cloudflare 6.1.0 → 6.2.0

package/src/resources/radar/bgp/rpki/roas.ts

@@ -0,0 +1,120 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../resource';
+import { isRequestOptions } from '../../../../core';
+import * as Core from '../../../../core';
+
+export class Roas extends APIResource {
+  /**
+   * Retrieves RPKI ROA (Route Origin Authorization) validation ratios over time.
+   * Returns the selected metric as a time series. Supports filtering by ASN or
+   * location (country code) — multiple values of the same filter type produce one
+   * series per value. If no ASN or location is specified, returns the global
+   * aggregate.
+   *
+   * @example
+   * ```ts
+   * const response =
+   *   await client.radar.bgp.rpki.roas.timeseries();
+   * ```
+   */
+  timeseries(
+    query?: RoaTimeseriesParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<RoaTimeseriesResponse>;
+  timeseries(options?: Core.RequestOptions): Core.APIPromise<RoaTimeseriesResponse>;
+  timeseries(
+    query: RoaTimeseriesParams | Core.RequestOptions = {},
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<RoaTimeseriesResponse> {
+    if (isRequestOptions(query)) {
+      return this.timeseries({}, query);
+    }
+    return (
+      this._client.get('/radar/bgp/rpki/roas/timeseries', { query, ...options }) as Core.APIPromise<{
+        result: RoaTimeseriesResponse;
+      }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export interface RoaTimeseriesResponse {
+  meta: RoaTimeseriesResponse.Meta;
+
+  serie_0: RoaTimeseriesResponse.Serie0;
+}
+
+export namespace RoaTimeseriesResponse {
+  export interface Meta {
+    /**
+     * Timestamp of the underlying data.
+     */
+    dataTime: string;
+
+    /**
+     * Timestamp when the query was executed.
+     */
+    queryTime: string;
+  }
+
+  export interface Serie0 {
+    timestamps: Array<string>;
+
+    values: Array<string>;
+  }
+}
+
+export interface RoaTimeseriesParams {
+  /**
+   * Filters results by Autonomous System Number. Specify one or more ASNs. Multiple
+   * values generate one series per ASN.
+   */
+  asn?: Array<string>;
+
+  /**
+   * End of the date range (inclusive).
+   */
+  dateEnd?: string;
+
+  /**
+   * Start of the date range (inclusive).
+   */
+  dateStart?: string;
+
+  /**
+   * Format in which results will be returned.
+   */
+  format?: 'JSON' | 'CSV';
+
+  /**
+   * Filters results by location. Specify a comma-separated list of alpha-2 location
+   * codes.
+   */
+  location?: Array<string>;
+
+  /**
+   * Which RPKI ROA validation metric to return. validPfxsRatio = ratio of RPKI-valid
+   * prefixes (IPv4+IPv6 combined). validPfxsV4Ratio / validPfxsV6Ratio = same, split
+   * by IP version. validIpsRatio = ratio of RPKI-valid address space (IPv4 /24s +
+   * IPv6 /48s). validIpsV4Ratio / validIpsV6Ratio = same, split by IP version.
+   */
+  metric?:
+    | 'validPfxsRatio'
+    | 'validPfxsV4Ratio'
+    | 'validPfxsV6Ratio'
+    | 'validIpsRatio'
+    | 'validIpsV4Ratio'
+    | 'validIpsV6Ratio';
+
+  /**
+   * Array of names used to label the series in the response.
+   */
+  name?: Array<string>;
+}
+
+export declare namespace Roas {
+  export {
+    type RoaTimeseriesResponse as RoaTimeseriesResponse,
+    type RoaTimeseriesParams as RoaTimeseriesParams,
+  };
+}

package/src/resources/radar/bgp/rpki/rpki.ts

@@ -11,12 +11,16 @@ import {
   ASPATimeseriesParams,
   ASPATimeseriesResponse,
 } from './aspa';
+import * as RoasAPI from './roas';
+import { RoaTimeseriesParams, RoaTimeseriesResponse, Roas } from './roas';
 
 export class RPKI extends APIResource {
   aspa: ASPAAPI.ASPA = new ASPAAPI.ASPA(this._client);
+  roas: RoasAPI.Roas = new RoasAPI.Roas(this._client);
 }
 
 RPKI.ASPA = ASPA;
+RPKI.Roas = Roas;
 
 export declare namespace RPKI {
   export {
@@ -28,4 +32,10 @@ export declare namespace RPKI {
     type ASPASnapshotParams as ASPASnapshotParams,
     type ASPATimeseriesParams as ASPATimeseriesParams,
   };
+
+  export {
+    Roas as Roas,
+    type RoaTimeseriesResponse as RoaTimeseriesResponse,
+    type RoaTimeseriesParams as RoaTimeseriesParams,
+  };
 }

package/src/resources/radar/http/http.ts

@@ -80,6 +80,7 @@ export class HTTP extends APIResource {
   summaryV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -98,6 +99,7 @@ export class HTTP extends APIResource {
   summaryV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -115,6 +117,7 @@ export class HTTP extends APIResource {
   summaryV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -180,6 +183,7 @@ export class HTTP extends APIResource {
   timeseriesGroupsV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -198,6 +202,7 @@ export class HTTP extends APIResource {
   timeseriesGroupsV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -215,6 +220,7 @@ export class HTTP extends APIResource {
   timeseriesGroupsV2(
     dimension:
       | 'ADM1'
+      | 'API_TRAFFIC'
       | 'AS'
       | 'BOT_CLASS'
       | 'BROWSER'
@@ -656,6 +662,12 @@ export namespace HTTPTimeseriesGroupsV2Response {
 }
 
 export interface HTTPSummaryV2Params {
+  /**
+   * Filters results by API traffic classification. API traffic is identified by JSON
+   * or XML response content types on dynamic (non-cacheable) HTTP requests.
+   */
+  apiTraffic?: Array<'API' | 'NON_API'>;
+
   /**
    * Filters results by Autonomous System. Specify one or more Autonomous System
    * Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from
@@ -765,6 +777,12 @@ export interface HTTPTimeseriesParams {
    */
   aggInterval?: '15m' | '1h' | '1d' | '1w';
 
+  /**
+   * Filters results by API traffic classification. API traffic is identified by JSON
+   * or XML response content types on dynamic (non-cacheable) HTTP requests.
+   */
+  apiTraffic?: Array<'API' | 'NON_API'>;
+
   /**
    * Filters results by Autonomous System. Specify one or more Autonomous System
    * Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from
@@ -878,6 +896,12 @@ export interface HTTPTimeseriesGroupsV2Params {
    */
   aggInterval?: '15m' | '1h' | '1d' | '1w';
 
+  /**
+   * Filters results by API traffic classification. API traffic is identified by JSON
+   * or XML response content types on dynamic (non-cacheable) HTTP requests.
+   */
+  apiTraffic?: Array<'API' | 'NON_API'>;
+
   /**
    * Filters results by Autonomous System. Specify one or more Autonomous System
    * Numbers (ASNs) as a comma-separated list. Prefix with `-` to exclude ASNs from

package/src/resources/radar/post-quantum/tls.ts

@@ -6,8 +6,9 @@ import * as Core from '../../../core';
 export class TLS extends APIResource {
   /**
    * Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key
-   * exchange. Returns information about the negotiated key exchange algorithm and
-   * whether it uses PQ cryptography.
+   * exchange. Returns information about the negotiated key exchange algorithm,
+   * whether it uses PQ cryptography, and any detected TLS implementation bugs (Split
+   * ClientHello, HRR failure, etc.).
    *
    * @example
    * ```ts
@@ -26,6 +27,8 @@ export class TLS extends APIResource {
 }
 
 export interface TLSSupportResponse {
+  bugs: TLSSupportResponse.Bugs;
+
   /**
    * The host that was tested
    */
@@ -42,11 +45,37 @@ export interface TLSSupportResponse {
   kexName: string;
 
