cloudflare 5.2.0 → 6.0.0-beta.1

package/src/resources/zero-trust/access/applications/applications.ts

@@ -1667,7 +1667,10 @@ export type ApplicationType =
   | 'bookmark'
   | 'dash_sso'
   | 'infrastructure'
-  | 'rdp';
+  | 'rdp'
+  | 'mcp'
+  | 'mcp_portal'
+  | 'proxy_endpoint';
 
 /**
  * The application type.
@@ -1683,7 +1686,10 @@ export type ApplicationTypeParam =
   | 'bookmark'
   | 'dash_sso'
   | 'infrastructure'
-  | 'rdp';
+  | 'rdp'
+  | 'mcp'
+  | 'mcp_portal'
+  | 'proxy_endpoint';
 
 export interface CORSHeaders {
   /**
@@ -2583,6 +2589,7 @@ export type ApplicationCreateResponse =
   | ApplicationCreateResponse.AppLauncherApplication
   | ApplicationCreateResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationCreateResponse.BrowserIsolationPermissionsApplication
+  | ApplicationCreateResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationCreateResponse.BookmarkApplication
   | ApplicationCreateResponse.InfrastructureApplication
   | ApplicationCreateResponse.BrowserRdpApplication;
@@ -2670,7 +2677,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -2779,10 +2790,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -2814,6 +2821,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -3263,7 +3283,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -3335,7 +3358,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -3444,10 +3471,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3479,6 +3502,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -3681,7 +3717,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -3753,7 +3792,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -3862,10 +3905,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -3897,6 +3936,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -4093,7 +4145,10 @@ export namespace ApplicationCreateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -4608,6 +4663,155 @@ export namespace ApplicationCreateResponse {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * The custom pages that will be displayed when applicable for this application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
   export interface BookmarkApplication {
     /**
      * UUID.
@@ -4859,7 +5063,11 @@ export namespace ApplicationCreateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -4986,10 +5194,6 @@ export namespace ApplicationCreateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5021,6 +5225,19 @@ export namespace ApplicationCreateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -5211,6 +5428,7 @@ export type ApplicationUpdateResponse =
   | ApplicationUpdateResponse.AppLauncherApplication
   | ApplicationUpdateResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationUpdateResponse.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationUpdateResponse.BookmarkApplication
   | ApplicationUpdateResponse.InfrastructureApplication
   | ApplicationUpdateResponse.BrowserRdpApplication;
@@ -5298,7 +5516,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -5407,10 +5629,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -5442,6 +5660,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -5891,7 +6122,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -5963,7 +6197,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -6072,10 +6310,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6107,6 +6341,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -6309,7 +6556,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -6381,7 +6631,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -6490,10 +6744,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -6525,6 +6775,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -6721,7 +6984,10 @@ export namespace ApplicationUpdateResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -7236,16 +7502,22 @@ export namespace ApplicationUpdateResponse {
     }
   }
 
-  export interface BookmarkApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
     /**
      * UUID.
      */
     id?: string;
 
     /**
-     * Displays the application in the App Launcher.
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    app_launcher_visible?: boolean;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
@@ -7253,39 +7525,182 @@ export namespace ApplicationUpdateResponse {
     aud?: string;
 
     /**
-     * The URL or domain of the bookmark.
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
      */
-    domain?: string;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * The image URL for the logo shown in the App Launcher dashboard.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
      */
-    logo_url?: string;
+    custom_deny_url?: string;
 
     /**
-     * The name of the application.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
      */
-    name?: string;
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The tags you want assigned to an application. Tags are used to filter
-     * applications in the App Launcher dashboard.
+     * The custom pages that will be displayed when applicable for this application
      */
-    tags?: Array<string>;
+    custom_pages?: Array<string>;
 
     /**
-     * The application type.
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
      */
-    type?: ApplicationsAPI.ApplicationType;
-  }
-
-  export interface InfrastructureApplication {
-    target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+    domain?: string;
 
