cloudflare 6.2.0 → 6.3.0

package/src/resources/zero-trust/access/applications/policies.ts

@@ -332,7 +332,8 @@ export type AccessRule =
   | AccessRule.AccessOIDCClaimRule
   | ServiceTokenRule
   | AccessRule.AccessLinkedAppTokenRule
-  | AccessRule.AccessUserRiskScoreRule;
+  | AccessRule.AccessUserRiskScoreRule
+  | AccessRule.AccessCloudflareAccountMemberRule;
 
 export namespace AccessRule {
   /**
@@ -452,6 +453,23 @@ export namespace AccessRule {
       user_risk_score: Array<'low' | 'medium' | 'high' | 'unscored'>;
     }
   }
+
+  /**
+   * Matches users who are members of a specific Cloudflare account. Requires a
+   * Cloudflare identity provider.
+   */
+  export interface AccessCloudflareAccountMemberRule {
+    cloudflare_account_member: AccessCloudflareAccountMemberRule.CloudflareAccountMember;
+  }
+
+  export namespace AccessCloudflareAccountMemberRule {
+    export interface CloudflareAccountMember {
+      /**
+       * Identifier.
+       */
+      account_id?: string;
+    }
+  }
 }
 
 /**
@@ -482,7 +500,8 @@ export type AccessRuleParam =
   | AccessRuleParam.AccessOIDCClaimRule
   | ServiceTokenRuleParam
   | AccessRuleParam.AccessLinkedAppTokenRule
-  | AccessRuleParam.AccessUserRiskScoreRule;
+  | AccessRuleParam.AccessUserRiskScoreRule
+  | AccessRuleParam.AccessCloudflareAccountMemberRule;
 
 export namespace AccessRuleParam {
   /**
@@ -602,6 +621,23 @@ export namespace AccessRuleParam {
       user_risk_score: Array<'low' | 'medium' | 'high' | 'unscored'>;
     }
   }
+
+  /**
+   * Matches users who are members of a specific Cloudflare account. Requires a
+   * Cloudflare identity provider.
+   */
+  export interface AccessCloudflareAccountMemberRule {
+    cloudflare_account_member: AccessCloudflareAccountMemberRule.CloudflareAccountMember;
+  }
+
+  export namespace AccessCloudflareAccountMemberRule {
+    export interface CloudflareAccountMember {
+      /**
+       * Identifier.
+       */
+      account_id?: string;
+    }
+  }
 }
 
 /**

package/src/resources/zero-trust/access/index.ts

@@ -125,6 +125,17 @@ export {
   type PolicyDeleteParams,
   type PolicyGetParams,
 } from './policies';
+export {
+  SAMLCertificateListResponsesV4PagePaginationArray,
+  SAMLCertificates,
+  type SAMLCertificateListResponse,
+  type SAMLCertificateGetResponse,
+  type SAMLCertificateRotateResponse,
+  type SAMLCertificateListParams,
+  type SAMLCertificateGetParams,
+  type SAMLCertificateGetPemParams,
+  type SAMLCertificateRotateParams,
+} from './saml-certificates';
 export {
   ServiceTokensV4PagePaginationArray,
   ServiceTokens,