   /**
-   * Whether the negotiated key exchange uses Post-Quantum cryptography
+   * Whether the negotiated key exchange uses Post-Quantum cryptography (specifically
+   * X25519MLKEM768)
    */
   pq: boolean;
 }
 
+export namespace TLSSupportResponse {
+  export interface Bugs {
+    /**
+     * Server sends a HelloRetryRequest but fails to complete the handshake after the
+     * client sends the second ClientHello. Often caused by non-compliant TLS 1.3
+     * implementations on shared hosting providers.
+     */
+    hrrFailure: boolean;
+
+    /**
+     * Server rejects fragmented ClientHello caused by large PQ keyshare, but accepts
+     * classical (non-PQ) handshakes. Typically caused by middleboxes or firewalls that
+     * cannot reassemble split TLS ClientHello messages.
+     */
+    splitClientHello: boolean;
+
+    /**
+     * Server cannot handle an unknown key exchange algorithm in the ClientHello
+     * keyshare extension. Compliant servers should respond with HelloRetryRequest for
+     * a supported algorithm.
+     */
+    unknownKeyshare: boolean;
+  }
+}
+
 export interface TLSSupportParams {
   /**
    * Hostname or IP address to test for Post-Quantum TLS support, optionally with

package/src/resources/radar/quality/iqi.ts

@@ -318,13 +318,9 @@ export namespace IQITimeseriesGroupsResponse {
   }
 
   export interface Serie0 {
-    p25: Array<string>;
-
-    p50: Array<string>;
-
-    p75: Array<string>;
-
     timestamps: Array<string>;
+
+    [k: string]: Array<string> | Array<string> | undefined;
   }
 }
 

package/src/resources/resource-sharing/resource-sharing.ts

@@ -291,7 +291,8 @@ export namespace ResourceSharingCreateResponse {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
 
     /**
      * Resource Version.
@@ -418,7 +419,8 @@ export namespace ResourceSharingUpdateResponse {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
 
     /**
      * Resource Version.
@@ -545,7 +547,8 @@ export namespace ResourceSharingListResponse {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
 
     /**
      * Resource Version.
@@ -672,7 +675,8 @@ export namespace ResourceSharingDeleteResponse {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
 
     /**
      * Resource Version.
@@ -799,7 +803,8 @@ export namespace ResourceSharingGetResponse {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
 
     /**
      * Resource Version.
@@ -875,7 +880,8 @@ export namespace ResourceSharingCreateParams {
       | 'gateway-policy'
       | 'gateway-destination-ip'
       | 'gateway-block-page-settings'
-      | 'gateway-extended-email-matching';
+      | 'gateway-extended-email-matching'
+      | 'idp-federation-grant';
   }
 }
 
@@ -931,6 +937,7 @@ export interface ResourceSharingListParams extends V4PagePaginationArrayParams {
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
     | 'gateway-extended-email-matching'
+    | 'idp-federation-grant'
   >;
 
   /**
@@ -938,6 +945,14 @@ export interface ResourceSharingListParams extends V4PagePaginationArrayParams {
    */
   status?: 'active' | 'deleting' | 'deleted';
 
