cloudflare 5.2.0 → 6.0.0-beta.1

package/resources/zero-trust/access/applications/applications.d.ts

@@ -1109,11 +1109,11 @@ export declare namespace ApplicationSCIMConfig {
 /**
  * The application type.
  */
-export type ApplicationType = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+export type ApplicationType = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
 /**
  * The application type.
  */
-export type ApplicationTypeParam = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+export type ApplicationTypeParam = 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
 export interface CORSHeaders {
     /**
      * Allows all HTTP request headers.
@@ -1850,7 +1850,7 @@ export type SelfHostedDomains = string;
  * A domain that Access will secure.
  */
 export type SelfHostedDomainsParam = string;
-export type ApplicationCreateResponse = ApplicationCreateResponse.SelfHostedApplication | ApplicationCreateResponse.SaaSApplication | ApplicationCreateResponse.BrowserSSHApplication | ApplicationCreateResponse.BrowserVNCApplication | ApplicationCreateResponse.AppLauncherApplication | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication | ApplicationCreateResponse.BrowserIsolationPermissionsApplication | ApplicationCreateResponse.BookmarkApplication | ApplicationCreateResponse.InfrastructureApplication | ApplicationCreateResponse.BrowserRdpApplication;
+export type ApplicationCreateResponse = ApplicationCreateResponse.SelfHostedApplication | ApplicationCreateResponse.SaaSApplication | ApplicationCreateResponse.BrowserSSHApplication | ApplicationCreateResponse.BrowserVNCApplication | ApplicationCreateResponse.AppLauncherApplication | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication | ApplicationCreateResponse.BrowserIsolationPermissionsApplication | ApplicationCreateResponse.GatewayIdentityProxyEndpointApplication | ApplicationCreateResponse.BookmarkApplication | ApplicationCreateResponse.InfrastructureApplication | ApplicationCreateResponse.BrowserRdpApplication;
 export declare namespace ApplicationCreateResponse {
     interface SelfHostedApplication {
         /**
@@ -1920,7 +1920,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2011,10 +2011,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2040,6 +2036,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -2390,7 +2397,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -2449,7 +2456,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2540,10 +2547,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2569,6 +2572,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -2722,7 +2736,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -2781,7 +2795,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2872,10 +2886,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2901,6 +2911,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -3049,7 +3070,7 @@ export declare namespace ApplicationCreateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -3470,6 +3491,128 @@ export declare namespace ApplicationCreateResponse {
             updated_at?: string;
         }
     }
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * The custom pages that will be displayed when applicable for this application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
     interface BookmarkApplication {
         /**
          * UUID.
@@ -3679,7 +3822,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -3787,10 +3930,6 @@ export declare namespace ApplicationCreateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3816,6 +3955,17 @@ export declare namespace ApplicationCreateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -3961,7 +4111,7 @@ export declare namespace ApplicationCreateResponse {
         }
     }
 }
-export type ApplicationUpdateResponse = ApplicationUpdateResponse.SelfHostedApplication | ApplicationUpdateResponse.SaaSApplication | ApplicationUpdateResponse.BrowserSSHApplication | ApplicationUpdateResponse.BrowserVNCApplication | ApplicationUpdateResponse.AppLauncherApplication | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication | ApplicationUpdateResponse.BookmarkApplication | ApplicationUpdateResponse.InfrastructureApplication | ApplicationUpdateResponse.BrowserRdpApplication;
+export type ApplicationUpdateResponse = ApplicationUpdateResponse.SelfHostedApplication | ApplicationUpdateResponse.SaaSApplication | ApplicationUpdateResponse.BrowserSSHApplication | ApplicationUpdateResponse.BrowserVNCApplication | ApplicationUpdateResponse.AppLauncherApplication | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication | ApplicationUpdateResponse.GatewayIdentityProxyEndpointApplication | ApplicationUpdateResponse.BookmarkApplication | ApplicationUpdateResponse.InfrastructureApplication | ApplicationUpdateResponse.BrowserRdpApplication;
 export declare namespace ApplicationUpdateResponse {
     interface SelfHostedApplication {
         /**
@@ -4031,7 +4181,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4122,10 +4272,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -4151,6 +4297,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -4501,7 +4658,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -4560,7 +4717,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4651,10 +4808,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -4680,6 +4833,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -4833,7 +4997,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -4892,7 +5056,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4983,10 +5147,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5012,6 +5172,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -5160,7 +5331,7 @@ export declare namespace ApplicationUpdateResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -5581,89 +5752,75 @@ export declare namespace ApplicationUpdateResponse {
             updated_at?: string;
         }
     }
-    interface BookmarkApplication {
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID.
