cloudflare 6.2.0 → 6.4.0

package/src/resources/zero-trust/identity-providers/identity-providers.ts

@@ -4,6 +4,12 @@ import { APIResource } from '../../../resource';
 import { isRequestOptions } from '../../../core';
 import * as Core from '../../../core';
 import * as IdentityProvidersAPI from './identity-providers';
+import * as SAMLCertificateAPI from './saml-certificate';
+import {
+  SAMLCertificate,
+  SAMLCertificateCreateParams,
+  SAMLCertificateCreateResponse,
+} from './saml-certificate';
 import * as SCIMAPI from './scim/scim';
 import { SCIM } from './scim/scim';
 import { CloudflareError } from '../../../error';
@@ -11,6 +17,7 @@ import { V4PagePaginationArray, type V4PagePaginationArrayParams } from '../../.
 
 export class IdentityProviders extends APIResource {
   scim: SCIMAPI.SCIM = new SCIMAPI.SCIM(this._client);
+  samlCertificate: SAMLCertificateAPI.SAMLCertificate = new SAMLCertificateAPI.SAMLCertificate(this._client);
 
   /**
    * Adds a new identity provider to Access.
@@ -286,6 +293,27 @@ export interface AzureAD {
    */
   id?: string;
 
+  /**
+   * Indicates that the identity provider is immutable and cannot be updated or
+   * deleted via the API.
+   */
+  read_only?: boolean;
+
+  /**
+   * The SAML encryption certificate set details, including current and previous
+   * certificates. Only present for SAML identity providers with a certificate set
+   * assigned.
+   */
+  saml_certificate_set?: AzureAD.SAMLCertificateSet;
+
+  /**
+   * The UID of the SAML encryption certificate set assigned to this Identity
+   * Provider. Only present for SAML identity providers with encryption configured.
+   * Create a certificate set via POST to
+   * `/identity_providers/{id}/saml_certificate`.
+   */
+  saml_certificate_set_id?: string;
+
   /**
    * The configuration settings for enabling a System for Cross-Domain Identity
    * Management (SCIM) with the identity provider.
@@ -347,6 +375,68 @@ export namespace AzureAD {
      */
     support_groups?: boolean;
   }
+
+  /**
+   * The SAML encryption certificate set details, including current and previous
+   * certificates. Only present for SAML identity providers with a certificate set
+   * assigned.
+   */
+  export interface SAMLCertificateSet {
+    /**
+     * Timestamp when the certificate set was created
+     */
+    created_at: string;
+
+    /**
+     * Unique identifier for the certificate set
+     */
+    uid: string;
+
+    /**
+     * Timestamp when the certificate set was last updated (e.g., during rotation)
+     */
+    updated_at: string;
+
+    /**
+     * The currently active certificate used for encrypting SAML assertions
+     */
+    current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+    /**
+     * The previous certificate, maintained during rotation to ensure continuity. Null
+     * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+     */
+    previous_certificate?: unknown | null;
+  }
+
+  export namespace SAMLCertificateSet {
+    /**
+     * The currently active certificate used for encrypting SAML assertions
+     */
+    export interface CurrentCertificate {
+      /**
+       * Indicates whether this is the currently active certificate
+       */
+      is_current: boolean;
+
+      /**
+       * Certificate expiration date. Certificates are automatically rotated 30 days
+       * before expiration.
+       */
+      not_after: string;
+
+      /**
+       * PEM-encoded X.509 certificate containing the public key. Configure this
+       * certificate in your external SAML Identity Provider to enable encryption.
+       */
+      public_certificate: string;
+
+      /**
+       * Unique identifier for the certificate
+       */
+      uid: string;
+    }
+  }
 }
 
 export interface AzureADParam {
@@ -369,6 +459,14 @@ export interface AzureADParam {
    */
   type: IdentityProviderTypeParam;
 