     /**
-     * The application type.
+     * The name of the application.
      */
-    type: ApplicationsAPI.ApplicationType;
+    name?: string;
+
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
+  export interface BookmarkApplication {
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * The URL or domain of the bookmark.
+     */
+    domain?: string;
+
+    /**
+     * The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    /**
+     * The tags you want assigned to an application. Tags are used to filter
+     * applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * The application type.
+     */
+    type?: ApplicationsAPI.ApplicationType;
+  }
+
+  export interface InfrastructureApplication {
+    target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
 
     /**
      * UUID.
@@ -7487,7 +7902,11 @@ export namespace ApplicationUpdateResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -7614,10 +8033,6 @@ export namespace ApplicationUpdateResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -7649,6 +8064,19 @@ export namespace ApplicationUpdateResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -7839,6 +8267,7 @@ export type ApplicationListResponse =
   | ApplicationListResponse.AppLauncherApplication
   | ApplicationListResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationListResponse.BrowserIsolationPermissionsApplication
+  | ApplicationListResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationListResponse.BookmarkApplication
   | ApplicationListResponse.InfrastructureApplication
   | ApplicationListResponse.BrowserRdpApplication;
@@ -7926,7 +8355,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -8035,10 +8468,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8070,6 +8499,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -8519,7 +8961,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -8591,7 +9036,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -8700,10 +9149,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -8735,6 +9180,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -8937,7 +9395,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -9009,7 +9470,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -9118,10 +9583,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -9153,6 +9614,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -9349,7 +9823,10 @@ export namespace ApplicationListResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -9864,16 +10341,22 @@ export namespace ApplicationListResponse {
     }
   }
 
-  export interface BookmarkApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
     /**
      * UUID.
      */
     id?: string;
 
     /**
-     * Displays the application in the App Launcher.
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
      */
-    app_launcher_visible?: boolean;
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
 
     /**
      * Audience tag.
@@ -9881,73 +10364,216 @@ export namespace ApplicationListResponse {
     aud?: string;
 
     /**
-     * The URL or domain of the bookmark.
-     */
-    domain?: string;
-
-    /**
-     * The image URL for the logo shown in the App Launcher dashboard.
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
      */
-    logo_url?: string;
+    auto_redirect_to_identity?: boolean;
 
     /**
-     * The name of the application.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
      */
-    name?: string;
+    custom_deny_url?: string;
 
     /**
-     * The tags you want assigned to an application. Tags are used to filter
-     * applications in the App Launcher dashboard.
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
      */
-    tags?: Array<string>;
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The application type.
+     * The custom pages that will be displayed when applicable for this application
      */
-    type?: ApplicationsAPI.ApplicationType;
-  }
-
-  export interface InfrastructureApplication {
-    target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+    custom_pages?: Array<string>;
 
     /**
-     * The application type.
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
      */
-    type: ApplicationsAPI.ApplicationType;
+    domain?: string;
 
     /**
-     * UUID.
+     * The name of the application.
      */
-    id?: string;
+    name?: string;
 
-    /**
-     * Audience tag.
-     */
-    aud?: string;
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
 
     /**
-     * The name of the application.
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
      */
-    name?: string;
-
-    policies?: Array<InfrastructureApplication.Policy>;
+    session_duration?: string;
   }
 
-  export namespace InfrastructureApplication {
-    export interface TargetCriterion {
+  export namespace GatewayIdentityProxyEndpointApplication {
+    export interface Policy {
       /**
-       * The port that the targets use for the chosen communication protocol. A port
-       * cannot be assigned to multiple protocols.
+       * The UUID of the policy
        */
-      port: number;
+      id?: string;
 
       /**
-       * The communication protocol your application secures.
+       * Administrators who can approve a temporary authentication request.
        */
-      protocol: 'SSH';
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
 