          */
         id?: string;
         /**
-         * Displays the application in the App Launcher.
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        app_launcher_visible?: boolean;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
         aud?: string;
         /**
-         * The URL or domain of the bookmark.
-         */
-        domain?: string;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
-        /**
-         * The name of the application.
-         */
-        name?: string;
-        /**
-         * The tags you want assigned to an application. Tags are used to filter
-         * applications in the App Launcher dashboard.
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
          */
-        tags?: Array<string>;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
          */
-        type?: ApplicationsAPI.ApplicationType;
-    }
-    interface InfrastructureApplication {
-        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        custom_deny_url?: string;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
          */
-        type: ApplicationsAPI.ApplicationType;
+        custom_non_identity_deny_url?: string;
         /**
-         * UUID.
+         * The custom pages that will be displayed when applicable for this application
          */
-        id?: string;
+        custom_pages?: Array<string>;
         /**
-         * Audience tag.
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
          */
-        aud?: string;
+        domain?: string;
         /**
          * The name of the application.
          */
         name?: string;
-        policies?: Array<InfrastructureApplication.Policy>;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
     }
-    namespace InfrastructureApplication {
-        interface TargetCriterion {
-            /**
-             * The port that the targets use for the chosen communication protocol. A port
-             * cannot be assigned to multiple protocols.
-             */
-            port: number;
-            /**
-             * The communication protocol your application secures.
-             */
-            protocol: 'SSH';
-            /**
-             * Contains a map of target attribute keys to target attribute values.
-             */
-            target_attributes: {
-                [key: string]: Array<string>;
-            };
-        }
+    namespace GatewayIdentityProxyEndpointApplication {
         interface Policy {
             /**
              * The UUID of the policy
              */
             id?: string;
             /**
-             * The rules that define how users may connect to the targets secured by your
-             * application.
+             * Administrators who can approve a temporary authentication request.
              */
-            connection_rules?: Policy.ConnectionRules;
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
             created_at?: string;
             /**
              * The action Access will take if a user matches this policy. Infrastructure
@@ -5680,12 +5837,148 @@ export declare namespace ApplicationUpdateResponse {
              * the Include rules.
              */
             include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
             /**
              * The name of the Access policy.
              */
             name?: string;
             /**
-             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
+    interface BookmarkApplication {
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * The tags you want assigned to an application. Tags are used to filter
+         * applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * The application type.
+         */
+        type?: ApplicationsAPI.ApplicationType;
+    }
+    interface InfrastructureApplication {
+        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<InfrastructureApplication.Policy>;
+    }
+    namespace InfrastructureApplication {
+        interface TargetCriterion {
+            /**
+             * The port that the targets use for the chosen communication protocol. A port
+             * cannot be assigned to multiple protocols.
+             */
+            port: number;
+            /**
+             * The communication protocol your application secures.
+             */
+            protocol: 'SSH';
+            /**
+             * Contains a map of target attribute keys to target attribute values.
+             */
+            target_attributes: {
+                [key: string]: Array<string>;
+            };
+        }
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The rules that define how users may connect to the targets secured by your
+             * application.
+             */
+            connection_rules?: Policy.ConnectionRules;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
              * meet all of the Require rules.