+  /**
+   * The UID of the SAML encryption certificate set assigned to this Identity
+   * Provider. Only present for SAML identity providers with encryption configured.
+   * Create a certificate set via POST to
+   * `/identity_providers/{id}/saml_certificate`.
+   */
+  saml_certificate_set_id?: string;
+
   /**
    * The configuration settings for enabling a System for Cross-Domain Identity
    * Management (SCIM) with the identity provider.
@@ -470,7 +568,8 @@ export type IdentityProvider =
   | IdentityProvider.AccessPingone
   | IdentityProvider.AccessSAML
   | IdentityProvider.AccessYandex
-  | IdentityProvider.AccessOnetimepin;
+  | IdentityProvider.AccessOnetimepin
+  | IdentityProvider.AccessCloudflare;
 
 export namespace IdentityProvider {
   export interface AccessCentrify {
@@ -498,6 +597,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessCentrify.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -542,6 +662,68 @@ export namespace IdentityProvider {
        */
       email_claim_name?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessFacebook {
@@ -569,6 +751,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessFacebook.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -576,6 +779,70 @@ export namespace IdentityProvider {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
+  export namespace AccessFacebook {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
   export interface AccessGitHub {
     /**
      * The configuration parameters for the identity provider. To view the required
@@ -601,6 +868,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGitHub.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -608,6 +896,70 @@ export namespace IdentityProvider {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
+  export namespace AccessGitHub {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
   export interface AccessGoogle {
     /**
      * The configuration parameters for the identity provider. To view the required
@@ -633,6 +985,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGoogle.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -667,6 +1040,68 @@ export namespace IdentityProvider {
        */
       email_claim_name?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessGoogleApps {
@@ -694,6 +1129,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGoogleApps.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -733,32 +1189,115 @@ export namespace IdentityProvider {
        */
       email_claim_name?: string;
     }
-  }
-
-  export interface AccessLinkedin {
-    /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-     */
-    config: IdentityProvidersAPI.GenericOAuthConfig;
 
     /**
-     * The name of the identity provider, shown to users on the login page.
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    name: string;
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
 
-    /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-     */
-    type: IdentityProvidersAPI.IdentityProviderType;
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
 
-    /**
-     * UUID.
-     */
-    id?: string;
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessLinkedin {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: IdentityProvidersAPI.GenericOAuthConfig;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessLinkedin.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
 
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
@@ -767,6 +1306,70 @@ export namespace IdentityProvider {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
+  export namespace AccessLinkedin {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
   export interface AccessOIDC {
     /**
      * The configuration parameters for the identity provider. To view the required
@@ -792,6 +1395,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOIDC.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -851,6 +1475,68 @@ export namespace IdentityProvider {
        */
       token_url?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessOkta {
@@ -878,6 +1564,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOkta.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -922,6 +1629,68 @@ export namespace IdentityProvider {
        */
       okta_account?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessOnelogin {
@@ -949,6 +1718,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOnelogin.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -988,6 +1778,68 @@ export namespace IdentityProvider {
        */
       onelogin_account?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessPingone {
@@ -1015,6 +1867,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessPingone.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1054,33 +1927,116 @@ export namespace IdentityProvider {
        */
       ping_env_id?: string;
     }
-  }
 
-  export interface AccessSAML {
     /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    config: AccessSAML.Config;
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
 
-    /**
-     * The name of the identity provider, shown to users on the login page.
-     */
-    name: string;
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
 
-    /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-     */
-    type: IdentityProvidersAPI.IdentityProviderType;
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
 
-    /**
-     * UUID.
-     */
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessSAML {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessSAML.Config;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderType;
+
+    /**
+     * UUID.
+     */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessSAML.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1106,6 +2062,22 @@ export namespace IdentityProvider {
        */
       email_attribute_name?: string;
 
+      /**
+       * Enable SAML assertion encryption. When enabled, the Identity Provider will
+       * encrypt SAML assertions using the certificate from the assigned certificate set.
+       *
+       * To enable encryption:
+       *
+       * 1. Create a certificate set via POST to
+       *    `/identity_providers/{id}/saml_certificate`
+       * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+       *    request
+       * 3. Configure the public certificate in your external Identity Provider
+       *
+       * Note: Requires `saml_certificate_set_id` to be set when `true`.
+       */
+      enable_encryption?: boolean;
+
       /**
        * Add a list of attribute names that will be returned in the response header from
        * the Access callback.
@@ -1147,6 +2119,68 @@ export namespace IdentityProvider {
         header_name?: string;
       }
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessYandex {
@@ -1174,6 +2208,27 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessYandex.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1181,6 +2236,70 @@ export namespace IdentityProvider {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
+  export namespace AccessYandex {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
   export interface AccessOnetimepin {
     /**
      * The configuration parameters for the identity provider. To view the required
@@ -1207,114 +2326,113 @@ export namespace IdentityProvider {
     id?: string;
 
     /**
-     * The configuration settings for enabling a System for Cross-Domain Identity
-     * Management (SCIM) with the identity provider.
-     */
-    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
-  }
-
-  export namespace AccessOnetimepin {
-    /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-     */
-    export interface Config {
-      redirect_url?: string;
-    }
-  }
-}
-
-export type IdentityProviderParam =
-  | AzureADParam
-  | IdentityProviderParam.AccessCentrify
-  | IdentityProviderParam.AccessFacebook
-  | IdentityProviderParam.AccessGitHub
-  | IdentityProviderParam.AccessGoogle
-  | IdentityProviderParam.AccessGoogleApps
-  | IdentityProviderParam.AccessLinkedin
-  | IdentityProviderParam.AccessOIDC
-  | IdentityProviderParam.AccessOkta
-  | IdentityProviderParam.AccessOnelogin
-  | IdentityProviderParam.AccessPingone
-  | IdentityProviderParam.AccessSAML
-  | IdentityProviderParam.AccessYandex
-  | IdentityProviderParam.AccessOnetimepin;
-
-export namespace IdentityProviderParam {
-  export interface AccessCentrify {
-    /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
      */
-    config: AccessCentrify.Config;
+    read_only?: boolean;
 
     /**
-     * The name of the identity provider, shown to users on the login page.
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    name: string;
+    saml_certificate_set?: AccessOnetimepin.SAMLCertificateSet;
 
     /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
      */
-    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+    saml_certificate_set_id?: string;
 
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
      */
-    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessCentrify {
+  export namespace AccessOnetimepin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     export interface Config {
+      redirect_url?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
       /**
-       * Your centrify account url
+       * Timestamp when the certificate set was created
        */
-      centrify_account?: string;
+      created_at: string;
 
       /**
-       * Your centrify app id
+       * Unique identifier for the certificate set
        */
-      centrify_app_id?: string;
+      uid: string;
 
       /**
-       * Custom claims
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
        */
-      claims?: Array<string>;
+      updated_at: string;
 
       /**
-       * Your OAuth Client ID
+       * The currently active certificate used for encrypting SAML assertions
        */
-      client_id?: string;
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
 
       /**
-       * Your OAuth Client Secret
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
        */
-      client_secret?: string;
+      previous_certificate?: unknown | null;
+    }
 
+    export namespace SAMLCertificateSet {
       /**
-       * The claim name for email in the id_token response.
+       * The currently active certificate used for encrypting SAML assertions
        */
-      email_claim_name?: string;
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessFacebook {
+  export interface AccessCloudflare {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: IdentityProvidersAPI.GenericOAuthConfigParam;
+    config: AccessCloudflare.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -1326,62 +2444,312 @@ export namespace IdentityProviderParam {
      * refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+    type: IdentityProvidersAPI.IdentityProviderType;
 
     /**
-     * The configuration settings for enabling a System for Cross-Domain Identity
-     * Management (SCIM) with the identity provider.
+     * UUID.
      */
-    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
-  }
+    id?: string;
 
-  export interface AccessGitHub {
     /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
      */
-    config: IdentityProvidersAPI.GenericOAuthConfigParam;
+    read_only?: boolean;
 
     /**
-     * The name of the identity provider, shown to users on the login page.
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    name: string;
+    saml_certificate_set?: AccessCloudflare.SAMLCertificateSet;
 
     /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
      */
-    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+    saml_certificate_set_id?: string;
 
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
      */
-    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export interface AccessGoogle {
+  export namespace AccessCloudflare {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessGoogle.Config;
+    export interface Config {
+      redirect_url?: string;
 
-    /**
-     * The name of the identity provider, shown to users on the login page.
-     */
-    name: string;
+      /**
+       * When enabled, only users who are members of your Cloudflare account can
+       * authenticate through this identity provider. When disabled, any user with a
+       * Cloudflare account can authenticate, subject to your Access policies.
+       */
+      restrict_to_account_members?: boolean;
+    }
 
     /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    type: IdentityProvidersAPI.IdentityProviderTypeParam;
-
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+}
+
+export type IdentityProviderParam =
+  | AzureADParam
+  | IdentityProviderParam.AccessCentrify
+  | IdentityProviderParam.AccessFacebook
+  | IdentityProviderParam.AccessGitHub
+  | IdentityProviderParam.AccessGoogle
+  | IdentityProviderParam.AccessGoogleApps
+  | IdentityProviderParam.AccessLinkedin
+  | IdentityProviderParam.AccessOIDC
+  | IdentityProviderParam.AccessOkta
+  | IdentityProviderParam.AccessOnelogin
+  | IdentityProviderParam.AccessPingone
+  | IdentityProviderParam.AccessSAML
+  | IdentityProviderParam.AccessYandex
+  | IdentityProviderParam.AccessOnetimepin
+  | IdentityProviderParam.AccessCloudflare;
+
+export namespace IdentityProviderParam {
+  export interface AccessCentrify {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessCentrify.Config;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+  }
+
+  export namespace AccessCentrify {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * Your centrify account url
+       */
+      centrify_account?: string;
+
+      /**
+       * Your centrify app id
+       */
+      centrify_app_id?: string;
+
+      /**
+       * Custom claims
+       */
+      claims?: Array<string>;
+
+      /**
+       * Your OAuth Client ID
+       */
+      client_id?: string;
+
+      /**
+       * Your OAuth Client Secret
+       */
+      client_secret?: string;
+
+      /**
+       * The claim name for email in the id_token response.
+       */
+      email_claim_name?: string;
+    }
+  }
+
+  export interface AccessFacebook {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: IdentityProvidersAPI.GenericOAuthConfigParam;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+  }
+
+  export interface AccessGitHub {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: IdentityProvidersAPI.GenericOAuthConfigParam;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+  }
+
+  export interface AccessGoogle {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessGoogle.Config;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1438,6 +2806,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1499,6 +2875,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1526,6 +2910,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1607,6 +2999,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1673,6 +3073,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1734,6 +3142,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1795,6 +3211,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1820,6 +3244,22 @@ export namespace IdentityProviderParam {
        */
       email_attribute_name?: string;
 
+      /**
+       * Enable SAML assertion encryption. When enabled, the Identity Provider will
+       * encrypt SAML assertions using the certificate from the assigned certificate set.
+       *
+       * To enable encryption:
+       *
+       * 1. Create a certificate set via POST to
+       *    `/identity_providers/{id}/saml_certificate`
+       * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+       *    request
+       * 3. Configure the public certificate in your external Identity Provider
+       *
+       * Note: Requires `saml_certificate_set_id` to be set when `true`.
+       */
+      enable_encryption?: boolean;
+
       /**
        * Add a list of attribute names that will be returned in the response header from
        * the Access callback.
@@ -1883,6 +3323,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1910,6 +3358,14 @@ export namespace IdentityProviderParam {
      */
     type: IdentityProvidersAPI.IdentityProviderTypeParam;
 
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -1925,27 +3381,78 @@ export namespace IdentityProviderParam {
      */
     export interface Config {}
   }
-}
 
-/**
- * The configuration settings for enabling a System for Cross-Domain Identity
- * Management (SCIM) with the identity provider.
- */
-export interface IdentityProviderSCIMConfig {
-  /**
-   * A flag to enable or disable SCIM for the identity provider.
-   */
-  enabled?: boolean;
+  export interface AccessCloudflare {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessCloudflare.Config;
 
-  /**
-   * Indicates how a SCIM event updates a user identity used for policy evaluation.
-   * Use "automatic" to automatically update a user's identity and augment it with
-   * fields from the SCIM user resource. Use "reauth" to force re-authentication on
-   * group membership updates, user identity update will only occur after successful
-   * re-authentication. With "reauth" identities will not contain fields from the
-   * SCIM user resource. With "no_action" identities will not be changed by SCIM
-   * updates in any way and users will not be prompted to reauthenticate.
-   */
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderTypeParam;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+  }
+
+  export namespace AccessCloudflare {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * When enabled, only users who are members of your Cloudflare account can
+       * authenticate through this identity provider. When disabled, any user with a
+       * Cloudflare account can authenticate, subject to your Access policies.
+       */
+      restrict_to_account_members?: boolean;
+    }
+  }
+}
+
+/**
+ * The configuration settings for enabling a System for Cross-Domain Identity
+ * Management (SCIM) with the identity provider.
+ */
+export interface IdentityProviderSCIMConfig {
+  /**
+   * A flag to enable or disable SCIM for the identity provider.
+   */
+  enabled?: boolean;
+
+  /**
+   * Indicates how a SCIM event updates a user identity used for policy evaluation.
+   * Use "automatic" to automatically update a user's identity and augment it with
+   * fields from the SCIM user resource. Use "reauth" to force re-authentication on
+   * group membership updates, user identity update will only occur after successful
+   * re-authentication. With "reauth" identities will not contain fields from the
+   * SCIM user resource. With "no_action" identities will not be changed by SCIM
+   * updates in any way and users will not be prompted to reauthenticate.
+   */
   identity_update_behavior?: 'automatic' | 'reauth' | 'no_action';
 
   /**
@@ -2028,7 +3535,8 @@ export type IdentityProviderType =
   | 'okta'
   | 'onelogin'
   | 'pingone'
-  | 'yandex';
+  | 'yandex'
+  | 'cloudflare';
 
 /**
  * The type of identity provider. To determine the value for a specific provider,
@@ -2049,7 +3557,8 @@ export type IdentityProviderTypeParam =
   | 'okta'
   | 'onelogin'
   | 'pingone'
-  | 'yandex';
+  | 'yandex'
+  | 'cloudflare';
 
 export type IdentityProviderListResponse =
   | AzureAD
@@ -2064,7 +3573,9 @@ export type IdentityProviderListResponse =
   | IdentityProviderListResponse.AccessOnelogin
   | IdentityProviderListResponse.AccessPingone
   | IdentityProviderListResponse.AccessSAML
-  | IdentityProviderListResponse.AccessYandex;
+  | IdentityProviderListResponse.AccessYandex
+  | IdentityProviderListResponse.AccessOnetimepin
+  | IdentityProviderListResponse.AccessCloudflare;
 
 export namespace IdentityProviderListResponse {
   export interface AccessCentrify {
@@ -2092,6 +3603,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessCentrify.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2136,6 +3668,68 @@ export namespace IdentityProviderListResponse {
        */
       email_claim_name?: string;
     }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
   }
 
   export interface AccessFacebook {
@@ -2163,6 +3757,144 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessFacebook.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+  }
+
+  export namespace AccessFacebook {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessGitHub {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: IdentityProvidersAPI.GenericOAuthConfig;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGitHub.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2170,7 +3902,364 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export interface AccessGitHub {
+  export namespace AccessGitHub {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessGoogle {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessGoogle.Config;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGoogle.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+  }
+
+  export namespace AccessGoogle {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * Custom claims
+       */
+      claims?: Array<string>;
+
+      /**
+       * Your OAuth Client ID
+       */
+      client_id?: string;
+
+      /**
+       * Your OAuth Client Secret
+       */
+      client_secret?: string;
+
+      /**
+       * The claim name for email in the id_token response.
+       */
+      email_claim_name?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessGoogleApps {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessGoogleApps.Config;
+
+    /**
+     * The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * The type of identity provider. To determine the value for a specific provider,
+     * refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProvidersAPI.IdentityProviderType;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessGoogleApps.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * The configuration settings for enabling a System for Cross-Domain Identity
+     * Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+  }
+
+  export namespace AccessGoogleApps {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * Your companies TLD
+       */
+      apps_domain?: string;
+
+      /**
+       * Custom claims
+       */
+      claims?: Array<string>;
+
+      /**
+       * Your OAuth Client ID
+       */
+      client_id?: string;
+
+      /**
+       * Your OAuth Client Secret
+       */
+      client_secret?: string;
+
+      /**
+       * The claim name for email in the id_token response.
+       */
+      email_claim_name?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessLinkedin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
@@ -2195,6 +4284,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessLinkedin.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2202,13 +4312,77 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export interface AccessGoogle {
+  export namespace AccessLinkedin {
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
+
+  export interface AccessOIDC {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessGoogle.Config;
+    config: AccessOIDC.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2227,6 +4401,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOIDC.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2234,13 +4429,23 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessGoogle {
+  export namespace AccessOIDC {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     export interface Config {
+      /**
+       * The authorization_endpoint URL of your IdP
+       */
+      auth_url?: string;
+
+      /**
+       * The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
+       */
+      certs_url?: string;
+
       /**
        * Custom claims
        */
@@ -2260,16 +4465,93 @@ export namespace IdentityProviderListResponse {
        * The claim name for email in the id_token response.
        */
       email_claim_name?: string;
+
+      /**
+       * Enable Proof Key for Code Exchange (PKCE)
+       */
+      pkce_enabled?: boolean;
+
+      /**
+       * OAuth scopes
+       */
+      scopes?: Array<string>;
+
+      /**
+       * The token_endpoint URL of your IdP
+       */
+      token_url?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessGoogleApps {
+  export interface AccessOkta {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessGoogleApps.Config;
+    config: AccessOkta.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2288,6 +4570,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOkta.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2295,7 +4598,7 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessGoogleApps {
+  export namespace AccessOkta {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
@@ -2303,9 +4606,9 @@ export namespace IdentityProviderListResponse {
      */
     export interface Config {
       /**
-       * Your companies TLD
+       * Your okta authorization server id
        */
-      apps_domain?: string;
+      authorization_server_id?: string;
 
       /**
        * Custom claims
@@ -2326,16 +4629,83 @@ export namespace IdentityProviderListResponse {
        * The claim name for email in the id_token response.
        */
       email_claim_name?: string;
+
+      /**
+       * Your okta account url
+       */
+      okta_account?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessLinkedin {
+  export interface AccessOnelogin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: IdentityProvidersAPI.GenericOAuthConfig;
+    config: AccessOnelogin.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2355,36 +4725,25 @@ export namespace IdentityProviderListResponse {
     id?: string;
 
     /**
-     * The configuration settings for enabling a System for Cross-Domain Identity
-     * Management (SCIM) with the identity provider.
-     */
-    scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
-  }
-
-  export interface AccessOIDC {
-    /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-     */
-    config: AccessOIDC.Config;
-
-    /**
-     * The name of the identity provider, shown to users on the login page.
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
      */
-    name: string;
+    read_only?: boolean;
 
     /**
-     * The type of identity provider. To determine the value for a specific provider,
-     * refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    type: IdentityProvidersAPI.IdentityProviderType;
+    saml_certificate_set?: AccessOnelogin.SAMLCertificateSet;
 
     /**
-     * UUID.
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
      */
-    id?: string;
+    saml_certificate_set_id?: string;
 
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
@@ -2393,23 +4752,13 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessOIDC {
+  export namespace AccessOnelogin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     export interface Config {
-      /**
-       * The authorization_endpoint URL of your IdP
-       */
-      auth_url?: string;
-
-      /**
-       * The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
-       */
-      certs_url?: string;
-
       /**
        * Custom claims
        */
@@ -2431,29 +4780,81 @@ export namespace IdentityProviderListResponse {
       email_claim_name?: string;
 
       /**
-       * Enable Proof Key for Code Exchange (PKCE)
+       * Your OneLogin account url
        */
-      pkce_enabled?: boolean;
+      onelogin_account?: string;
+    }
 
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
       /**
-       * OAuth scopes
+       * Timestamp when the certificate set was created
        */
-      scopes?: Array<string>;
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
 
-      /**
-       * The token_endpoint URL of your IdP
-       */
-      token_url?: string;
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessOkta {
+  export interface AccessPingone {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessOkta.Config;
+    config: AccessPingone.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2472,6 +4873,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessPingone.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2479,18 +4901,13 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessOkta {
+  export namespace AccessPingone {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     export interface Config {
-      /**
-       * Your okta authorization server id
-       */
-      authorization_server_id?: string;
-
       /**
        * Custom claims
        */
@@ -2512,19 +4929,81 @@ export namespace IdentityProviderListResponse {
       email_claim_name?: string;
 
       /**
-       * Your okta account url
+       * