 if
+   * unspecified.
    */
   port?: number;
 
   /**
-   * Whether to connect to this resolver over a private network. Must be set when
-   * vnet_id is set.
+   * Indicate whether to connect to this resolver over a private network. Must set
+   * when vnet_id set.
    */
   route_through_private_network?: boolean;
 
   /**
-   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * Specify an optional virtual network for this resolver. Uses default virtual
    * network id if omitted.
    */
   vnet_id?: string;
@@ -183,23 +208,24 @@ export interface DNSResolverSettingsV4 {
 
 export interface DNSResolverSettingsV4Param {
   /**
-   * IPv4 address of upstream resolver.
+   * Specify the IPv4 address of the upstream resolver.
    */
   ip: string;
 
   /**
-   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   * Specify a port number to use for the upstream resolver. Defaults to 53 if
+   * unspecified.
    */
   port?: number;
 
   /**
-   * Whether to connect to this resolver over a private network. Must be set when
-   * vnet_id is set.
+   * Indicate whether to connect to this resolver over a private network. Must set
+   * when vnet_id set.
    */
   route_through_private_network?: boolean;
 
   /**
-   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * Specify an optional virtual network for this resolver. Uses default virtual
    * network id if omitted.
    */
   vnet_id?: string;
@@ -207,23 +233,24 @@ export interface DNSResolverSettingsV4Param {
 
 export interface DNSResolverSettingsV6 {
   /**
-   * IPv6 address of upstream resolver.
+   * Specify the IPv6 address of the upstream resolver.
    */
   ip: string;
 
   /**
-   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   * Specify a port number to use for the upstream resolver. Defaults to 53 if
+   * unspecified.
    */
   port?: number;
 
   /**
-   * Whether to connect to this resolver over a private network. Must be set when
-   * vnet_id is set.
+   * Indicate whether to connect to this resolver over a private network. Must set
+   * when vnet_id set.
    */
   route_through_private_network?: boolean;
 
   /**
-   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * Specify an optional virtual network for this resolver. Uses default virtual
    * network id if omitted.
    */
   vnet_id?: string;
@@ -231,42 +258,43 @@ export interface DNSResolverSettingsV6 {
 
 export interface DNSResolverSettingsV6Param {
   /**
-   * IPv6 address of upstream resolver.
+   * Specify the IPv6 address of the upstream resolver.
    */
   ip: string;
 
   /**
-   * A port number to use for upstream resolver. Defaults to 53 if unspecified.
+   * Specify a port number to use for the upstream resolver. Defaults to 53 if
+   * unspecified.
    */
   port?: number;
 
   /**
-   * Whether to connect to this resolver over a private network. Must be set when
-   * vnet_id is set.
+   * Indicate whether to connect to this resolver over a private network. Must set
+   * when vnet_id set.
    */
   route_through_private_network?: boolean;
 
   /**
-   * Optionally specify a virtual network for this resolver. Uses default virtual
+   * Specify an optional virtual network for this resolver. Uses default virtual
    * network id if omitted.
    */
   vnet_id?: string;
 }
 
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilter = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 
 /**
- * The protocol or layer to use.
+ * Specify the protocol or layer to use.
  */
 export type GatewayFilterParam = 'http' | 'dns' | 'l4' | 'egress' | 'dns_resolver';
 
 export interface GatewayRule {
   /**
-   * The action to perform when the associated traffic, identity, and device posture
-   * expressions are either absent or evaluate to `true`.
+   * Specify the action to perform when the associated traffic, identity, and device
+   * posture expressions either absent or evaluate to `true`.
    */
   action:
     | 'on'
@@ -287,318 +315,345 @@ export interface GatewayRule {
     | 'redirect';
 
   /**
-   * True if the rule is enabled.
+   * Specify whether the rule is enabled.
    */
   enabled: boolean;
 
   /**
-   * The protocol or layer to evaluate the traffic, identity, and device. posture
-   * expressions.
+   * Specify the protocol or layer to evaluate the traffic, identity, and device
+   * posture expressions. Can only contain a single value.
    */
   filters: Array<GatewayFilter>;
 
   /**
-   * The name of the rule.
+   * Specify the rule name.
    */
   name: string;
 
   /**
-   * Precedence sets the order of your rules. Lower values indicate higher
-   * precedence. At each processing phase, applicable rules are evaluated in
-   * ascending order of this value. Refer to
+   * Set the order of your rules. Lower values indicate higher precedence. At each
+   * processing phase, evaluate applicable rules in ascending order of this value.
+   * Refer to
    * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-   * docs on how to manage precedence via Terraform.
+   * to manage precedence via Terraform.
    */
   precedence: number;
 
   /**
-   * The wirefilter expression used for traffic matching. The API automatically
-   * formats and sanitizes this expression. This returns a normalized version that
-   * may differ from your input and cause Terraform state drift.
+   * Specify the wirefilter expression used for traffic matching. The API
+   * automatically formats and sanitizes expressions before storing them. To prevent
+   * Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   traffic: string;
 
   /**
-   * The API resource UUID.
+   * Identify the API resource with a UUID.
    */
   id?: string;
 
   created_at?: string;
 
   /**
-   * Date of deletion, if any.
+   * Indicate the date of deletion, if any.
    */
   deleted_at?: string | null;
 
   /**
-   * The description of the rule.
+   * Specify the rule description.
    */
   description?: string;
 
   /**
-   * The wirefilter expression used for device posture check matching. The API
-   * automatically formats and sanitizes this expression. This returns a normalized
-   * version that may differ from your input and cause Terraform state drift.
+   * Specify the wirefilter expression used for device posture check. The API
+   * automatically formats and sanitizes expressions before storing them. To prevent
+   * Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   device_posture?: string;
 
   /**
-   * The expiration time stamp and default duration of a DNS policy. Takes precedence
-   * over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Defines the expiration time stamp and default duration of a DNS policy. Takes
+   * precedence over the policy's `schedule` configuration, if any. This does not
+   * apply to HTTP or network policies. Settable only for `dns` rules.
    */
   expiration?: GatewayRule.Expiration | null;
 
   /**
-   * The wirefilter expression used for identity matching. The API automatically
-   * formats and sanitizes this expression. This returns a normalized version that
-   * may differ from your input and cause Terraform state drift.
+   * Specify the wirefilter expression used for identity matching. The API
+   * automatically formats and sanitizes expressions before storing them. To prevent
+   * Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   identity?: string;
 
   /**
-   * The rule cannot be shared via the Orgs API.
-   */
-  not_sharable?: boolean;
-
-  /**
-   * The rule was shared via the Orgs API and cannot be edited by the current
-   * account.
+   * Indicate that this rule is shared via the Orgs API and read only.
    */
   read_only?: boolean;
 
   /**
-   * Additional settings that modify the rule's action.
+   * Defines settings for this rule. Settings apply only to specific rule types and
+   * must use compatible selectors. If Terraform detects drift, confirm the setting
+   * supports your rule type and check whether the API modifies the value. Use
+   * API-returned values in your configuration to prevent drift.
    */
   rule_settings?: RuleSetting;
 
   /**
-   * The schedule for activating DNS policies. This does not apply to HTTP or network
-   * policies.
+   * Defines the schedule for activating DNS policies. Settable only for `dns` and
+   * `dns_resolver` rules.
    */
   schedule?: Schedule | null;
 