              */
             require?: Array<ApplicationsPoliciesAPI.AccessRule>;
@@ -5790,7 +6083,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -5898,10 +6191,6 @@ export declare namespace ApplicationUpdateResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5927,6 +6216,17 @@ export declare namespace ApplicationUpdateResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6072,7 +6372,7 @@ export declare namespace ApplicationUpdateResponse {
         }
     }
 }
-export type ApplicationListResponse = ApplicationListResponse.SelfHostedApplication | ApplicationListResponse.SaaSApplication | ApplicationListResponse.BrowserSSHApplication | ApplicationListResponse.BrowserVNCApplication | ApplicationListResponse.AppLauncherApplication | ApplicationListResponse.DeviceEnrollmentPermissionsApplication | ApplicationListResponse.BrowserIsolationPermissionsApplication | ApplicationListResponse.BookmarkApplication | ApplicationListResponse.InfrastructureApplication | ApplicationListResponse.BrowserRdpApplication;
+export type ApplicationListResponse = ApplicationListResponse.SelfHostedApplication | ApplicationListResponse.SaaSApplication | ApplicationListResponse.BrowserSSHApplication | ApplicationListResponse.BrowserVNCApplication | ApplicationListResponse.AppLauncherApplication | ApplicationListResponse.DeviceEnrollmentPermissionsApplication | ApplicationListResponse.BrowserIsolationPermissionsApplication | ApplicationListResponse.GatewayIdentityProxyEndpointApplication | ApplicationListResponse.BookmarkApplication | ApplicationListResponse.InfrastructureApplication | ApplicationListResponse.BrowserRdpApplication;
 export declare namespace ApplicationListResponse {
     interface SelfHostedApplication {
         /**
@@ -6142,7 +6442,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -6233,10 +6533,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6262,6 +6558,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6612,7 +6919,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -6671,7 +6978,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -6762,10 +7069,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6791,6 +7094,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -6944,7 +7258,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -7003,7 +7317,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -7094,10 +7408,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -7123,6 +7433,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -7271,7 +7592,7 @@ export declare namespace ApplicationListResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -7692,89 +8013,75 @@ export declare namespace ApplicationListResponse {
             updated_at?: string;
         }
     }
-    interface BookmarkApplication {
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
         /**
          * UUID.
          */
         id?: string;
         /**
-         * Displays the application in the App Launcher.
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
          */
-        app_launcher_visible?: boolean;
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
         /**
          * Audience tag.
          */
         aud?: string;
         /**
-         * The URL or domain of the bookmark.
-         */
-        domain?: string;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
-        /**
-         * The name of the application.
-         */
-        name?: string;
-        /**
-         * The tags you want assigned to an application. Tags are used to filter
-         * applications in the App Launcher dashboard.
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
          */
-        tags?: Array<string>;
+        auto_redirect_to_identity?: boolean;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
          */
-        type?: ApplicationsAPI.ApplicationType;
-    }
-    interface InfrastructureApplication {
-        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        custom_deny_url?: string;
         /**
-         * The application type.
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
          */
-        type: ApplicationsAPI.ApplicationType;
+        custom_non_identity_deny_url?: string;
         /**
-         * UUID.
+         * The custom pages that will be displayed when applicable for this application
          */
-        id?: string;
+        custom_pages?: Array<string>;
         /**
-         * Audience tag.
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
          */
-        aud?: string;
+        domain?: string;
         /**
          * The name of the application.
          */
         name?: string;
-        policies?: Array<InfrastructureApplication.Policy>;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
     }
-    namespace InfrastructureApplication {
-        interface TargetCriterion {
-            /**
-             * The port that the targets use for the chosen communication protocol. A port
-             * cannot be assigned to multiple protocols.
-             */
-            port: number;
-            /**
-             * The communication protocol your application secures.
-             */
-            protocol: 'SSH';
-            /**
-             * Contains a map of target attribute keys to target attribute values.
-             */
-            target_attributes: {
-                [key: string]: Array<string>;
-            };
-        }
+    namespace GatewayIdentityProxyEndpointApplication {
         interface Policy {
             /**
              * The UUID of the policy
              */
             id?: string;
             /**
-             * The rules that define how users may connect to the targets secured by your
-             * application.
+             * Administrators who can approve a temporary authentication request.
              */
-            connection_rules?: Policy.ConnectionRules;
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
             created_at?: string;
             /**
              * The action Access will take if a user matches this policy. Infrastructure
@@ -7791,18 +8098,154 @@ export declare namespace ApplicationListResponse {
              * the Include rules.
              */
             include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
             /**
              * The name of the Access policy.
              */
             name?: string;
             /**
-             * Rules evaluated with an AND logical operator. To match the policy, a user must
-             * meet all of the Require rules.
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
              */
-            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
-            updated_at?: string;
-        }
-        namespace Policy {
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
+    interface BookmarkApplication {
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The URL or domain of the bookmark.
+         */
+        domain?: string;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * The tags you want assigned to an application. Tags are used to filter
+         * applications in the App Launcher dashboard.
+         */
+        tags?: Array<string>;
+        /**
+         * The application type.
+         */
+        type?: ApplicationsAPI.ApplicationType;
+    }
+    interface InfrastructureApplication {
+        target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<InfrastructureApplication.Policy>;
+    }
+    namespace InfrastructureApplication {
+        interface TargetCriterion {
+            /**
+             * The port that the targets use for the chosen communication protocol. A port
+             * cannot be assigned to multiple protocols.
+             */
+            port: number;
+            /**
+             * The communication protocol your application secures.
+             */
+            protocol: 'SSH';
+            /**
+             * Contains a map of target attribute keys to target attribute values.
+             */
+            target_attributes: {
+                [key: string]: Array<string>;
+            };
+        }
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The rules that define how users may connect to the targets secured by your
+             * application.
+             */
+            connection_rules?: Policy.ConnectionRules;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            updated_at?: string;
+        }
+        namespace Policy {
             /**
              * The rules that define how users may connect to the targets secured by your
              * application.
@@ -7901,7 +8344,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8009,10 +8452,6 @@ export declare namespace ApplicationListResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8038,6 +8477,17 @@ export declare namespace ApplicationListResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -8189,7 +8639,7 @@ export interface ApplicationDeleteResponse {
      */
     id?: string;
 }
-export type ApplicationGetResponse = ApplicationGetResponse.SelfHostedApplication | ApplicationGetResponse.SaaSApplication | ApplicationGetResponse.BrowserSSHApplication | ApplicationGetResponse.BrowserVNCApplication | ApplicationGetResponse.AppLauncherApplication | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication | ApplicationGetResponse.BrowserIsolationPermissionsApplication | ApplicationGetResponse.BookmarkApplication | ApplicationGetResponse.InfrastructureApplication | ApplicationGetResponse.BrowserRdpApplication;
+export type ApplicationGetResponse = ApplicationGetResponse.SelfHostedApplication | ApplicationGetResponse.SaaSApplication | ApplicationGetResponse.BrowserSSHApplication | ApplicationGetResponse.BrowserVNCApplication | ApplicationGetResponse.AppLauncherApplication | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication | ApplicationGetResponse.BrowserIsolationPermissionsApplication | ApplicationGetResponse.GatewayIdentityProxyEndpointApplication | ApplicationGetResponse.BookmarkApplication | ApplicationGetResponse.InfrastructureApplication | ApplicationGetResponse.BrowserRdpApplication;
 export declare namespace ApplicationGetResponse {
     interface SelfHostedApplication {
         /**
@@ -8259,7 +8709,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8350,10 +8800,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8379,6 +8825,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -8729,7 +9186,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -8788,7 +9245,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -8879,10 +9336,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8908,6 +9361,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -9061,7 +9525,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -9120,7 +9584,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -9211,10 +9675,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -9240,6 +9700,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -9388,7 +9859,7 @@ export declare namespace ApplicationGetResponse {
         /**
          * The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * UUID.
          */
@@ -9809,6 +10280,128 @@ export declare namespace ApplicationGetResponse {
             updated_at?: string;
         }
     }
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * The application type.
+         */
+        type: ApplicationsAPI.ApplicationType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * The custom pages that will be displayed when applicable for this application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+         * .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        interface Policy {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            created_at?: string;
+            /**
+             * The action Access will take if a user matches this policy. Infrastructure
+             * application policies can only use the Allow action.
+             */
+            decision?: ApplicationsAPI.Decision;
+            /**
+             * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+             * meet any of the Exclude rules.
+             */
+            exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Rules evaluated with an OR logical operator. A user needs to meet only one of
+             * the Include rules.
+             */
+            include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The name of the Access policy.
+             */
+            name?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * Rules evaluated with an AND logical operator. To match the policy, a user must
+             * meet all of the Require rules.
+             */
+            require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+            updated_at?: string;
+        }
+    }
     interface BookmarkApplication {
         /**
          * UUID.
@@ -10018,7 +10611,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -10126,10 +10719,6 @@ export declare namespace ApplicationGetResponse {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10155,6 +10744,17 @@ export declare namespace ApplicationGetResponse {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         interface Policy {
             /**
              * The UUID of the policy
@@ -10301,7 +10901,7 @@ export declare namespace ApplicationGetResponse {
     }
 }
 export type ApplicationRevokeTokensResponse = unknown;
-export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVNCApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.AccessBookmarkProps | ApplicationCreateParams.InfrastructureApplication | ApplicationCreateParams.BrowserRdpApplication;
+export type ApplicationCreateParams = ApplicationCreateParams.SelfHostedApplication | ApplicationCreateParams.SaaSApplication | ApplicationCreateParams.BrowserSSHApplication | ApplicationCreateParams.BrowserVNCApplication | ApplicationCreateParams.AppLauncherApplication | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication | ApplicationCreateParams.BrowserIsolationPermissionsApplication | ApplicationCreateParams.GatewayIdentityProxyEndpointApplication | ApplicationCreateParams.AccessBookmarkProps | ApplicationCreateParams.InfrastructureApplication | ApplicationCreateParams.BrowserRdpApplication;
 export declare namespace ApplicationCreateParams {
     interface SelfHostedApplication {
         /**
@@ -10378,7 +10978,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -10475,10 +11075,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10504,6 +11100,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -10841,7 +11448,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -10907,7 +11514,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -11004,10 +11611,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11033,6 +11636,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11174,7 +11788,7 @@ export declare namespace ApplicationCreateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -11240,7 +11854,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -11337,10 +11951,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11366,6 +11976,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11477,32 +12098,201 @@ export declare namespace ApplicationCreateParams {
                 scheme: 'access_service_token';
             }
             /**
-             * Attributes for configuring Access Service Token authentication scheme for SCIM
-             * provisioning to an application.
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
+    interface AppLauncherApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdPsParam>;
+        /**
+         * Body param: The image URL of the logo shown in the App Launcher header.
+         */
+        app_launcher_logo_url?: string;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The background color of the App Launcher page.
+         */
+        bg_color?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: The links in the App Launcher footer.
+         */
+        footer_links?: Array<AppLauncherApplication.FooterLink>;
+        /**
+         * Body param: The background color of the App Launcher header.
+         */
+        header_bg_color?: string;
+        /**
+         * Body param: The design of the App Launcher landing page shown to users when they
+         * log in.
+         */
+        landing_page_design?: AppLauncherApplication.LandingPageDesign;
+        /**
+         * Body param: The policies that Access applies to the application, in ascending
+         * order of precedence. Items can reference existing policies or create new
+         * policies exclusive to the application.
+         */
+        policies?: Array<AppLauncherApplication.AccessAppPolicyLink | string | AppLauncherApplication.UnionMember2>;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+        /**
+         * Body param: Determines when to skip the App Launcher landing page.
+         */
+        skip_app_launcher_login_page?: boolean;
+    }
+    namespace AppLauncherApplication {
+        interface FooterLink {
+            /**
+             * The hypertext in the footer link.
+             */
+            name: string;
+            /**
+             * the hyperlink in the footer link.
+             */
+            url: string;
+        }
+        /**
+         * The design of the App Launcher landing page shown to users when they log in.
+         */
+        interface LandingPageDesign {
+            /**
+             * The background color of the log in button on the landing page.
+             */
+            button_color?: string;
+            /**
+             * The color of the text in the log in button on the landing page.
+             */
+            button_text_color?: string;
+            /**
+             * The URL of the image shown on the landing page.
+             */
+            image_url?: string;
+            /**
+             * The message shown on the landing page.
+             */
+            message?: string;
+            /**
+             * The title shown on the landing page.
+             */
+            title?: string;
+        }
+        /**
+         * A JSON that links a reusable policy to an application.
+         */
+        interface AccessAppPolicyLink {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+        }
+        interface UnionMember2 {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
              */
-            interface AccessSCIMConfigAuthenticationAccessServiceToken {
-                /**
-                 * Client ID of the Access service token used to authenticate with the remote
-                 * service.
-                 */
-                client_id: string;
-                /**
-                 * Client secret of the Access service token used to authenticate with the remote
-                 * service.
-                 */
-                client_secret: string;
-                /**
-                 * The authentication scheme to use when making SCIM requests to this application.
-                 */
-                scheme: 'access_service_token';
-            }
+            session_duration?: string;
         }
     }
-    interface AppLauncherApplication {
+    interface DeviceEnrollmentPermissionsApplication {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: ApplicationTypeParam;
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -11518,19 +12308,11 @@ export declare namespace ApplicationCreateParams {
          * application. Defaults to all IdPs configured in your account.
          */
         allowed_idps?: Array<AllowedIdPsParam>;
-        /**
-         * Body param: The image URL of the logo shown in the App Launcher header.
-         */
-        app_launcher_logo_url?: string;
         /**
          * Body param: When set to `true`, users skip the identity provider selection step
          * during login. You must specify only one identity provider in allowed_idps.
          */
         auto_redirect_to_identity?: boolean;
-        /**
-         * Body param: The background color of the App Launcher page.
-         */
-        bg_color?: string;
         /**
          * Body param: The custom URL a user is redirected to when they are denied access
          * to the application when failing identity-based rules.
@@ -11546,72 +12328,20 @@ export declare namespace ApplicationCreateParams {
          * application
          */
         custom_pages?: Array<string>;
-        /**
-         * Body param: The links in the App Launcher footer.
-         */
-        footer_links?: Array<AppLauncherApplication.FooterLink>;
-        /**
-         * Body param: The background color of the App Launcher header.
-         */
-        header_bg_color?: string;
-        /**
-         * Body param: The design of the App Launcher landing page shown to users when they
-         * log in.
-         */
-        landing_page_design?: AppLauncherApplication.LandingPageDesign;
         /**
          * Body param: The policies that Access applies to the application, in ascending
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<AppLauncherApplication.AccessAppPolicyLink | string | AppLauncherApplication.UnionMember2>;
+        policies?: Array<DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink | string | DeviceEnrollmentPermissionsApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
          * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
          */
         session_duration?: string;
-        /**
-         * Body param: Determines when to skip the App Launcher landing page.
-         */
-        skip_app_launcher_login_page?: boolean;
     }
-    namespace AppLauncherApplication {
-        interface FooterLink {
-            /**
-             * The hypertext in the footer link.
-             */
-            name: string;
-            /**
-             * the hyperlink in the footer link.
-             */
-            url: string;
-        }
-        /**
-         * The design of the App Launcher landing page shown to users when they log in.
-         */
-        interface LandingPageDesign {
-            /**
-             * The background color of the log in button on the landing page.
-             */
-            button_color?: string;
-            /**
-             * The color of the text in the log in button on the landing page.
-             */
-            button_text_color?: string;
-            /**
-             * The URL of the image shown on the landing page.