       /**
-       * Contains a map of target attribute keys to target attribute values.
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
+  export interface BookmarkApplication {
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * The URL or domain of the bookmark.
+     */
+    domain?: string;
+
+    /**
+     * The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    /**
+     * The tags you want assigned to an application. Tags are used to filter
+     * applications in the App Launcher dashboard.
+     */
+    tags?: Array<string>;
+
+    /**
+     * The application type.
+     */
+    type?: ApplicationsAPI.ApplicationType;
+  }
+
+  export interface InfrastructureApplication {
+    target_criteria: Array<InfrastructureApplication.TargetCriterion>;
+
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<InfrastructureApplication.Policy>;
+  }
+
+  export namespace InfrastructureApplication {
+    export interface TargetCriterion {
+      /**
+       * The port that the targets use for the chosen communication protocol. A port
+       * cannot be assigned to multiple protocols.
+       */
+      port: number;
+
+      /**
+       * The communication protocol your application secures.
+       */
+      protocol: 'SSH';
+
+      /**
+       * Contains a map of target attribute keys to target attribute values.
        */
       target_attributes: { [key: string]: Array<string> };
     }
@@ -10115,7 +10741,11 @@ export namespace ApplicationListResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -10242,10 +10872,6 @@ export namespace ApplicationListResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10277,6 +10903,19 @@ export namespace ApplicationListResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -10474,6 +11113,7 @@ export type ApplicationGetResponse =
   | ApplicationGetResponse.AppLauncherApplication
   | ApplicationGetResponse.DeviceEnrollmentPermissionsApplication
   | ApplicationGetResponse.BrowserIsolationPermissionsApplication
+  | ApplicationGetResponse.GatewayIdentityProxyEndpointApplication
   | ApplicationGetResponse.BookmarkApplication
   | ApplicationGetResponse.InfrastructureApplication
   | ApplicationGetResponse.BrowserRdpApplication;
@@ -10561,7 +11201,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -10670,10 +11314,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -10705,6 +11345,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -11154,7 +11807,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -11226,7 +11882,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -11335,10 +11995,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11370,6 +12026,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -11572,7 +12241,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -11644,7 +12316,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -11753,10 +12429,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -11788,6 +12460,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -11984,7 +12669,10 @@ export namespace ApplicationGetResponse {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * UUID.
@@ -12044,24 +12732,220 @@ export namespace ApplicationGetResponse {
     /**
      * The links in the App Launcher footer.
      */
-    footer_links?: Array<AppLauncherApplication.FooterLink>;
+    footer_links?: Array<AppLauncherApplication.FooterLink>;
+
+    /**
+     * The background color of the App Launcher header.
+     */
+    header_bg_color?: string;
+
+    /**
+     * The design of the App Launcher landing page shown to users when they log in.
+     */
+    landing_page_design?: AppLauncherApplication.LandingPageDesign;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    policies?: Array<AppLauncherApplication.Policy>;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+
+    /**
+     * Determines when to skip the App Launcher landing page.
+     */
+    skip_app_launcher_login_page?: boolean;
+  }
+
+  export namespace AppLauncherApplication {
+    export interface FooterLink {
+      /**
+       * The hypertext in the footer link.
+       */
+      name: string;
+
+      /**
+       * the hyperlink in the footer link.
+       */
+      url: string;
+    }
+
+    /**
+     * The design of the App Launcher landing page shown to users when they log in.
+     */
+    export interface LandingPageDesign {
+      /**
+       * The background color of the log in button on the landing page.
+       */
+      button_color?: string;
+
+      /**
+       * The color of the text in the log in button on the landing page.
+       */
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    export interface Policy {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      created_at?: string;
+
+      /**
+       * The action Access will take if a user matches this policy. Infrastructure
+       * application policies can only use the Allow action.
+       */
+      decision?: ApplicationsAPI.Decision;
+
+      /**
+       * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+       * meet any of the Exclude rules.
+       */
+      exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Rules evaluated with an OR logical operator. A user needs to meet only one of
+       * the Include rules.
+       */
+      include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The name of the Access policy.
+       */
+      name?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * Rules evaluated with an AND logical operator. To match the policy, a user must
+       * meet all of the Require rules.
+       */
+      require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+
+      updated_at?: string;
+    }
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * The application type.
+     */
+    type: ApplicationsAPI.ApplicationType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
 