   /**
-   * account tag of account that created the rule.
+   * Indicate that this rule is sharable via the Orgs API.
+   */
+  sharable?: boolean;
+
+  /**
+   * Provide the account tag of the account that created the rule.
    */
   source_account?: string;
 
   updated_at?: string;
 
   /**
-   * version number of the rule.
+   * Indicate the version number of the rule(read-only).
    */
   version?: number;
 
   /**
-   * Warning for a misconfigured rule, if any.
+   * Indicate a warning for a misconfigured rule, if any.
    */
   warning_status?: string | null;
 }
 
 export namespace GatewayRule {
   /**
-   * The expiration time stamp and default duration of a DNS policy. Takes precedence
-   * over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Defines the expiration time stamp and default duration of a DNS policy. Takes
+   * precedence over the policy's `schedule` configuration, if any. This does not
+   * apply to HTTP or network policies. Settable only for `dns` rules.
    */
   export interface Expiration {
     /**
-     * The time stamp at which the policy will expire and cease to be applied.
-     *
-     * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-     * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-     * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-     *
-     * Policies with an expiration do not consider the timezone of clients they are
-     * applied to, and expire "globally" at the point given by their `expires_at`
-     * value.
+     * Show the timestamp when the policy expires and stops applying. The value must
+     * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+     * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+     * a trailing Z. Expiration policies ignore client timezones and expire globally at
+     * the specified expires_at time.
      */
     expires_at: string;
 
     /**
-     * The default duration a policy will be active in minutes. Must be set in order to
+     * Defines the default duration a policy active in minutes. Must set in order to
      * use the `reset_expiration` endpoint on this rule.
      */
     duration?: number;
 
     /**
-     * Whether the policy has expired.
+     * Indicates whether the policy is expired.
      */
     expired?: boolean;
   }
 }
 
 /**
- * Additional settings that modify the rule's action.
+ * Defines settings for this rule. Settings apply only to specific rule types and
+ * must use compatible selectors. If Terraform detects drift, confirm the setting
+ * supports your rule type and check whether the API modifies the value. Use
+ * API-returned values in your configuration to prevent drift.
  */
 export interface RuleSetting {
   /**
-   * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-   * header names, pointing to an array with its header value(s).
+   * Add custom headers to allowed requests as key-value pairs. Use header names as
+   * keys that map to arrays of header values. Settable only for `http` rules with
+   * the action set to `allow`.
    */
   add_headers?: { [key: string]: Array<string> } | null;
 
   /**
-   * Set by parent MSP accounts to enable their children to bypass this rule.
+   * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+   * this. this rule. Settable for all types of rules.
    */
   allow_child_bypass?: boolean | null;
 
   /**
-   * Settings for the Audit SSH action.
+   * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+   * `audit_ssh` action.
    */
   audit_ssh?: RuleSetting.AuditSSH | null;
 
   /**
-   * Configure how browser isolation behaves.
+   * Configure browser isolation behavior. Settable only for `http` rules with the
+   * action set to `isolate`.
    */
   biso_admin_controls?: RuleSetting.BISOAdminControls;
 
   /**
-   * Custom block page settings. If missing/null, blocking will use the the account
-   * settings.
+   * Configure custom block page settings. If missing or null, use the account
+   * settings. Settable only for `http` rules with the action set to `block`.
    */
   block_page?: RuleSetting.BlockPage | null;
 
   /**
-   * Enable the custom block page.
+   * Enable the custom block page. Settable only for `dns` rules with action `block`.
    */
   block_page_enabled?: boolean;
 
   /**
-   * The text describing why this block occurred, displayed on the custom block page
-   * (if enabled).
+   * Explain why the rule blocks the request. The custom block page shows this text
+   * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+   * set to `block`.
    */
   block_reason?: string | null;
 
   /**
-   * Set by children MSP accounts to bypass their parent's rules.
+   * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+   * accounts can set this. Settable for all types of rules.
    */
   bypass_parent_rule?: boolean | null;
 
   /**
-   * Configure how session check behaves.
+   * Configure session check behavior. Settable only for `l4` and `http` rules with
+   * the action set to `allow`.
    */
   check_session?: RuleSetting.CheckSession | null;
 
   /**
-   * Add your own custom resolvers to route queries that match the resolver policy.
-   * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-   * are set. DNS queries will route to the address closest to their origin. Only
-   * valid when a rule's action is set to 'resolve'.
+   * Configure custom resolvers to route queries that match the resolver policy.
+   * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+   * settings. DNS queries get routed to the address closest to their origin. Only
+   * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+   * rules.
    */
   dns_resolvers?: RuleSetting.DNSResolvers | null;
 
   /**
    * Configure how Gateway Proxy traffic egresses. You can enable this setting for
    * rules with Egress actions and filters, or omit it to indicate local egress via
-   * WARP IPs.
+   * WARP IPs. Settable only for `egress` rules.
    */
   egress?: RuleSetting.Egress | null;
 
   /**
-   * Set to true, to ignore the category matches at CNAME domains in a response. If
-   * unchecked, the categories in this rule will be checked against all the CNAME
-   * domain categories in a response.
+   * Configure whether a copy of the HTTP request will be sent to storage when the
+   * rule matches.
+   */
+  forensic_copy?: RuleSetting.ForensicCopy | null;
+
+  /**
+   * Ignore category matches at CNAME domains in a response. When off, evaluate
+   * categories in this rule against all CNAME domain categories in the response.
+   * Settable only for `dns` and `dns_resolver` rules.
    */
   ignore_cname_category_matches?: boolean;
 
   /**
-   * INSECURE - disable DNSSEC validation (for Allow actions).
+   * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+   * Settable only for `dns` rules.
    */
   insecure_disable_dnssec_validation?: boolean;
 
   /**
-   * Set to true to enable IPs in DNS resolver category blocks. By default categories
-   * only block based on domain names.
+   * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+   * categories unless you enable this setting. Settable only for `dns` and
+   * `dns_resolver` rules.
    */
   ip_categories?: boolean;
 
   /**
-   * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-   * indicator feeds only block based on domain names.
+   * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+   * indicator feeds block only domain names. Settable only for `dns` and
+   * `dns_resolver` rules.
    */
   ip_indicator_feeds?: boolean;
 
   /**
-   * Send matching traffic to the supplied destination IP address. and port.
+   * Send matching traffic to the supplied destination IP address and port. Settable
+   * only for `l4` rules with the action set to `l4_override`.
    */
   l4override?: RuleSetting.L4override | null;
 
   /**
-   * Configure a notification to display on the user's device when this rule is
-   * matched.
+   * Configure a notification to display on the user's device when this rule matched.
+   * Settable for all types of rules with the action set to `block`.
    */
   notification_settings?: RuleSetting.NotificationSettings | null;
 
   /**
-   * Override matching DNS queries with a hostname.
+   * Defines a hostname for override, for the matching DNS queries. Settable only for
+   * `dns` rules with the action set to `override`.
    */
   override_host?: string;
 
   /**
-   * Override matching DNS queries with an IP or set of IPs.
+   * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+   * for `dns` rules with the action set to `override`.
    */
   override_ips?: Array<string> | null;
 
   /**
-   * Configure DLP payload logging.
+   * Configure DLP payload logging. Settable only for `http` rules.
    */
   payload_log?: RuleSetting.PayloadLog | null;
 
   /**
-   * Settings that apply to quarantine rules.
+   * Configure settings that apply to quarantine rules. Settable only for `http`
+   * rules.
    */
   quarantine?: RuleSetting.Quarantine | null;
 
   /**
-   * Settings that apply to redirect rules.
+   * Apply settings to redirect rules. Settable only for `http` rules with the action
+   * set to `redirect`.
    */
   redirect?: RuleSetting.Redirect | null;
 
   /**
    * Configure to forward the query to the internal DNS service, passing the
-   * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-   * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-   * set to 'resolve'.
+   * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+   * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+   * 'resolve'. Settable only for `dns_resolver` rules.
    */
   resolve_dns_internally?: RuleSetting.ResolveDNSInternally | null;
 
   /**
    * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-   * resolver. Cannot be set when 'dns_resolvers' are specified or
-   * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-   * 'resolve'.
+   * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+   * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+   * `dns_resolver` rules.
    */
   resolve_dns_through_cloudflare?: boolean | null;
 
   /**
-   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   * Configure behavior when an upstream certificate is invalid or an SSL error
+   * occurs. Settable only for `http` rules with the action set to `allow`.
    */
   untrusted_cert?: RuleSetting.UntrustedCERT | null;
 }
 
 export namespace RuleSetting {
   /**
-   * Settings for the Audit SSH action.
+   * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+   * `audit_ssh` action.
    */
   export interface AuditSSH {
     /**
-     * Enable to turn on SSH command logging.
+     * Enable SSH command logging.
      */
     command_logging?: boolean;
   }
 
   /**
-   * Configure how browser isolation behaves.
+   * Configure browser isolation behavior. Settable only for `http` rules with the
+   * action set to `isolate`.
    */
   export interface BISOAdminControls {
     /**
-     * Configure whether copy is enabled or not. When set with "remote_only", copying
-     * isolated content from the remote browser to the user's local clipboard is
-     * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+     * Configure copy behavior. If set to remote_only, users cannot copy isolated
+     * content from the remote browser to the local clipboard. If this field is absent,
+     * copying remains enabled. Applies only when version == "v2".
      */
     copy?: 'enabled' | 'disabled' | 'remote_only';
 
@@ -618,8 +673,8 @@ export namespace RuleSetting {
     dk?: boolean;
 
     /**
-     * Configure whether downloading enabled or not. When set with "remote_only",
-     * downloads are only available for viewing. Only applies when `version == "v2"`.
+     * Configure download behavior. When set to remote_only, users can view downloads
+     * but cannot save them. Applies only when version == "v2".
      */
     download?: 'enabled' | 'disabled' | 'remote_only';
 
@@ -634,74 +689,75 @@ export namespace RuleSetting {
     du?: boolean;
 
     /**
-     * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-     * is enabled. Only applies when `version == "v2"`.
+     * Configure keyboard usage behavior. If this field is absent, keyboard usage
+     * remains enabled. Applies only when version == "v2".
      */
     keyboard?: 'enabled' | 'disabled';
 
     /**
-     * Configure whether pasting is enabled or not. When set with "remote_only",
-     * pasting content from the user's local clipboard into isolated pages is disabled.
-     * When absent, paste is enabled. Only applies when `version == "v2"`.
+     * Configure paste behavior. If set to remote_only, users cannot paste content from
+     * the local clipboard into isolated pages. If this field is absent, pasting
+     * remains enabled. Applies only when version == "v2".
      */
     paste?: 'enabled' | 'disabled' | 'remote_only';
 
     /**
-     * Configure whether printing is enabled or not. When absent, printing is enabled.
-     * Only applies when `version == "v2"`.
+     * Configure print behavior. Default, Printing is enabled. Applies only when
+     * version == "v2".
      */
     printing?: 'enabled' | 'disabled';
 
     /**
-     * Configure whether uploading is enabled or not. When absent, uploading is
-     * enabled. Only applies when `version == "v2"`.
+     * Configure upload behavior. If this field is absent, uploading remains enabled.
+     * Applies only when version == "v2".
      */
     upload?: 'enabled' | 'disabled';
 
     /**
-     * Indicates which version of the browser isolation controls should apply.
+     * Indicate which version of the browser isolation controls should apply.
      */
     version?: 'v1' | 'v2';
   }
 
   /**
-   * Custom block page settings. If missing/null, blocking will use the the account
-   * settings.
+   * Configure custom block page settings. If missing or null, use the account
+   * settings. Settable only for `http` rules with the action set to `block`.
    */
   export interface BlockPage {
     /**
-     * URI to which the user will be redirected.
+     * Specify the URI to which the user is redirected.
      */
     target_uri: string;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Specify whether to pass the context information as query parameters.
      */
     include_context?: boolean;
   }
 
   /**
-   * Configure how session check behaves.
+   * Configure session check behavior. Settable only for `l4` and `http` rules with
+   * the action set to `allow`.
    */
   export interface CheckSession {
     /**
-     * Configure how fresh the session needs to be to be considered valid. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Sets the required session freshness threshold. The API returns a normalized
+     * version of this value.
      */
     duration?: string;
 
     /**
-     * Set to true to enable session enforcement.
+     * Enable session enforcement.
      */
     enforce?: boolean;
   }
 
   /**
-   * Add your own custom resolvers to route queries that match the resolver policy.
-   * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-   * are set. DNS queries will route to the address closest to their origin. Only
-   * valid when a rule's action is set to 'resolve'.
+   * Configure custom resolvers to route queries that match the resolver policy.
+   * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+   * settings. DNS queries get routed to the address closest to their origin. Only
+   * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+   * rules.
    */
   export interface DNSResolvers {
     ipv4?: Array<RulesAPI.DNSResolverSettingsV4>;
@@ -712,54 +768,65 @@ export namespace RuleSetting {
   /**
    * Configure how Gateway Proxy traffic egresses. You can enable this setting for
    * rules with Egress actions and filters, or omit it to indicate local egress via
-   * WARP IPs.
+   * WARP IPs. Settable only for `egress` rules.
    */
   export interface Egress {
     /**
-     * The IPv4 address to be used for egress.
+     * Specify the IPv4 address to use for egress.
      */
     ipv4?: string;
 
     /**
-     * The fallback IPv4 address to be used for egress in the event of an error
-     * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-     * WARP IPs.
+     * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+     * Set '0.0.0.0' to indicate local egress via WARP IPs.
      */
     ipv4_fallback?: string;
 
     /**
-     * The IPv6 range to be used for egress.
+     * Specify the IPv6 range to use for egress.
      */
     ipv6?: string;
   }
 
   /**
-   * Send matching traffic to the supplied destination IP address. and port.
+   * Configure whether a copy of the HTTP request will be sent to storage when the
+   * rule matches.
+   */
+  export interface ForensicCopy {
+    /**
+     * Enable sending the copy to storage.
+     */
+    enabled?: boolean;
+  }
+
+  /**
+   * Send matching traffic to the supplied destination IP address and port. Settable
+   * only for `l4` rules with the action set to `l4_override`.
    */
   export interface L4override {
     /**
-     * IPv4 or IPv6 address.
+     * Defines the IPv4 or IPv6 address.
      */
     ip?: string;
 
     /**
-     * A port number to use for TCP/UDP overrides.
+     * Defines a port number to use for TCP/UDP overrides.
      */
     port?: number;
   }
 
   /**
-   * Configure a notification to display on the user's device when this rule is
-   * matched.
+   * Configure a notification to display on the user's device when this rule matched.
+   * Settable for all types of rules with the action set to `block`.
    */
   export interface NotificationSettings {
     /**
-     * Set notification on.
+     * Enable notification.
      */
     enabled?: boolean;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Indicates whether to pass the context information as query parameters.
      */
     include_context?: boolean;
 
@@ -769,28 +836,29 @@ export namespace RuleSetting {
     msg?: string;
 
     /**
-     * Optional URL to direct users to additional information. If not set, the
-     * notification will open a block page.
+     * Defines an optional URL to direct users to additional information. If unset, the
+     * notification opens a block page.
      */
     support_url?: string;
   }
 
   /**
-   * Configure DLP payload logging.
+   * Configure DLP payload logging. Settable only for `http` rules.
    */
   export interface PayloadLog {
     /**
-     * Set to true to enable DLP payload logging for this rule.
+     * Enable DLP payload logging for this rule.
      */
     enabled?: boolean;
   }
 
   /**
-   * Settings that apply to quarantine rules.
+   * Configure settings that apply to quarantine rules. Settable only for `http`
+   * rules.
    */
   export interface Quarantine {
     /**
-     * Types of files to sandbox.
+     * Specify the types of files to sandbox.
      */
     file_types?: Array<
       | 'exe'
@@ -810,226 +878,256 @@ export namespace RuleSetting {
   }
 
   /**
-   * Settings that apply to redirect rules.
+   * Apply settings to redirect rules. Settable only for `http` rules with the action
+   * set to `redirect`.
    */
   export interface Redirect {
     /**
-     * URI to which the user will be redirected.
+     * Specify the URI to which the user is redirected.
      */
     target_uri: string;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Specify whether to pass the context information as query parameters.
      */
     include_context?: boolean;
 
     /**
-     * If true, the path and query parameters from the original request will be
-     * appended to target_uri.
+     * Specify whether to append the path and query parameters from the original
+     * request to target_uri.
      */
     preserve_path_and_query?: boolean;
   }
 
   /**
    * Configure to forward the query to the internal DNS service, passing the
-   * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-   * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-   * set to 'resolve'.
+   * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+   * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+   * 'resolve'. Settable only for `dns_resolver` rules.
    */
   export interface ResolveDNSInternally {
     /**
-     * The fallback behavior to apply when the internal DNS response code is different
-     * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-     * 'AAAA' queries.
+     * Specify the fallback behavior to apply when the internal DNS response code
+     * differs from 'NOERROR' or when the response data contains only CNAME records for
+     * 'A' or 'AAAA' queries.
      */
     fallback?: 'none' | 'public_dns';
 
     /**
-     * The internal DNS view identifier that's passed to the internal DNS service.
+     * Specify the internal DNS view identifier to pass to the internal DNS service.
      */
     view_id?: string;
   }
 
   /**
-   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   * Configure behavior when an upstream certificate is invalid or an SSL error
+   * occurs. Settable only for `http` rules with the action set to `allow`.
    */
   export interface UntrustedCERT {
     /**
-     * The action performed when an untrusted certificate is seen. The default action
-     * is an error with HTTP code 526.
+     * Defines the action performed when an untrusted certificate seen. The default
+     * action an error with HTTP code 526.
      */
     action?: 'pass_through' | 'block' | 'error';
   }
 }
 
 /**
- * Additional settings that modify the rule's action.
+ * Defines settings for this rule. Settings apply only to specific rule types and
+ * must use compatible selectors. If Terraform detects drift, confirm the setting
+ * supports your rule type and check whether the API modifies the value. Use
+ * API-returned values in your configuration to prevent drift.
  */
 export interface RuleSettingParam {
   /**
-   * Add custom headers to allowed requests, in the form of key-value pairs. Keys are
-   * header names, pointing to an array with its header value(s).
+   * Add custom headers to allowed requests as key-value pairs. Use header names as
+   * keys that map to arrays of header values. Settable only for `http` rules with
+   * the action set to `allow`.
    */
   add_headers?: { [key: string]: Array<string> } | null;
 
   /**
-   * Set by parent MSP accounts to enable their children to bypass this rule.
+   * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set
+   * this. this rule. Settable for all types of rules.
    */
   allow_child_bypass?: boolean | null;
 
   /**
-   * Settings for the Audit SSH action.
+   * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+   * `audit_ssh` action.
    */
   audit_ssh?: RuleSettingParam.AuditSSH | null;
 
   /**
-   * Configure how browser isolation behaves.
+   * Configure browser isolation behavior. Settable only for `http` rules with the
+   * action set to `isolate`.
    */
   biso_admin_controls?: RuleSettingParam.BISOAdminControls;
 
   /**
-   * Custom block page settings. If missing/null, blocking will use the the account
-   * settings.
+   * Configure custom block page settings. If missing or null, use the account
+   * settings. Settable only for `http` rules with the action set to `block`.
    */
   block_page?: RuleSettingParam.BlockPage | null;
 
   /**
-   * Enable the custom block page.
+   * Enable the custom block page. Settable only for `dns` rules with action `block`.
    */
   block_page_enabled?: boolean;
 
   /**
-   * The text describing why this block occurred, displayed on the custom block page
-   * (if enabled).
+   * Explain why the rule blocks the request. The custom block page shows this text
+   * (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action
+   * set to `block`.
    */
   block_reason?: string | null;
 
   /**
-   * Set by children MSP accounts to bypass their parent's rules.
+   * Set to enable MSP accounts to bypass their parent's rules. Only MSP child
+   * accounts can set this. Settable for all types of rules.
    */
   bypass_parent_rule?: boolean | null;
 
   /**
-   * Configure how session check behaves.
+   * Configure session check behavior. Settable only for `l4` and `http` rules with
+   * the action set to `allow`.
    */
   check_session?: RuleSettingParam.CheckSession | null;
 
   /**
-   * Add your own custom resolvers to route queries that match the resolver policy.
-   * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-   * are set. DNS queries will route to the address closest to their origin. Only
-   * valid when a rule's action is set to 'resolve'.
+   * Configure custom resolvers to route queries that match the resolver policy.
+   * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+   * settings. DNS queries get routed to the address closest to their origin. Only
+   * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+   * rules.
    */
   dns_resolvers?: RuleSettingParam.DNSResolvers | null;
 
   /**
    * Configure how Gateway Proxy traffic egresses. You can enable this setting for
    * rules with Egress actions and filters, or omit it to indicate local egress via
-   * WARP IPs.
+   * WARP IPs. Settable only for `egress` rules.
    */
   egress?: RuleSettingParam.Egress | null;
 
   /**
-   * Set to true, to ignore the category matches at CNAME domains in a response. If
-   * unchecked, the categories in this rule will be checked against all the CNAME
-   * domain categories in a response.
+   * Configure whether a copy of the HTTP request will be sent to storage when the
+   * rule matches.
+   */
+  forensic_copy?: RuleSettingParam.ForensicCopy | null;
+
+  /**
+   * Ignore category matches at CNAME domains in a response. When off, evaluate
+   * categories in this rule against all CNAME domain categories in the response.
+   * Settable only for `dns` and `dns_resolver` rules.
    */
   ignore_cname_category_matches?: boolean;
 
   /**
-   * INSECURE - disable DNSSEC validation (for Allow actions).
+   * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE].
+   * Settable only for `dns` rules.
    */
   insecure_disable_dnssec_validation?: boolean;
 
   /**
-   * Set to true to enable IPs in DNS resolver category blocks. By default categories
-   * only block based on domain names.
+   * Enable IPs in DNS resolver category blocks. The system blocks only domain name
+   * categories unless you enable this setting. Settable only for `dns` and
+   * `dns_resolver` rules.
    */
   ip_categories?: boolean;
 
   /**
-   * Set to true to include IPs in DNS resolver indicator feed blocks. By default
-   * indicator feeds only block based on domain names.
+   * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default,
+   * indicator feeds block only domain names. Settable only for `dns` and
+   * `dns_resolver` rules.
    */
   ip_indicator_feeds?: boolean;
 
   /**
-   * Send matching traffic to the supplied destination IP address. and port.
+   * Send matching traffic to the supplied destination IP address and port. Settable
+   * only for `l4` rules with the action set to `l4_override`.
    */
   l4override?: RuleSettingParam.L4override | null;
 
   /**
-   * Configure a notification to display on the user's device when this rule is
-   * matched.
+   * Configure a notification to display on the user's device when this rule matched.
+   * Settable for all types of rules with the action set to `block`.
    */
   notification_settings?: RuleSettingParam.NotificationSettings | null;
 
   /**
-   * Override matching DNS queries with a hostname.
+   * Defines a hostname for override, for the matching DNS queries. Settable only for
+   * `dns` rules with the action set to `override`.
    */
   override_host?: string;
 
   /**
-   * Override matching DNS queries with an IP or set of IPs.
+   * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only
+   * for `dns` rules with the action set to `override`.
    */
   override_ips?: Array<string> | null;
 
   /**
-   * Configure DLP payload logging.
+   * Configure DLP payload logging. Settable only for `http` rules.
    */
   payload_log?: RuleSettingParam.PayloadLog | null;
 
   /**
-   * Settings that apply to quarantine rules.
+   * Configure settings that apply to quarantine rules. Settable only for `http`
+   * rules.
    */
   quarantine?: RuleSettingParam.Quarantine | null;
 
   /**
-   * Settings that apply to redirect rules.
+   * Apply settings to redirect rules. Settable only for `http` rules with the action
+   * set to `redirect`.
    */
   redirect?: RuleSettingParam.Redirect | null;
 
   /**
    * Configure to forward the query to the internal DNS service, passing the
-   * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-   * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-   * set to 'resolve'.
+   * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+   * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+   * 'resolve'. Settable only for `dns_resolver` rules.
    */
   resolve_dns_internally?: RuleSettingParam.ResolveDNSInternally | null;
 
   /**
    * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS
-   * resolver. Cannot be set when 'dns_resolvers' are specified or
-   * 'resolve_dns_internally' is set. Only valid when a rule's action is set to
-   * 'resolve'.
+   * resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally'
+   * is set. Only valid when a rule's action set to 'resolve'. Settable only for
+   * `dns_resolver` rules.
    */
   resolve_dns_through_cloudflare?: boolean | null;
 
   /**
-   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   * Configure behavior when an upstream certificate is invalid or an SSL error
+   * occurs. Settable only for `http` rules with the action set to `allow`.
    */
   untrusted_cert?: RuleSettingParam.UntrustedCERT | null;
 }
 
 export namespace RuleSettingParam {
   /**
-   * Settings for the Audit SSH action.
+   * Define the settings for the Audit SSH action. Settable only for `l4` rules with
+   * `audit_ssh` action.
    */
   export interface AuditSSH {
     /**
-     * Enable to turn on SSH command logging.
+     * Enable SSH command logging.
      */
     command_logging?: boolean;
   }
 
   /**
-   * Configure how browser isolation behaves.
+   * Configure browser isolation behavior. Settable only for `http` rules with the
+   * action set to `isolate`.
    */
   export interface BISOAdminControls {
     /**
-     * Configure whether copy is enabled or not. When set with "remote_only", copying
-     * isolated content from the remote browser to the user's local clipboard is
-     * disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
+     * Configure copy behavior. If set to remote_only, users cannot copy isolated
+     * content from the remote browser to the local clipboard. If this field is absent,
+     * copying remains enabled. Applies only when version == "v2".
      */
     copy?: 'enabled' | 'disabled' | 'remote_only';
 
@@ -1049,8 +1147,8 @@ export namespace RuleSettingParam {
     dk?: boolean;
 
     /**
-     * Configure whether downloading enabled or not. When set with "remote_only",
-     * downloads are only available for viewing. Only applies when `version == "v2"`.
+     * Configure download behavior. When set to remote_only, users can view downloads
+     * but cannot save them. Applies only when version == "v2".
      */
     download?: 'enabled' | 'disabled' | 'remote_only';
 
@@ -1065,74 +1163,75 @@ export namespace RuleSettingParam {
     du?: boolean;
 
     /**
-     * Configure whether keyboard usage is enabled or not. When absent, keyboard usage
-     * is enabled. Only applies when `version == "v2"`.
+     * Configure keyboard usage behavior. If this field is absent, keyboard usage
+     * remains enabled. Applies only when version == "v2".
      */
     keyboard?: 'enabled' | 'disabled';
 
     /**
-     * Configure whether pasting is enabled or not. When set with "remote_only",
-     * pasting content from the user's local clipboard into isolated pages is disabled.
-     * When absent, paste is enabled. Only applies when `version == "v2"`.
+     * Configure paste behavior. If set to remote_only, users cannot paste content from
+     * the local clipboard into isolated pages. If this field is absent, pasting
+     * remains enabled. Applies only when version == "v2".
      */
     paste?: 'enabled' | 'disabled' | 'remote_only';
 
     /**
-     * Configure whether printing is enabled or not. When absent, printing is enabled.
-     * Only applies when `version == "v2"`.
+     * Configure print behavior. Default, Printing is enabled. Applies only when
+     * version == "v2".
      */
     printing?: 'enabled' | 'disabled';
 
     /**
-     * Configure whether uploading is enabled or not. When absent, uploading is
-     * enabled. Only applies when `version == "v2"`.
+     * Configure upload behavior. If this field is absent, uploading remains enabled.
+     * Applies only when version == "v2".
      */
     upload?: 'enabled' | 'disabled';
 
     /**
-     * Indicates which version of the browser isolation controls should apply.
+     * Indicate which version of the browser isolation controls should apply.
      */
     version?: 'v1' | 'v2';
   }
 
   /**
-   * Custom block page settings. If missing/null, blocking will use the the account
-   * settings.
+   * Configure custom block page settings. If missing or null, use the account
+   * settings. Settable only for `http` rules with the action set to `block`.
    */
   export interface BlockPage {
     /**
-     * URI to which the user will be redirected.
+     * Specify the URI to which the user is redirected.
      */
     target_uri: string;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Specify whether to pass the context information as query parameters.
      */
     include_context?: boolean;
   }
 
   /**
-   * Configure how session check behaves.
+   * Configure session check behavior. Settable only for `l4` and `http` rules with
+   * the action set to `allow`.
    */
   export interface CheckSession {
     /**
-     * Configure how fresh the session needs to be to be considered valid. The API
-     * automatically formats and sanitizes this expression. This returns a normalized
-     * version that may differ from your input and cause Terraform state drift.
+     * Sets the required session freshness threshold. The API returns a normalized
+     * version of this value.
      */
     duration?: string;
 
     /**
-     * Set to true to enable session enforcement.
+     * Enable session enforcement.
      */
     enforce?: boolean;
   }
 
   /**
-   * Add your own custom resolvers to route queries that match the resolver policy.
-   * Cannot be used when 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
-   * are set. DNS queries will route to the address closest to their origin. Only
-   * valid when a rule's action is set to 'resolve'.
+   * Configure custom resolvers to route queries that match the resolver policy.
+   * Unused with 'resolve_dns_through_cloudflare' or 'resolve_dns_internally'
+   * settings. DNS queries get routed to the address closest to their origin. Only
+   * valid when a rule's action set to 'resolve'. Settable only for `dns_resolver`
+   * rules.
    */
   export interface DNSResolvers {
     ipv4?: Array<RulesAPI.DNSResolverSettingsV4Param>;
@@ -1143,54 +1242,65 @@ export namespace RuleSettingParam {
   /**
    * Configure how Gateway Proxy traffic egresses. You can enable this setting for
    * rules with Egress actions and filters, or omit it to indicate local egress via
-   * WARP IPs.
+   * WARP IPs. Settable only for `egress` rules.
    */
   export interface Egress {
     /**
-     * The IPv4 address to be used for egress.
+     * Specify the IPv4 address to use for egress.
      */
     ipv4?: string;
 
     /**
-     * The fallback IPv4 address to be used for egress in the event of an error
-     * egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via
-     * WARP IPs.
+     * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails.
+     * Set '0.0.0.0' to indicate local egress via WARP IPs.
      */
     ipv4_fallback?: string;
 
     /**
-     * The IPv6 range to be used for egress.
+     * Specify the IPv6 range to use for egress.
      */
     ipv6?: string;
   }
 
   /**
-   * Send matching traffic to the supplied destination IP address. and port.
+   * Configure whether a copy of the HTTP request will be sent to storage when the
+   * rule matches.
+   */
+  export interface ForensicCopy {
+    /**
+     * Enable sending the copy to storage.
+     */
+    enabled?: boolean;
+  }
+
+  /**
+   * Send matching traffic to the supplied destination IP address and port. Settable
+   * only for `l4` rules with the action set to `l4_override`.
    */
   export interface L4override {
     /**
-     * IPv4 or IPv6 address.
+     * Defines the IPv4 or IPv6 address.
      */
     ip?: string;
 
     /**
-     * A port number to use for TCP/UDP overrides.
+     * Defines a port number to use for TCP/UDP overrides.
      */
     port?: number;
   }
 
   /**
-   * Configure a notification to display on the user's device when this rule is
-   * matched.
+   * Configure a notification to display on the user's device when this rule matched.
+   * Settable for all types of rules with the action set to `block`.
    */
   export interface NotificationSettings {
     /**
-     * Set notification on.
+     * Enable notification.
      */
     enabled?: boolean;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Indicates whether to pass the context information as query parameters.
      */
     include_context?: boolean;
 
@@ -1200,28 +1310,29 @@ export namespace RuleSettingParam {
     msg?: string;
 
     /**
-     * Optional URL to direct users to additional information. If not set, the
-     * notification will open a block page.
+     * Defines an optional URL to direct users to additional information. If unset, the
+     * notification opens a block page.
      */
     support_url?: string;
   }
 
   /**
-   * Configure DLP payload logging.
+   * Configure DLP payload logging. Settable only for `http` rules.
    */
   export interface PayloadLog {
     /**
-     * Set to true to enable DLP payload logging for this rule.
+     * Enable DLP payload logging for this rule.
      */
     enabled?: boolean;
   }
 
   /**
-   * Settings that apply to quarantine rules.
+   * Configure settings that apply to quarantine rules. Settable only for `http`
+   * rules.
    */
   export interface Quarantine {
     /**
-     * Types of files to sandbox.
+     * Specify the types of files to sandbox.
      */
     file_types?: Array<
       | 'exe'
@@ -1241,186 +1352,200 @@ export namespace RuleSettingParam {
   }
 
   /**
-   * Settings that apply to redirect rules.
+   * Apply settings to redirect rules. Settable only for `http` rules with the action
+   * set to `redirect`.
    */
   export interface Redirect {
     /**
-     * URI to which the user will be redirected.
+     * Specify the URI to which the user is redirected.
      */
     target_uri: string;
 
     /**
-     * If true, context information will be passed as query parameters.
+     * Specify whether to pass the context information as query parameters.
      */
     include_context?: boolean;
 
     /**
-     * If true, the path and query parameters from the original request will be
-     * appended to target_uri.
+     * Specify whether to append the path and query parameters from the original
+     * request to target_uri.
      */
     preserve_path_and_query?: boolean;
   }
 
   /**
    * Configure to forward the query to the internal DNS service, passing the
-   * specified 'view_id' as input. Cannot be set when 'dns_resolvers' are specified
-   * or 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action is
-   * set to 'resolve'.
+   * specified 'view_id' as input. Not used when 'dns_resolvers' is specified or
+   * 'resolve_dns_through_cloudflare' is set. Only valid when a rule's action set to
+   * 'resolve'. Settable only for `dns_resolver` rules.
    */
   export interface ResolveDNSInternally {
     /**
-     * The fallback behavior to apply when the internal DNS response code is different
-     * from 'NOERROR' or when the response data only contains CNAME records for 'A' or
-     * 'AAAA' queries.
+     * Specify the fallback behavior to apply when the internal DNS response code
+     * differs from 'NOERROR' or when the response data contains only CNAME records for
+     * 'A' or 'AAAA' queries.
      */
     fallback?: 'none' | 'public_dns';
 
     /**
-     * The internal DNS view identifier that's passed to the internal DNS service.
+     * Specify the internal DNS view identifier to pass to the internal DNS service.
      */
     view_id?: string;
   }
 
   /**
-   * Configure behavior when an upstream cert is invalid or an SSL error occurs.
+   * Configure behavior when an upstream certificate is invalid or an SSL error
+   * occurs. Settable only for `http` rules with the action set to `allow`.
    */
   export interface UntrustedCERT {
     /**
-     * The action performed when an untrusted certificate is seen. The default action
-     * is an error with HTTP code 526.
+     * Defines the action performed when an untrusted certificate seen. The default
+     * action an error with HTTP code 526.
      */
     action?: 'pass_through' | 'block' | 'error';
   }
 }
 
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface Schedule {
   /**
-   * The time intervals when the rule will be active on Fridays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Fridays.
+   * Specify the time intervals when the rule is active on Fridays, in the increasing
+   * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+   * Fridays. API returns a formatted version of this string, which may cause
+   * Terraform drift if a unformatted value is used.
    */
   fri?: string;
 
   /**
-   * The time intervals when the rule will be active on Mondays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Mondays.
+   * Specify the time intervals when the rule is active on Mondays, in the increasing
+   * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+   * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+   * this string, which may cause Terraform drift if a unformatted value is used.
    */
   mon?: string;
 
   /**
-   * The time intervals when the rule will be active on Saturdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Saturdays.
+   * Specify the time intervals when the rule is active on Saturdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Saturdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   sat?: string;
 
   /**
-   * The time intervals when the rule will be active on Sundays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Sundays.
+   * Specify the time intervals when the rule is active on Sundays, in the increasing
+   * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+   * Sundays. API returns a formatted version of this string, which may cause
+   * Terraform drift if a unformatted value is used.
    */
   sun?: string;
 
   /**
-   * The time intervals when the rule will be active on Thursdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Thursdays.
+   * Specify the time intervals when the rule is active on Thursdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Thursdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   thu?: string;
 
   /**
-   * The time zone the rule will be evaluated against. If a
+   * Specify the time zone for rule evaluation. When a
    * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-   * is provided, Gateway will always use the current time at that time zone. If this
-   * parameter is omitted, then Gateway will use the time zone inferred from the
-   * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-   * from the IP, we will fall back to the time zone of the user's connected data
-   * center.
+   * is provided, Gateway always uses the current time for that time zone. When this
+   * parameter is omitted, Gateway uses the time zone determined from the user's IP
+   * address. Colo time zone is used when the user's IP address does not resolve to a
+   * location.
    */
   time_zone?: string;
 
   /**
-   * The time intervals when the rule will be active on Tuesdays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Tuesdays.
+   * Specify the time intervals when the rule is active on Tuesdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Tuesdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   tue?: string;
 
   /**
-   * The time intervals when the rule will be active on Wednesdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Wednesdays.
+   * Specify the time intervals when the rule is active on Wednesdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Wednesdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   wed?: string;
 }
 
 /**
- * The schedule for activating DNS policies. This does not apply to HTTP or network
- * policies.
+ * Defines the schedule for activating DNS policies. Settable only for `dns` and
+ * `dns_resolver` rules.
  */
 export interface ScheduleParam {
   /**
-   * The time intervals when the rule will be active on Fridays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Fridays.
+   * Specify the time intervals when the rule is active on Fridays, in the increasing
+   * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+   * Fridays. API returns a formatted version of this string, which may cause
+   * Terraform drift if a unformatted value is used.
    */
   fri?: string;
 
   /**
-   * The time intervals when the rule will be active on Mondays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Mondays.
+   * Specify the time intervals when the rule is active on Mondays, in the increasing
+   * order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter
+   * omitted, the rule is deactivated on Mondays. API returns a formatted version of
+   * this string, which may cause Terraform drift if a unformatted value is used.
    */
   mon?: string;
 
   /**
-   * The time intervals when the rule will be active on Saturdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Saturdays.
+   * Specify the time intervals when the rule is active on Saturdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Saturdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   sat?: string;
 
   /**
-   * The time intervals when the rule will be active on Sundays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Sundays.
+   * Specify the time intervals when the rule is active on Sundays, in the increasing
+   * order from 00:00-24:00. If this parameter omitted, the rule is deactivated on
+   * Sundays. API returns a formatted version of this string, which may cause
+   * Terraform drift if a unformatted value is used.
    */
   sun?: string;
 
   /**
-   * The time intervals when the rule will be active on Thursdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Thursdays.
+   * Specify the time intervals when the rule is active on Thursdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Thursdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   thu?: string;
 
   /**
-   * The time zone the rule will be evaluated against. If a
+   * Specify the time zone for rule evaluation. When a
    * [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List)
-   * is provided, Gateway will always use the current time at that time zone. If this
-   * parameter is omitted, then Gateway will use the time zone inferred from the
-   * user's source IP to evaluate the rule. If Gateway cannot determine the time zone
-   * from the IP, we will fall back to the time zone of the user's connected data
-   * center.
+   * is provided, Gateway always uses the current time for that time zone. When this
+   * parameter is omitted, Gateway uses the time zone determined from the user's IP
+   * address. Colo time zone is used when the user's IP address does not resolve to a
+   * location.
    */
   time_zone?: string;
 
   /**
-   * The time intervals when the rule will be active on Tuesdays, in increasing order
-   * from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on
-   * Tuesdays.
+   * Specify the time intervals when the rule is active on Tuesdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Tuesdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   tue?: string;
 
   /**
-   * The time intervals when the rule will be active on Wednesdays, in increasing
-   * order from 00:00-24:00. If this parameter is omitted, the rule will be
-   * deactivated on Wednesdays.
+   * Specify the time intervals when the rule is active on Wednesdays, in the
+   * increasing order from 00:00-24:00. If this parameter omitted, the rule is
+   * deactivated on Wednesdays. API returns a formatted version of this string, which
+   * may cause Terraform drift if a unformatted value is used.
    */
   wed?: string;
 }
@@ -1434,8 +1559,8 @@ export interface RuleCreateParams {
   account_id: string;
 
   /**
-   * Body param: The action to perform when the associated traffic, identity, and
-   * device posture expressions are either absent or evaluate to `true`.
+   * Body param: Specify the action to perform when the associated traffic, identity,
+   * and device posture expressions either absent or evaluate to `true`.
    */
   action:
     | 'on'
@@ -1456,100 +1581,99 @@ export interface RuleCreateParams {
     | 'redirect';
 
   /**
-   * Body param: The name of the rule.
+   * Body param: Specify the rule name.
    */
   name: string;
 
   /**
-   * Body param: The description of the rule.
+   * Body param: Specify the rule description.
    */
   description?: string;
 
   /**
-   * Body param: The wirefilter expression used for device posture check matching.
-   * The API automatically formats and sanitizes this expression. This returns a
-   * normalized version that may differ from your input and cause Terraform state
-   * drift.
+   * Body param: Specify the wirefilter expression used for device posture check. The
+   * API automatically formats and sanitizes expressions before storing them. To
+   * prevent Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   device_posture?: string;
 
   /**
-   * Body param: True if the rule is enabled.
+   * Body param: Specify whether the rule is enabled.
    */
   enabled?: boolean;
 
   /**
-   * Body param: The expiration time stamp and default duration of a DNS policy.
-   * Takes precedence over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Body param: Defines the expiration time stamp and default duration of a DNS
+   * policy. Takes precedence over the policy's `schedule` configuration, if any.
+   * This does not apply to HTTP or network policies. Settable only for `dns` rules.
    */
   expiration?: RuleCreateParams.Expiration | null;
 
   /**
-   * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-   * posture expressions.
+   * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+   * device posture expressions. Can only contain a single value.
    */
   filters?: Array<GatewayFilterParam>;
 
   /**
-   * Body param: The wirefilter expression used for identity matching. The API
-   * automatically formats and sanitizes this expression. This returns a normalized
-   * version that may differ from your input and cause Terraform state drift.
+   * Body param: Specify the wirefilter expression used for identity matching. The
+   * API automatically formats and sanitizes expressions before storing them. To
+   * prevent Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   identity?: string;
 
   /**
-   * Body param: Precedence sets the order of your rules. Lower values indicate
-   * higher precedence. At each processing phase, applicable rules are evaluated in
-   * ascending order of this value. Refer to
+   * Body param: Set the order of your rules. Lower values indicate higher
+   * precedence. At each processing phase, evaluate applicable rules in ascending
+   * order of this value. Refer to
    * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-   * docs on how to manage precedence via Terraform.
+   * to manage precedence via Terraform.
    */
   precedence?: number;
 
   /**
-   * Body param: Additional settings that modify the rule's action.
+   * Body param: Defines settings for this rule. Settings apply only to specific rule
+   * types and must use compatible selectors. If Terraform detects drift, confirm the
+   * setting supports your rule type and check whether the API modifies the value.
+   * Use API-returned values in your configuration to prevent drift.
    */
   rule_settings?: RuleSettingParam;
 
   /**
-   * Body param: The schedule for activating DNS policies. This does not apply to
-   * HTTP or network policies.
+   * Body param: Defines the schedule for activating DNS policies. Settable only for
+   * `dns` and `dns_resolver` rules.
    */
   schedule?: ScheduleParam | null;
 