-             */
-            image_url?: string;
-            /**
-             * The message shown on the landing page.
-             */
-            message?: string;
-            /**
-             * The title shown on the landing page.
-             */
-            title?: string;
-        }
+    namespace DeviceEnrollmentPermissionsApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11667,7 +12397,7 @@ export declare namespace ApplicationCreateParams {
             session_duration?: string;
         }
     }
-    interface DeviceEnrollmentPermissionsApplication {
+    interface BrowserIsolationPermissionsApplication {
         /**
          * Body param: The application type.
          */
@@ -11712,7 +12442,7 @@ export declare namespace ApplicationCreateParams {
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink | string | DeviceEnrollmentPermissionsApplication.UnionMember2>;
+        policies?: Array<BrowserIsolationPermissionsApplication.AccessAppPolicyLink | string | BrowserIsolationPermissionsApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -11720,7 +12450,7 @@ export declare namespace ApplicationCreateParams {
          */
         session_duration?: string;
     }
-    namespace DeviceEnrollmentPermissionsApplication {
+    namespace BrowserIsolationPermissionsApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -11776,7 +12506,7 @@ export declare namespace ApplicationCreateParams {
             session_duration?: string;
         }
     }
-    interface BrowserIsolationPermissionsApplication {
+    interface GatewayIdentityProxyEndpointApplication {
         /**
          * Body param: The application type.
          */
@@ -11816,12 +12546,21 @@ export declare namespace ApplicationCreateParams {
          * application
          */
         custom_pages?: Array<string>;
+        /**
+         * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+         * followed by .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
         /**
          * Body param: The policies that Access applies to the application, in ascending
          * order of precedence. Items can reference existing policies or create new
          * policies exclusive to the application.
          */
-        policies?: Array<BrowserIsolationPermissionsApplication.AccessAppPolicyLink | string | BrowserIsolationPermissionsApplication.UnionMember2>;
+        policies?: Array<GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink | string | GatewayIdentityProxyEndpointApplication.UnionMember2>;
         /**
          * Body param: The amount of time that tokens issued for this application will be
          * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
@@ -11829,7 +12568,7 @@ export declare namespace ApplicationCreateParams {
          */
         session_duration?: string;
     }
-    namespace BrowserIsolationPermissionsApplication {
+    namespace GatewayIdentityProxyEndpointApplication {
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -12108,7 +12847,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -12222,10 +12961,6 @@ export declare namespace ApplicationCreateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -12251,6 +12986,17 @@ export declare namespace ApplicationCreateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -12384,7 +13130,7 @@ export declare namespace ApplicationCreateParams {
         }
     }
 }
-export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVNCApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.AccessBookmarkProps | ApplicationUpdateParams.InfrastructureApplication | ApplicationUpdateParams.BrowserRdpApplication;
+export type ApplicationUpdateParams = ApplicationUpdateParams.SelfHostedApplication | ApplicationUpdateParams.SaaSApplication | ApplicationUpdateParams.BrowserSSHApplication | ApplicationUpdateParams.BrowserVNCApplication | ApplicationUpdateParams.AppLauncherApplication | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication | ApplicationUpdateParams.BrowserIsolationPermissionsApplication | ApplicationUpdateParams.GatewayIdentityProxyEndpointApplication | ApplicationUpdateParams.AccessBookmarkProps | ApplicationUpdateParams.InfrastructureApplication | ApplicationUpdateParams.BrowserRdpApplication;
 export declare namespace ApplicationUpdateParams {
     interface SelfHostedApplication {
         /**
@@ -12461,7 +13207,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -12558,10 +13304,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -12587,6 +13329,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -12924,7 +13677,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -12990,7 +13743,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -13087,10 +13840,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13116,6 +13865,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -13257,7 +14017,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13323,7 +14083,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -13420,10 +14180,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13449,6 +14205,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -13585,7 +14352,7 @@ export declare namespace ApplicationUpdateParams {
         /**
          * Body param: The application type.
