cloudflare 6.2.0 → 6.4.0

package/src/resources/zero-trust/access/ai-controls/mcp/servers.ts

@@ -136,7 +136,8 @@ export class Servers extends APIResource {
   }
 
   /**
-   * Syncs an MCP server's tool catalog with the portal.
+   * Syncs an MCP server's capabilities and returns the updated server state,
+   * including any connection errors.
    *
    * @example
    * ```ts
@@ -188,6 +189,17 @@ export interface ServerCreateResponse {
 
   error?: string;
 
+  error_details?: ServerCreateResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -196,6 +208,11 @@ export interface ServerCreateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerCreateResponse.UpdatedPrompt>;
@@ -204,6 +221,33 @@ export interface ServerCreateResponse {
 }
 
 export namespace ServerCreateResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -249,6 +293,17 @@ export interface ServerUpdateResponse {
 
   error?: string;
 
+  error_details?: ServerUpdateResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -257,6 +312,11 @@ export interface ServerUpdateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerUpdateResponse.UpdatedPrompt>;
@@ -265,6 +325,33 @@ export interface ServerUpdateResponse {
 }
 
 export namespace ServerUpdateResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -310,6 +397,17 @@ export interface ServerListResponse {
 
   error?: string;
 
+  error_details?: ServerListResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -318,6 +416,11 @@ export interface ServerListResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerListResponse.UpdatedPrompt>;
@@ -326,6 +429,33 @@ export interface ServerListResponse {
 }
 
 export namespace ServerListResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -371,6 +501,17 @@ export interface ServerDeleteResponse {
 
   error?: string;
 
+  error_details?: ServerDeleteResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -379,6 +520,11 @@ export interface ServerDeleteResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerDeleteResponse.UpdatedPrompt>;
@@ -387,6 +533,33 @@ export interface ServerDeleteResponse {
 }
 
 export namespace ServerDeleteResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -432,6 +605,17 @@ export interface ServerReadResponse {
 
   error?: string;
 
+  error_details?: ServerReadResponse.ErrorDetails;
+
+  /**
+   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
+   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   last_successful_sync?: string;
 
   last_synced?: string;
@@ -440,6 +624,11 @@ export interface ServerReadResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerReadResponse.UpdatedPrompt>;
@@ -448,6 +637,33 @@ export interface ServerReadResponse {
 }
 
 export namespace ServerReadResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+
   export interface UpdatedPrompt {
     name: string;
 
@@ -469,7 +685,42 @@ export namespace ServerReadResponse {
   }
 }
 
-export type ServerSyncResponse = unknown;
+export interface ServerSyncResponse {
+  error?: string;
+
+  error_details?: ServerSyncResponse.ErrorDetails;
+
+  status?: string;
+}
+
+export namespace ServerSyncResponse {
+  export interface ErrorDetails {
+    /**
+     * Underlying error message
+     */
+    cause?: string;
+
+    /**
+     * True = MCP server returned an error. False = couldn't reach the server
+     */
+    is_upstream?: boolean;
+
+    /**
+     * MCP protocol error code
+     */
+    mcp_code?: number;
+
+    /**
+     * Whether the error is transient and worth retrying
+     */
+    retryable?: boolean;
+
+    /**
+     * HTTP status code from the server
+     */
+    status_code?: number;
+  }
+}
 
 export interface ServerCreateParams {
   /**
@@ -507,6 +758,21 @@ export interface ServerCreateParams {
    */
   description?: string | null;
 
+  /**
+   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
+   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
+   * the customer portal hostname. New public server creates default to true;
+   * existing servers default to false from migration until explicitly updated.
+   * Effective behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */
@@ -556,11 +822,26 @@ export interface ServerUpdateParams {
    */
   description?: string | null;
 
+  /**
+   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
+   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
+   * the customer portal hostname. New public server creates default to true;
+   * existing servers default to false from migration until explicitly updated.
+   * Effective behavior is gated by the gateway worker's per-env rollout mode KV key.
+   */
+  is_shared_oauth_callback_enabled?: boolean;
+
   /**
    * Body param
    */
   name?: string;
 
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */

package/src/resources/zero-trust/access/applications/policies.ts

@@ -332,7 +332,8 @@ export type AccessRule =
   | AccessRule.AccessOIDCClaimRule
   | ServiceTokenRule
   | AccessRule.AccessLinkedAppTokenRule
-  | AccessRule.AccessUserRiskScoreRule;
+  | AccessRule.AccessUserRiskScoreRule
+  | AccessRule.AccessCloudflareAccountMemberRule;
 
 export namespace AccessRule {
   /**
@@ -452,6 +453,23 @@ export namespace AccessRule {
       user_risk_score: Array<'low' | 'medium' | 'high' | 'unscored'>;
     }
   }
+
+  /**
+   * Matches users who are members of a specific Cloudflare account. Requires a
+   * Cloudflare identity provider.
+   */
+  export interface AccessCloudflareAccountMemberRule {
+    cloudflare_account_member: AccessCloudflareAccountMemberRule.CloudflareAccountMember;
+  }
+
+  export namespace AccessCloudflareAccountMemberRule {
+    export interface CloudflareAccountMember {
+      /**
+       * Identifier.
+       */
+      account_id?: string;
+    }
+  }
 }
 
 /**
@@ -482,7 +500,8 @@ export type AccessRuleParam =
   | AccessRuleParam.AccessOIDCClaimRule
   | ServiceTokenRuleParam
   | AccessRuleParam.AccessLinkedAppTokenRule
-  | AccessRuleParam.AccessUserRiskScoreRule;
+  | AccessRuleParam.AccessUserRiskScoreRule
+  | AccessRuleParam.AccessCloudflareAccountMemberRule;
 
 export namespace AccessRuleParam {
   /**
@@ -602,6 +621,23 @@ export namespace AccessRuleParam {
       user_risk_score: Array<'low' | 'medium' | 'high' | 'unscored'>;
     }
   }
+
+  /**
+   * Matches users who are members of a specific Cloudflare account. Requires a
+   * Cloudflare identity provider.
+   */
+  export interface AccessCloudflareAccountMemberRule {
+    cloudflare_account_member: AccessCloudflareAccountMemberRule.CloudflareAccountMember;
+  }
+
+  export namespace AccessCloudflareAccountMemberRule {
+    export interface CloudflareAccountMember {
+      /**
+       * Identifier.
+       */
+      account_id?: string;
+    }
+  }
 }
 
 /**

package/src/resources/zero-trust/access/idp-federation-grants.ts

@@ -0,0 +1,185 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../resource';
+import * as Core from '../../../core';
+
+export class IdPFederationGrants extends APIResource {
+  /**
+   * Creates an IdP federation grant for the specified identity provider, making it
+   * available for federation to other accounts in the same Cloudflare organization.
+   *
+   * The account must belong to a Cloudflare organization. One-time pin and
+   * Cloudflare-managed identity providers cannot be federated. An identity provider
+   * may only have one active grant at a time.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.create({
+   *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *     idp_id: 'a79de439-0e7f-4ebb-8a02-222222222222',
+   *   });
+   * ```
+   */
+  create(
+    params: IdPFederationGrantCreateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrant> {
+    const { account_id, ...body } = params;
+    return (
+      this._client.post(`/accounts/${account_id}/access/idp_federation_grants`, {
+        body,
+        ...options,
+      }) as Core.APIPromise<{ result: IdPFederationGrant }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Lists the IdP federation grants owned by the account.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrants =
+   *   await client.zeroTrust.access.IdPFederationGrants.list({
+   *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *   });
+   * ```
+   */
+  list(
+    params: IdPFederationGrantListParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrantListResponse> {
+    const { account_id } = params;
+    return (
+      this._client.get(`/accounts/${account_id}/access/idp_federation_grants`, options) as Core.APIPromise<{
+        result: IdPFederationGrantListResponse;
+      }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Deletes an IdP federation grant. The identity provider remains in the account,
+   * but it is no longer available for federation to other accounts.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.delete(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  delete(
+    grantId: string,
+    params: IdPFederationGrantDeleteParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrantDeleteResponse> {
+    const { account_id } = params;
+    return (
+      this._client.delete(
+        `/accounts/${account_id}/access/idp_federation_grants/${grantId}`,
+        options,
+      ) as Core.APIPromise<{ result: IdPFederationGrantDeleteResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Retrieves a single IdP federation grant by its UID.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.get(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  get(
+    grantId: string,
+    params: IdPFederationGrantGetParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrant> {
+    const { account_id } = params;
+    return (
+      this._client.get(
+        `/accounts/${account_id}/access/idp_federation_grants/${grantId}`,
+        options,
+      ) as Core.APIPromise<{ result: IdPFederationGrant }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export interface IdPFederationGrant {
+  /**
+   * UID of the IdP federation grant.
+   */
+  id: string;
+
+  /**
+   * When the grant was created.
+   */
+  created_at: string;
+
+  /**
+   * UID of the identity provider being federated.
+   */
+  idp_id: string;
+}
+
+export type IdPFederationGrantListResponse = Array<IdPFederationGrant>;
+
+export interface IdPFederationGrantDeleteResponse {
+  /**
+   * UID of the deleted IdP federation grant.
+   */
+  id?: string;
+}
+
+export interface IdPFederationGrantCreateParams {
+  /**
+   * Path param: Identifier.
+   */
+  account_id: string;
+
+  /**
+   * Body param: UID of the identity provider to federate. Must be an existing
+   * identity provider in this account. One-time pin and Cloudflare-managed identity
+   * providers cannot be federated.
+   */
+  idp_id: string;
+}
+
+export interface IdPFederationGrantListParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface IdPFederationGrantDeleteParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface IdPFederationGrantGetParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export declare namespace IdPFederationGrants {
+  export {
+    type IdPFederationGrant as IdPFederationGrant,
+    type IdPFederationGrantListResponse as IdPFederationGrantListResponse,
+    type IdPFederationGrantDeleteResponse as IdPFederationGrantDeleteResponse,
+    type IdPFederationGrantCreateParams as IdPFederationGrantCreateParams,
+    type IdPFederationGrantListParams as IdPFederationGrantListParams,
+    type IdPFederationGrantDeleteParams as IdPFederationGrantDeleteParams,
+    type IdPFederationGrantGetParams as IdPFederationGrantGetParams,
+  };
+}

package/src/resources/zero-trust/access/index.ts

@@ -98,6 +98,16 @@ export {
   type GatewayCAListParams,
   type GatewayCADeleteParams,
 } from './gateway-ca';
+export {
+  IdPFederationGrants,
+  type IdPFederationGrant,
+  type IdPFederationGrantListResponse,
+  type IdPFederationGrantDeleteResponse,
+  type IdPFederationGrantCreateParams,
+  type IdPFederationGrantListParams,
+  type IdPFederationGrantDeleteParams,
+  type IdPFederationGrantGetParams,
+} from './idp-federation-grants';
 export { Infrastructure } from './infrastructure/index';
 export {
   Keys,
@@ -125,6 +135,17 @@ export {
   type PolicyDeleteParams,
   type PolicyGetParams,
 } from './policies';
+export {
+  SAMLCertificateListResponsesV4PagePaginationArray,
+  SAMLCertificates,
+  type SAMLCertificateListResponse,
+  type SAMLCertificateGetResponse,
+  type SAMLCertificateRotateResponse,
+  type SAMLCertificateListParams,
+  type SAMLCertificateGetParams,
+  type SAMLCertificateGetPemParams,
+  type SAMLCertificateRotateParams,
+} from './saml-certificates';
 export {
   ServiceTokensV4PagePaginationArray,
   ServiceTokens,