   /**
-   * Body param: The wirefilter expression used for traffic matching. The API
-   * automatically formats and sanitizes this expression. This returns a normalized
-   * version that may differ from your input and cause Terraform state drift.
+   * Body param: Specify the wirefilter expression used for traffic matching. The API
+   * automatically formats and sanitizes expressions before storing them. To prevent
+   * Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   traffic?: string;
 }
 
 export namespace RuleCreateParams {
   /**
-   * The expiration time stamp and default duration of a DNS policy. Takes precedence
-   * over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Defines the expiration time stamp and default duration of a DNS policy. Takes
+   * precedence over the policy's `schedule` configuration, if any. This does not
+   * apply to HTTP or network policies. Settable only for `dns` rules.
    */
   export interface Expiration {
     /**
-     * The time stamp at which the policy will expire and cease to be applied.
-     *
-     * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-     * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-     * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-     *
-     * Policies with an expiration do not consider the timezone of clients they are
-     * applied to, and expire "globally" at the point given by their `expires_at`
-     * value.
+     * Show the timestamp when the policy expires and stops applying. The value must
+     * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+     * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+     * a trailing Z. Expiration policies ignore client timezones and expire globally at
+     * the specified expires_at time.
      */
     expires_at: string;
 
     /**
-     * The default duration a policy will be active in minutes. Must be set in order to
+     * Defines the default duration a policy active in minutes. Must set in order to
      * use the `reset_expiration` endpoint on this rule.
      */
     duration?: number;
@@ -1563,8 +1687,8 @@ export interface RuleUpdateParams {
   account_id: string;
 
   /**
-   * Body param: The action to perform when the associated traffic, identity, and
-   * device posture expressions are either absent or evaluate to `true`.
+   * Body param: Specify the action to perform when the associated traffic, identity,
+   * and device posture expressions either absent or evaluate to `true`.
    */
   action:
     | 'on'
@@ -1585,100 +1709,99 @@ export interface RuleUpdateParams {
     | 'redirect';
 
   /**
-   * Body param: The name of the rule.
+   * Body param: Specify the rule name.
    */
   name: string;
 
   /**
-   * Body param: The description of the rule.
+   * Body param: Specify the rule description.
    */
   description?: string;
 
   /**
-   * Body param: The wirefilter expression used for device posture check matching.
-   * The API automatically formats and sanitizes this expression. This returns a
-   * normalized version that may differ from your input and cause Terraform state
-   * drift.
+   * Body param: Specify the wirefilter expression used for device posture check. The
+   * API automatically formats and sanitizes expressions before storing them. To
+   * prevent Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   device_posture?: string;
 
   /**
-   * Body param: True if the rule is enabled.
+   * Body param: Specify whether the rule is enabled.
    */
   enabled?: boolean;
 
   /**
-   * Body param: The expiration time stamp and default duration of a DNS policy.
-   * Takes precedence over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Body param: Defines the expiration time stamp and default duration of a DNS
+   * policy. Takes precedence over the policy's `schedule` configuration, if any.
+   * This does not apply to HTTP or network policies. Settable only for `dns` rules.
    */
   expiration?: RuleUpdateParams.Expiration | null;
 
   /**
-   * Body param: The protocol or layer to evaluate the traffic, identity, and device.
-   * posture expressions.
+   * Body param: Specify the protocol or layer to evaluate the traffic, identity, and
+   * device posture expressions. Can only contain a single value.
    */
   filters?: Array<GatewayFilterParam>;
 
   /**
-   * Body param: The wirefilter expression used for identity matching. The API
-   * automatically formats and sanitizes this expression. This returns a normalized
-   * version that may differ from your input and cause Terraform state drift.
+   * Body param: Specify the wirefilter expression used for identity matching. The
+   * API automatically formats and sanitizes expressions before storing them. To
+   * prevent Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   identity?: string;
 
   /**
-   * Body param: Precedence sets the order of your rules. Lower values indicate
-   * higher precedence. At each processing phase, applicable rules are evaluated in
-   * ascending order of this value. Refer to
+   * Body param: Set the order of your rules. Lower values indicate higher
+   * precedence. At each processing phase, evaluate applicable rules in ascending
+   * order of this value. Refer to
    * [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform)
-   * docs on how to manage precedence via Terraform.
+   * to manage precedence via Terraform.
    */
   precedence?: number;
 
   /**
-   * Body param: Additional settings that modify the rule's action.
+   * Body param: Defines settings for this rule. Settings apply only to specific rule
+   * types and must use compatible selectors. If Terraform detects drift, confirm the
+   * setting supports your rule type and check whether the API modifies the value.
+   * Use API-returned values in your configuration to prevent drift.
    */
   rule_settings?: RuleSettingParam;
 
   /**
-   * Body param: The schedule for activating DNS policies. This does not apply to
-   * HTTP or network policies.
+   * Body param: Defines the schedule for activating DNS policies. Settable only for
+   * `dns` and `dns_resolver` rules.
    */
   schedule?: ScheduleParam | null;
 
   /**
-   * Body param: The wirefilter expression used for traffic matching. The API
-   * automatically formats and sanitizes this expression. This returns a normalized
-   * version that may differ from your input and cause Terraform state drift.
+   * Body param: Specify the wirefilter expression used for traffic matching. The API
+   * automatically formats and sanitizes expressions before storing them. To prevent
+   * Terraform state drift, use the formatted expression returned in the API
+   * response.
    */
   traffic?: string;
 }
 
 export namespace RuleUpdateParams {
   /**
-   * The expiration time stamp and default duration of a DNS policy. Takes precedence
-   * over the policy's `schedule` configuration, if any.
-   *
-   * This does not apply to HTTP or network policies.
+   * Defines the expiration time stamp and default duration of a DNS policy. Takes
+   * precedence over the policy's `schedule` configuration, if any. This does not
+   * apply to HTTP or network policies. Settable only for `dns` rules.
    */
   export interface Expiration {
     /**
-     * The time stamp at which the policy will expire and cease to be applied.
-     *
-     * Must adhere to RFC 3339 and include a UTC offset. Non-zero offsets are accepted
-     * but will be converted to the equivalent value with offset zero (UTC+00:00) and
-     * will be returned as time stamps with offset zero denoted by a trailing 'Z'.
-     *
-     * Policies with an expiration do not consider the timezone of clients they are
-     * applied to, and expire "globally" at the point given by their `expires_at`
-     * value.
+     * Show the timestamp when the policy expires and stops applying. The value must
+     * follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets
+     * but converts them to the equivalent UTC+00:00 value and returns timestamps with
+     * a trailing Z. Expiration policies ignore client timezones and expire globally at
+     * the specified expires_at time.
      */
     expires_at: string;
 
     /**
-     * The default duration a policy will be active in minutes. Must be set in order to
+     * Defines the default duration a policy active in minutes. Must set in order to
      * use the `reset_expiration` endpoint on this rule.
      */
     duration?: number;
@@ -1697,6 +1820,10 @@ export interface RuleGetParams {
   account_id: string;
 }
 
+export interface RuleListTenantParams {
+  account_id: string;
+}
+
 export interface RuleResetExpirationParams {
   account_id: string;
 }
@@ -1718,6 +1845,7 @@ export declare namespace Rules {
     type RuleListParams as RuleListParams,
     type RuleDeleteParams as RuleDeleteParams,
     type RuleGetParams as RuleGetParams,
+    type RuleListTenantParams as RuleListTenantParams,
     type RuleResetExpirationParams as RuleResetExpirationParams,
   };
 }