     /**
-     * The background color of the App Launcher header.
+     * The custom pages that will be displayed when applicable for this application
      */
-    header_bg_color?: string;
+    custom_pages?: Array<string>;
 
     /**
-     * The design of the App Launcher landing page shown to users when they log in.
+     * The primary hostname and path secured by Access. This domain will be displayed
+     * if the app is visible in the App Launcher.
      */
-    landing_page_design?: AppLauncherApplication.LandingPageDesign;
+    domain?: string;
 
     /**
      * The name of the application.
      */
     name?: string;
 
-    policies?: Array<AppLauncherApplication.Policy>;
+    policies?: Array<DeviceEnrollmentPermissionsApplication.Policy>;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -12069,56 +12953,9 @@ export namespace ApplicationGetResponse {
      * s, m, h. Note: unsupported for infrastructure type applications.
      */
     session_duration?: string;
-
-    /**
-     * Determines when to skip the App Launcher landing page.
-     */
-    skip_app_launcher_login_page?: boolean;
   }
 
-  export namespace AppLauncherApplication {
-    export interface FooterLink {
-      /**
-       * The hypertext in the footer link.
-       */
-      name: string;
-
-      /**
-       * the hyperlink in the footer link.
-       */
-      url: string;
-    }
-
-    /**
-     * The design of the App Launcher landing page shown to users when they log in.
-     */
-    export interface LandingPageDesign {
-      /**
-       * The background color of the log in button on the landing page.
-       */
-      button_color?: string;
-
-      /**
-       * The color of the text in the log in button on the landing page.
-       */
-      button_text_color?: string;
-
-      /**
-       * The URL of the image shown on the landing page.
-       */
-      image_url?: string;
-
-      /**
-       * The message shown on the landing page.
-       */
-      message?: string;
-
-      /**
-       * The title shown on the landing page.
-       */
-      title?: string;
-    }
-
+  export namespace DeviceEnrollmentPermissionsApplication {
     export interface Policy {
       /**
        * The UUID of the policy
@@ -12201,7 +13038,7 @@ export namespace ApplicationGetResponse {
     }
   }
 
-  export interface DeviceEnrollmentPermissionsApplication {
+  export interface BrowserIsolationPermissionsApplication {
     /**
      * The application type.
      */
@@ -12257,7 +13094,7 @@ export namespace ApplicationGetResponse {
      */
     name?: string;
 
-    policies?: Array<DeviceEnrollmentPermissionsApplication.Policy>;
+    policies?: Array<BrowserIsolationPermissionsApplication.Policy>;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -12267,7 +13104,7 @@ export namespace ApplicationGetResponse {
     session_duration?: string;
   }
 
-  export namespace DeviceEnrollmentPermissionsApplication {
+  export namespace BrowserIsolationPermissionsApplication {
     export interface Policy {
       /**
        * The UUID of the policy
@@ -12350,7 +13187,7 @@ export namespace ApplicationGetResponse {
     }
   }
 
-  export interface BrowserIsolationPermissionsApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
     /**
      * The application type.
      */
@@ -12396,8 +13233,8 @@ export namespace ApplicationGetResponse {
     custom_pages?: Array<string>;
 
     /**
-     * The primary hostname and path secured by Access. This domain will be displayed
-     * if the app is visible in the App Launcher.
+     * The proxy endpoint domain in the format: 10 alphanumeric characters followed by
+     * .proxy.cloudflare-gateway.com
      */
     domain?: string;
 
@@ -12406,7 +13243,7 @@ export namespace ApplicationGetResponse {
      */
     name?: string;
 
-    policies?: Array<BrowserIsolationPermissionsApplication.Policy>;
+    policies?: Array<GatewayIdentityProxyEndpointApplication.Policy>;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -12416,7 +13253,7 @@ export namespace ApplicationGetResponse {
     session_duration?: string;
   }
 
-  export namespace BrowserIsolationPermissionsApplication {
+  export namespace GatewayIdentityProxyEndpointApplication {
     export interface Policy {
       /**
        * The UUID of the policy
@@ -12750,7 +13587,11 @@ export namespace ApplicationGetResponse {
      * allow for more flexibility in defining different types of domains. If
      * `destinations` are provided, then `self_hosted_domains` will be ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Enables the binding cookie, which increases security against compromised
@@ -12877,10 +13718,6 @@ export namespace ApplicationGetResponse {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -12912,6 +13749,19 @@ export namespace ApplicationGetResponse {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     export interface Policy {
       /**
        * The UUID of the policy
@@ -13104,6 +13954,7 @@ export type ApplicationCreateParams =
   | ApplicationCreateParams.AppLauncherApplication
   | ApplicationCreateParams.DeviceEnrollmentPermissionsApplication
   | ApplicationCreateParams.BrowserIsolationPermissionsApplication
+  | ApplicationCreateParams.GatewayIdentityProxyEndpointApplication
   | ApplicationCreateParams.AccessBookmarkProps
   | ApplicationCreateParams.InfrastructureApplication
   | ApplicationCreateParams.BrowserRdpApplication;
@@ -13198,7 +14049,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -13313,10 +14168,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -13348,6 +14199,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -13774,7 +14638,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -13853,7 +14720,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -13968,10 +14839,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14003,6 +14870,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14188,7 +15068,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14267,7 +15150,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -14382,10 +15269,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -14417,6 +15300,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14596,7 +15492,10 @@ export declare namespace ApplicationCreateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -14702,35 +15601,168 @@ export declare namespace ApplicationCreateParams {
     }
 
     /**
-     * The design of the App Launcher landing page shown to users when they log in.
+     * The design of the App Launcher landing page shown to users when they log in.
+     */
+    export interface LandingPageDesign {
+      /**
+       * The background color of the log in button on the landing page.
+       */
+      button_color?: string;
+
+      /**
+       * The color of the text in the log in button on the landing page.
+       */
+      button_text_color?: string;
+
+      /**
+       * The URL of the image shown on the landing page.
+       */
+      image_url?: string;
+
+      /**
+       * The message shown on the landing page.
+       */
+      message?: string;
+
+      /**
+       * The title shown on the landing page.
+       */
+      title?: string;
+    }
+
+    /**
+     * A JSON that links a reusable policy to an application.
+     */
+    export interface AccessAppPolicyLink {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+    }
+
+    export interface UnionMember2 {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+    }
+  }
+
+  export interface DeviceEnrollmentPermissionsApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: ApplicationTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdPsParam>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: The policies that Access applies to the application, in ascending
+     * order of precedence. Items can reference existing policies or create new
+     * policies exclusive to the application.
      */
-    export interface LandingPageDesign {
-      /**
-       * The background color of the log in button on the landing page.
-       */
-      button_color?: string;
-
-      /**
-       * The color of the text in the log in button on the landing page.
-       */
-      button_text_color?: string;
-
-      /**
-       * The URL of the image shown on the landing page.
-       */
-      image_url?: string;
-
-      /**
-       * The message shown on the landing page.
-       */
-      message?: string;
+    policies?: Array<
+      | DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink
+      | string
+      | DeviceEnrollmentPermissionsApplication.UnionMember2
+    >;
 
-      /**
-       * The title shown on the landing page.
-       */
-      title?: string;
-    }
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
 
+  export namespace DeviceEnrollmentPermissionsApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14796,7 +15828,7 @@ export declare namespace ApplicationCreateParams {
     }
   }
 
-  export interface DeviceEnrollmentPermissionsApplication {
+  export interface BrowserIsolationPermissionsApplication {
     /**
      * Body param: The application type.
      */
@@ -14850,9 +15882,9 @@ export declare namespace ApplicationCreateParams {
      * policies exclusive to the application.
      */
     policies?: Array<
-      | DeviceEnrollmentPermissionsApplication.AccessAppPolicyLink
+      | BrowserIsolationPermissionsApplication.AccessAppPolicyLink
       | string
-      | DeviceEnrollmentPermissionsApplication.UnionMember2
+      | BrowserIsolationPermissionsApplication.UnionMember2
     >;
 
     /**
@@ -14863,7 +15895,7 @@ export declare namespace ApplicationCreateParams {
     session_duration?: string;
   }
 
-  export namespace DeviceEnrollmentPermissionsApplication {
+  export namespace BrowserIsolationPermissionsApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -14929,7 +15961,7 @@ export declare namespace ApplicationCreateParams {
     }
   }
 
-  export interface BrowserIsolationPermissionsApplication {
+  export interface GatewayIdentityProxyEndpointApplication {
     /**
      * Body param: The application type.
      */
@@ -14977,15 +16009,26 @@ export declare namespace ApplicationCreateParams {
      */
     custom_pages?: Array<string>;
 
+    /**
+     * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+     * followed by .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
     /**
      * Body param: The policies that Access applies to the application, in ascending
      * order of precedence. Items can reference existing policies or create new
      * policies exclusive to the application.
      */
     policies?: Array<
-      | BrowserIsolationPermissionsApplication.AccessAppPolicyLink
+      | GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink
       | string
-      | BrowserIsolationPermissionsApplication.UnionMember2
+      | GatewayIdentityProxyEndpointApplication.UnionMember2
     >;
 
     /**
@@ -14996,7 +16039,7 @@ export declare namespace ApplicationCreateParams {
     session_duration?: string;
   }
 
-  export namespace BrowserIsolationPermissionsApplication {
+  export namespace GatewayIdentityProxyEndpointApplication {
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -15324,7 +16367,11 @@ export declare namespace ApplicationCreateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -15457,10 +16504,6 @@ export declare namespace ApplicationCreateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -15492,6 +16535,19 @@ export declare namespace ApplicationCreateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -15665,6 +16721,7 @@ export type ApplicationUpdateParams =
   | ApplicationUpdateParams.AppLauncherApplication
   | ApplicationUpdateParams.DeviceEnrollmentPermissionsApplication
   | ApplicationUpdateParams.BrowserIsolationPermissionsApplication
+  | ApplicationUpdateParams.GatewayIdentityProxyEndpointApplication
   | ApplicationUpdateParams.AccessBookmarkProps
   | ApplicationUpdateParams.InfrastructureApplication
   | ApplicationUpdateParams.BrowserRdpApplication;
@@ -15759,7 +16816,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination>;
+    destinations?: Array<
+      | SelfHostedApplication.PublicDestination
+      | SelfHostedApplication.PrivateDestination
+      | SelfHostedApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -15874,10 +16935,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -15909,6 +16966,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -16335,7 +17405,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -16414,7 +17487,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserSSHApplication.PublicDestination
+      | BrowserSSHApplication.PrivateDestination
+      | BrowserSSHApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -16529,10 +17606,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -16564,6 +17637,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -16749,7 +17835,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -16828,7 +17917,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserVNCApplication.PublicDestination
+      | BrowserVNCApplication.PrivateDestination
+      | BrowserVNCApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -16943,10 +18036,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -16978,6 +18067,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -17157,7 +18259,10 @@ export declare namespace ApplicationUpdateParams {
       | 'bookmark'
       | 'dash_sso'
       | 'infrastructure'
-      | 'rdp';
+      | 'rdp'
+      | 'mcp'
+      | 'mcp_portal'
+      | 'proxy_endpoint';
 
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -17623,6 +18728,150 @@ export declare namespace ApplicationUpdateParams {
     }
   }
 