+  /**
+   * Query param: Filter shares by tag. Each value is either `key=value` (matches
+   * shares whose tags contain that key/value pair) or `key` alone (matches shares
+   * that have any value for that key). May be repeated; multiple `tag` parameters
+   * are ANDed together. Maximum 20 `tag` parameters per request.
+   */
+  tag?: Array<string>;
+
   /**
    * Query param: Filter shares by target_type.
    */

package/src/resources/resource-sharing/resources.ts

@@ -195,7 +195,8 @@ export interface ResourceCreateResponse {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Resource Version.
@@ -247,7 +248,8 @@ export interface ResourceUpdateResponse {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Resource Version.
@@ -299,7 +301,8 @@ export interface ResourceListResponse {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Resource Version.
@@ -351,7 +354,8 @@ export interface ResourceDeleteResponse {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Resource Version.
@@ -403,7 +407,8 @@ export interface ResourceGetResponse {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Resource Version.
@@ -445,7 +450,8 @@ export interface ResourceCreateParams {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 }
 
 export interface ResourceUpdateParams {
@@ -474,7 +480,8 @@ export interface ResourceListParams extends V4PagePaginationArrayParams {
     | 'gateway-policy'
     | 'gateway-destination-ip'
     | 'gateway-block-page-settings'
-    | 'gateway-extended-email-matching';
+    | 'gateway-extended-email-matching'
+    | 'idp-federation-grant';
 
   /**
    * Query param: Filter share resources by status.

package/src/resources/secrets-store/stores/stores.ts

@@ -74,7 +74,10 @@ export class Stores extends APIResource {
   }
 
   /**
-   * Deletes a single store
+   * Deletes a single store. By default, a store that still contains secrets cannot
+   * be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error.
+   * Pass `force=true` to cascade-delete all secrets in the store. Empty stores are
+   * always deleted regardless of the force parameter.
    *
    * @example
    * ```ts
@@ -89,12 +92,12 @@ export class Stores extends APIResource {
     params: StoreDeleteParams,
     options?: Core.RequestOptions,
   ): Core.APIPromise<StoreDeleteResponse | null> {
-    const { account_id } = params;
+    const { account_id, force } = params;
     return (
-      this._client.delete(
-        `/accounts/${account_id}/secrets_store/stores/${storeId}`,
-        options,
-      ) as Core.APIPromise<{ result: StoreDeleteResponse | null }>
+      this._client.delete(`/accounts/${account_id}/secrets_store/stores/${storeId}`, {
+        query: { force },
+        ...options,
+      }) as Core.APIPromise<{ result: StoreDeleteResponse | null }>
     )._thenUnwrap((obj) => obj.result);
   }
 }
@@ -191,9 +194,16 @@ export interface StoreListParams extends V4PagePaginationArrayParams {
 
 export interface StoreDeleteParams {
   /**
-   * Account Identifier
+   * Path param: Account Identifier
    */
   account_id: string;
+
+  /**
+   * Query param: When true, cascade-deletes all secrets in the store before deleting
+   * the store itself. Required when deleting a non-empty store. Without this
+   * parameter, attempting to delete a non-empty store returns 409.
+   */
+  force?: boolean;
 }
 
 Stores.StoreListResponsesV4PagePaginationArray = StoreListResponsesV4PagePaginationArray;

package/src/resources/url-scanner/scans.ts

@@ -1058,6 +1058,8 @@ export namespace ScanGetResponse {
 
             ap2: Commerce.Ap2;
 
+            mpp: Commerce.Mpp;
+
             ucp: Commerce.Ucp;
 
             x402: Commerce.X402;
@@ -1176,6 +1178,62 @@ export namespace ScanGetResponse {
               }
             }
 
+            export interface Mpp {
+              status: string;
+
+              details?: unknown;
+
+              durationMs?: number;
+
+              evidence?: Array<Mpp.Evidence>;
+
+              message?: string;
+            }
+
+            export namespace Mpp {
+              export interface Evidence {
+                action: string;
+
+                label: string;
+
+                finding?: Evidence.Finding;
+
+                request?: Evidence.Request;
+
+                response?: Evidence.Response;
+              }
+
+              export namespace Evidence {
+                export interface Finding {
+                  outcome: string;
+
+                  summary: string;
+                }
+
+                export interface Request {
+                  method: string;
+
+                  url: string;
+
+                  headers?: unknown;
+                }
+
+                export interface Response {
+                  status: number;
+
+                  statusText: string;
+
+                  bodyPreview?: string;
+
+                  bodySize?: number;
+
+                  headers?: unknown;
+
+                  redirectedTo?: string;
+                }
+              }
+            }
+
             export interface Ucp {
               status: string;
 

package/src/resources/user/user.ts

@@ -76,7 +76,12 @@ export interface UserEditResponse {
   /**
    * Identifier of the user.
    */
-  id?: string;
+  id: string;
+
+  /**
+   * Current email address of the user.
+   */
+  email: string;
 
   /**
    * Lists the betas that the user is participating in.
@@ -147,7 +152,12 @@ export interface UserGetResponse {
   /**
    * Identifier of the user.
    */
-  id?: string;
+  id: string;
+
+  /**
+   * Current email address of the user.
+   */
+  email: string;
 
   /**
    * Lists the betas that the user is participating in.

package/src/resources/workflows/instances/instances.ts

@@ -236,6 +236,12 @@ export namespace InstanceGetResponse {
        * Specifies the timeout duration.
        */
       timeout: string | number;
+
+      /**
+       * When set to 'output', step output is redacted from log and step output
+       * responses.
+       */
+      sensitive?: 'output';
     }
 
     export namespace Config {

package/src/resources/zero-trust/api.md

@@ -1738,3 +1738,29 @@ Types:
 Methods:
 
 - <code title="get /accounts/{account_id}/zt_risk_scoring/integrations/reference_id/{reference_id}">client.zeroTrust.riskScoring.integrations.references.<a href="./src/resources/zero-trust/risk-scoring/integrations/references.ts">get</a>(referenceId, { ...params }) -> ReferenceGetResponse</code>
+
+## ResourceLibrary
+
+### Applications
+
+Types:
+
+- <code><a href="./src/resources/zero-trust/resource-library/applications.ts">ApplicationListResponse</a></code>
+- <code><a href="./src/resources/zero-trust/resource-library/applications.ts">ApplicationGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/resource-library/applications">client.zeroTrust.resourceLibrary.applications.<a href="./src/resources/zero-trust/resource-library/applications.ts">list</a>({ ...params }) -> ApplicationListResponsesSinglePage</code>
+- <code title="get /accounts/{account_id}/resource-library/applications/{id}">client.zeroTrust.resourceLibrary.applications.<a href="./src/resources/zero-trust/resource-library/applications.ts">get</a>(id, { ...params }) -> ApplicationGetResponse</code>
+
+### Categories
+
+Types:
+
+- <code><a href="./src/resources/zero-trust/resource-library/categories.ts">CategoryListResponse</a></code>
+- <code><a href="./src/resources/zero-trust/resource-library/categories.ts">CategoryGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/resource-library/categories">client.zeroTrust.resourceLibrary.categories.<a href="./src/resources/zero-trust/resource-library/categories.ts">list</a>({ ...params }) -> CategoryListResponsesSinglePage</code>
+- <code title="get /accounts/{account_id}/resource-library/categories/{id}">client.zeroTrust.resourceLibrary.categories.<a href="./src/resources/zero-trust/resource-library/categories.ts">get</a>(id, { ...params }) -> CategoryGetResponse</code>

package/src/resources/zero-trust/devices/fleet-status.ts

@@ -92,6 +92,11 @@ export interface FleetStatusGetResponse {
    */
   deviceName?: string;
 
+  /**
+   * @deprecated Use `registrationId` instead.
+   */
+  deviceRegistration?: string | null;
+
   diskReadBps?: number | null;
 
   diskUsagePct?: number | null;

package/src/resources/zero-trust/dex/fleet-status/devices.ts

@@ -98,6 +98,11 @@ export interface DeviceListResponse {
    */
   deviceName?: string;
 
+  /**
+   * @deprecated Use `registrationId` instead.
+   */
+  deviceRegistration?: string | null;
+
   diskReadBps?: number | null;
 
   diskUsagePct?: number | null;