          */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp';
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso' | 'infrastructure' | 'rdp' | 'mcp' | 'mcp_portal' | 'proxy_endpoint';
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
          * Zone ID.
@@ -13968,6 +14735,124 @@ export declare namespace ApplicationUpdateParams {
             session_duration?: string;
         }
     }
+    interface GatewayIdentityProxyEndpointApplication {
+        /**
+         * Body param: The application type.
+         */
+        type: ApplicationTypeParam;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<AllowedIdPsParam>;
+        /**
+         * Body param: When set to `true`, users skip the identity provider selection step
+         * during login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing identity-based rules.
+         */
+        custom_deny_url?: string;
+        /**
+         * Body param: The custom URL a user is redirected to when they are denied access
+         * to the application when failing non-identity rules.
+         */
+        custom_non_identity_deny_url?: string;
+        /**
+         * Body param: The custom pages that will be displayed when applicable for this
+         * application
+         */
+        custom_pages?: Array<string>;
+        /**
+         * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+         * followed by .proxy.cloudflare-gateway.com
+         */
+        domain?: string;
+        /**
+         * Body param: The name of the application.
+         */
+        name?: string;
+        /**
+         * Body param: The policies that Access applies to the application, in ascending
+         * order of precedence. Items can reference existing policies or create new
+         * policies exclusive to the application.
+         */
+        policies?: Array<GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink | string | GatewayIdentityProxyEndpointApplication.UnionMember2>;
+        /**
+         * Body param: The amount of time that tokens issued for this application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+         */
+        session_duration?: string;
+    }
+    namespace GatewayIdentityProxyEndpointApplication {
+        /**
+         * A JSON that links a reusable policy to an application.
+         */
+        interface AccessAppPolicyLink {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+        }
+        interface UnionMember2 {
+            /**
+             * The UUID of the policy
+             */
+            id?: string;
+            /**
+             * Administrators who can approve a temporary authentication request.
+             */
+            approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+            /**
+             * Requires the user to request access from an administrator at the start of each
+             * session.
+             */
+            approval_required?: boolean;
+            /**
+             * Require this application to be served in an isolated browser for users matching
+             * this policy. 'Client Web Isolation' must be on for the account in order to use
+             * this feature.
+             */
+            isolation_required?: boolean;
+            /**
+             * The order of execution for this policy. Must be unique for each policy within an
+             * app.
+             */
+            precedence?: number;
+            /**
+             * A custom message that will appear on the purpose justification screen.
+             */
+            purpose_justification_prompt?: string;
+            /**
+             * Require users to enter a justification when they log in to the application.
+             */
+            purpose_justification_required?: boolean;
+            /**
+             * The amount of time that tokens issued for the application will be valid. Must be
+             * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+             * m, h.
+             */
+            session_duration?: string;
+        }
+    }
     interface AccessBookmarkProps {
         /**
          * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14191,7 +15076,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+        destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination | BrowserRdpApplication.ViaMcpServerPortalDestination>;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -14305,10 +15190,6 @@ export declare namespace ApplicationUpdateParams {
              */
             uri?: string;
         }
-        /**
-         * Private destinations are an early access feature and gated behind a feature
-         * flag.
-         */
         interface PrivateDestination {
             /**
              * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14334,6 +15215,17 @@ export declare namespace ApplicationUpdateParams {
              */
             vnet_id?: string;
         }
+        /**
+         * A MCP server id configured in ai-controls. Access will secure the MCP server if
+         * accessed through a MCP portal.
+         */
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
         /**
          * A JSON that links a reusable policy to an application.
          */
@@ -14499,6 +15391,10 @@ export interface ApplicationListParams extends V4PagePaginationArrayParams {
      * Query param: Search for apps by other listed query parameters.
      */
     search?: string;
+    /**
+     * Query param: Target Criteria attributes in key=value format.
+     */
+    target_attributes?: string;
 }
 export interface ApplicationDeleteParams {
     /**