package/src/resources/zero-trust/access/saml-certificates.ts

@@ -0,0 +1,343 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../resource';
+import * as Core from '../../../core';
+import { V4PagePaginationArray, type V4PagePaginationArrayParams } from '../../../pagination';
+import { type Response } from '../../../_shims/index';
+
+export class SAMLCertificates extends APIResource {
+  /**
+   * Returns a paginated list of the organization's SAML encryption certificate sets.
+   * Each certificate set includes the current and (if present) previous
+   * certificates.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const samlCertificateListResponse of client.zeroTrust.access.samlCertificates.list(
+   *   { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   * )) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    params: SAMLCertificateListParams,
+    options?: Core.RequestOptions,
+  ): Core.PagePromise<SAMLCertificateListResponsesV4PagePaginationArray, SAMLCertificateListResponse> {
+    const { account_id, ...query } = params;
+    return this._client.getAPIList(
+      `/accounts/${account_id}/access/saml_certificates`,
+      SAMLCertificateListResponsesV4PagePaginationArray,
+      { query, ...options },
+    );
+  }
+
+  /**
+   * Retrieves a specific SAML encryption certificate set by its UID, including both
+   * current and previous certificates if available.
+   *
+   * @example
+   * ```ts
+   * const samlCertificate =
+   *   await client.zeroTrust.access.samlCertificates.get(
+   *     'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  get(
+    samlCERTSetId: string,
+    params: SAMLCertificateGetParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<SAMLCertificateGetResponse> {
+    const { account_id } = params;
+    return (
+      this._client.get(
+        `/accounts/${account_id}/access/saml_certificates/${samlCERTSetId}`,
+        options,
+      ) as Core.APIPromise<{ result: SAMLCertificateGetResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Downloads the current SAML encryption certificate's public key in PEM format for
+   * the specified certificate set. This endpoint is useful for providing the
+   * certificate to Identity Providers for SAML assertion encryption configuration.
+   *
+   * @example
+   * ```ts
+   * const response =
+   *   await client.zeroTrust.access.samlCertificates.getPem(
+   *     'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   *
+   * const content = await response.blob();
+   * console.log(content);
+   * ```
+   */
+  getPem(
+    samlCERTSetId: string,
+    params: SAMLCertificateGetPemParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<Response> {
+    const { account_id } = params;
+    return this._client.get(`/accounts/${account_id}/access/saml_certificates/${samlCERTSetId}/pem`, {
+      ...options,
+      headers: { Accept: 'application/x-pem-file', ...options?.headers },
+      __binaryResponse: true,
+    });
+  }
+
+  /**
+   * Rotates the SAML encryption certificates within the specified certificate set.
+   * This generates a new certificate and moves the current certificate to the
+   * previous slot. If a previous certificate exists, it will be deactivated and
+   * removed.
+   *
+   * This endpoint ensures zero-downtime rotation by maintaining both current and
+   * previous certificates during the transition period, allowing IdPs time to update
+   * their configurations. Automated rotation happens 30 days before a current
+   * certificate's expiration.
+   *
+   * @example
+   * ```ts
+   * const response =
+   *   await client.zeroTrust.access.samlCertificates.rotate(
+   *     'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  rotate(
+    samlCERTSetId: string,
+    params: SAMLCertificateRotateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<SAMLCertificateRotateResponse> {
+    const { account_id } = params;
+    return (
+      this._client.post(
+        `/accounts/${account_id}/access/saml_certificates/${samlCERTSetId}/rotate`,
+        options,
+      ) as Core.APIPromise<{ result: SAMLCertificateRotateResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export class SAMLCertificateListResponsesV4PagePaginationArray extends V4PagePaginationArray<SAMLCertificateListResponse> {}
+
+export interface SAMLCertificateListResponse {
+  /**
+   * When the certificate set was created
+   */
+  created_at: string;
+
+  /**
+   * Unique identifier for the certificate set
+   */
+  uid: string;
+
+  /**
+   * When the certificate set was last updated
+   */
+  updated_at: string;