+  export interface GatewayIdentityProxyEndpointApplication {
+    /**
+     * Body param: The application type.
+     */
+    type: ApplicationTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<AllowedIdPsParam>;
+
+    /**
+     * Body param: When set to `true`, users skip the identity provider selection step
+     * during login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing identity-based rules.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Body param: The custom URL a user is redirected to when they are denied access
+     * to the application when failing non-identity rules.
+     */
+    custom_non_identity_deny_url?: string;
+
+    /**
+     * Body param: The custom pages that will be displayed when applicable for this
+     * application
+     */
+    custom_pages?: Array<string>;
+
+    /**
+     * Body param: The proxy endpoint domain in the format: 10 alphanumeric characters
+     * followed by .proxy.cloudflare-gateway.com
+     */
+    domain?: string;
+
+    /**
+     * Body param: The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Body param: The policies that Access applies to the application, in ascending
+     * order of precedence. Items can reference existing policies or create new
+     * policies exclusive to the application.
+     */
+    policies?: Array<
+      | GatewayIdentityProxyEndpointApplication.AccessAppPolicyLink
+      | string
+      | GatewayIdentityProxyEndpointApplication.UnionMember2
+    >;
+
+    /**
+     * Body param: The amount of time that tokens issued for this application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
+     */
+    session_duration?: string;
+  }
+
+  export namespace GatewayIdentityProxyEndpointApplication {
+    /**
+     * A JSON that links a reusable policy to an application.
+     */
+    export interface AccessAppPolicyLink {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+    }
+
+    export interface UnionMember2 {
+      /**
+       * The UUID of the policy
+       */
+      id?: string;
+
+      /**
+       * Administrators who can approve a temporary authentication request.
+       */
+      approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+
+      /**
+       * Requires the user to request access from an administrator at the start of each
+       * session.
+       */
+      approval_required?: boolean;
+
+      /**
+       * Require this application to be served in an isolated browser for users matching
+       * this policy. 'Client Web Isolation' must be on for the account in order to use
+       * this feature.
+       */
+      isolation_required?: boolean;
+
+      /**
+       * The order of execution for this policy. Must be unique for each policy within an
+       * app.
+       */
+      precedence?: number;
+
+      /**
+       * A custom message that will appear on the purpose justification screen.
+       */
+      purpose_justification_prompt?: string;
+
+      /**
+       * Require users to enter a justification when they log in to the application.
+       */
+      purpose_justification_required?: boolean;
+
+      /**
+       * The amount of time that tokens issued for the application will be valid. Must be
+       * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+       * m, h.
+       */
+      session_duration?: string;
+    }
+  }
+
   export interface AccessBookmarkProps {
     /**
      * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
@@ -17885,7 +19134,11 @@ export declare namespace ApplicationUpdateParams {
      * of domains. If `destinations` are provided, then `self_hosted_domains` will be
      * ignored.
      */
-    destinations?: Array<BrowserRdpApplication.PublicDestination | BrowserRdpApplication.PrivateDestination>;
+    destinations?: Array<
+      | BrowserRdpApplication.PublicDestination
+      | BrowserRdpApplication.PrivateDestination
+      | BrowserRdpApplication.ViaMcpServerPortalDestination
+    >;
 
     /**
      * Body param: Enables the binding cookie, which increases security against
@@ -18018,10 +19271,6 @@ export declare namespace ApplicationUpdateParams {
       uri?: string;
     }
 
-    /**
-     * Private destinations are an early access feature and gated behind a feature
-     * flag.
-     */
     export interface PrivateDestination {
       /**
        * The CIDR range of the destination. Single IPs will be computed as /32.
@@ -18053,6 +19302,19 @@ export declare namespace ApplicationUpdateParams {
       vnet_id?: string;
     }
 
+    /**
+     * A MCP server id configured in ai-controls. Access will secure the MCP server if
+     * accessed through a MCP portal.
+     */
+    export interface ViaMcpServerPortalDestination {
+      /**
+       * The MCP server id configured in ai-controls.
+       */
+      mcp_server_id?: string;
+
+      type?: 'via_mcp_server_portal';
+    }
+
     /**
      * A JSON that links a reusable policy to an application.
      */
@@ -18256,6 +19518,11 @@ export interface ApplicationListParams extends V4PagePaginationArrayParams {
    * Query param: Search for apps by other listed query parameters.
    */
   search?: string;
+
+  /**
+   * Query param: Target Criteria attributes in key=value format.
+   */
+  target_attributes?: string;
 }
 
 export interface ApplicationDeleteParams {