+
+  /**
+   * The current active certificate
+   */
+  current_certificate?: SAMLCertificateListResponse.CurrentCertificate;
+
+  /**
+   * The previous certificate (maintained during rotation period). May be null when
+   * no rotation has occurred. Mirrors the structure of `saml_certificate`.
+   */
+  previous_certificate?: unknown | null;
+}
+
+export namespace SAMLCertificateListResponse {
+  /**
+   * The current active certificate
+   */
+  export interface CurrentCertificate {
+    /**
+     * Indicates whether the certificate can be used for IdP configuration.
+     */
+    is_current: boolean;
+
+    /**
+     * Certificate expiration date
+     */
+    not_after: string;
+
+    /**
+     * The public certificate in PEM format
+     */
+    public_certificate: string;
+
+    /**
+     * Unique identifier for the certificate
+     */
+    uid: string;
+  }
+}
+
+export interface SAMLCertificateGetResponse {
+  /**
+   * When the certificate set was created
+   */
+  created_at: string;
+
+  /**
+   * Unique identifier for the certificate set
+   */
+  uid: string;
+
+  /**
+   * When the certificate set was last updated
+   */
+  updated_at: string;
+
+  /**
+   * The current active certificate
+   */
+  current_certificate?: SAMLCertificateGetResponse.CurrentCertificate;
+
+  /**
+   * The previous certificate (maintained during rotation period). May be null when
+   * no rotation has occurred. Mirrors the structure of `saml_certificate`.
+   */
+  previous_certificate?: unknown | null;
+}
+
+export namespace SAMLCertificateGetResponse {
+  /**
+   * The current active certificate
+   */
+  export interface CurrentCertificate {
+    /**
+     * Indicates whether the certificate can be used for IdP configuration.
+     */
+    is_current: boolean;
+
+    /**
+     * Certificate expiration date
+     */
+    not_after: string;
+
+    /**
+     * The public certificate in PEM format
+     */
+    public_certificate: string;
+
+    /**
+     * Unique identifier for the certificate
+     */
+    uid: string;
+  }
+}
+
+export interface SAMLCertificateRotateResponse {
+  /**
+   * When the certificate set was created
+   */
+  created_at: string;
+
+  /**
+   * Unique identifier for the certificate set
+   */
+  uid: string;
+
+  /**
+   * When the certificate set was last updated
+   */
+  updated_at: string;
+
+  /**
+   * The current active certificate
+   */
+  current_certificate?: SAMLCertificateRotateResponse.CurrentCertificate;
+
+  /**
+   * The previous certificate (maintained during rotation period). May be null when
+   * no rotation has occurred. Mirrors the structure of `saml_certificate`.
+   */
+  previous_certificate?: unknown | null;
+}
+
+export namespace SAMLCertificateRotateResponse {
+  /**
+   * The current active certificate
+   */
+  export interface CurrentCertificate {
+    /**
+     * Indicates whether the certificate can be used for IdP configuration.
+     */
+    is_current: boolean;
+
+    /**
+     * Certificate expiration date
+     */
+    not_after: string;
+
+    /**
+     * The public certificate in PEM format
+     */
+    public_certificate: string;
+
+    /**
+     * Unique identifier for the certificate
+     */
+    uid: string;
+  }
+}
+
+export interface SAMLCertificateListParams extends V4PagePaginationArrayParams {
+  /**
+   * Path param: Identifier.
+   */
+  account_id: string;
+
+  /**
+   * Query param: Filter by SAML certificate set UID. Accepts a comma-separated list
+   * of UIDs.
+   */
+  id?: string;
+}
+
+export interface SAMLCertificateGetParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface SAMLCertificateGetPemParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface SAMLCertificateRotateParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+SAMLCertificates.SAMLCertificateListResponsesV4PagePaginationArray =
+  SAMLCertificateListResponsesV4PagePaginationArray;
+
+export declare namespace SAMLCertificates {
+  export {
+    type SAMLCertificateListResponse as SAMLCertificateListResponse,
+    type SAMLCertificateGetResponse as SAMLCertificateGetResponse,
+    type SAMLCertificateRotateResponse as SAMLCertificateRotateResponse,
+    SAMLCertificateListResponsesV4PagePaginationArray as SAMLCertificateListResponsesV4PagePaginationArray,
+    type SAMLCertificateListParams as SAMLCertificateListParams,
+    type SAMLCertificateGetParams as SAMLCertificateGetParams,
+    type SAMLCertificateGetPemParams as SAMLCertificateGetPemParams,
+    type SAMLCertificateRotateParams as SAMLCertificateRotateParams,
+  };
+}

package/src/resources/zero-trust/api.md

@@ -344,6 +344,16 @@ Methods:
 
 - <code title="get /accounts/{account_id}/access/identity_providers/{identity_provider_id}/scim/users">client.zeroTrust.identityProviders.scim.users.<a href="./src/resources/zero-trust/identity-providers/scim/users.ts">list</a>(identityProviderId, { ...params }) -> AccessUsersV4PagePaginationArray</code>
 
+### SAMLCertificate
+
+Types:
+
+- <code><a href="./src/resources/zero-trust/identity-providers/saml-certificate.ts">SAMLCertificateCreateResponse</a></code>
+
+Methods:
+
+- <code title="post /accounts/{account_id}/access/identity_providers/{identity_provider_id}/saml_certificate">client.zeroTrust.identityProviders.samlCertificate.<a href="./src/resources/zero-trust/identity-providers/saml-certificate.ts">create</a>(identityProviderId, { ...params }) -> SAMLCertificateCreateResponse</code>
+
 ## Organizations
 
 Types:
@@ -439,6 +449,21 @@ Methods:
 - <code title="get /accounts/{account_id}/access/gateway_ca">client.zeroTrust.access.gatewayCA.<a href="./src/resources/zero-trust/access/gateway-ca.ts">list</a>({ ...params }) -> GatewayCAListResponsesSinglePage</code>
 - <code title="delete /accounts/{account_id}/access/gateway_ca/{certificate_id}">client.zeroTrust.access.gatewayCA.<a href="./src/resources/zero-trust/access/gateway-ca.ts">delete</a>(certificateId, { ...params }) -> GatewayCADeleteResponse</code>
 
+### SAMLCertificates
+
+Types:
+
+- <code><a href="./src/resources/zero-trust/access/saml-certificates.ts">SAMLCertificateListResponse</a></code>
+- <code><a href="./src/resources/zero-trust/access/saml-certificates.ts">SAMLCertificateGetResponse</a></code>
+- <code><a href="./src/resources/zero-trust/access/saml-certificates.ts">SAMLCertificateRotateResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/access/saml_certificates">client.zeroTrust.access.samlCertificates.<a href="./src/resources/zero-trust/access/saml-certificates.ts">list</a>({ ...params }) -> SAMLCertificateListResponsesV4PagePaginationArray</code>
+- <code title="get /accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}">client.zeroTrust.access.samlCertificates.<a href="./src/resources/zero-trust/access/saml-certificates.ts">get</a>(samlCERTSetId, { ...params }) -> SAMLCertificateGetResponse</code>
+- <code title="get /accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}/pem">client.zeroTrust.access.samlCertificates.<a href="./src/resources/zero-trust/access/saml-certificates.ts">getPem</a>(samlCERTSetId, { ...params }) -> Response</code>
+- <code title="post /accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}/rotate">client.zeroTrust.access.samlCertificates.<a href="./src/resources/zero-trust/access/saml-certificates.ts">rotate</a>(samlCERTSetId, { ...params }) -> SAMLCertificateRotateResponse</code>
+
 ### Infrastructure
 
 #### Targets

package/src/resources/zero-trust/devices/posture/posture.ts

@@ -811,6 +811,12 @@ export interface KolideInput {
    */
   connection_id: string;
 
+  /**
+   * The set of Kolide device authentication states that pass the posture check.
+   * Device must match one of the specified states.
+   */
+  auth_state?: Array<'Good' | 'Notified' | 'Will Block' | 'Blocked'>;
+
   /**
    * Count Operator.
    */
@@ -828,6 +834,12 @@ export interface KolideInputParam {
    */
   connection_id: string;
 
+  /**
+   * The set of Kolide device authentication states that pass the posture check.
+   * Device must match one of the specified states.
+   */
+  auth_state?: Array<'Good' | 'Notified' | 'Will Block' | 'Blocked'>;
+
   /**
    * Count Operator.
    */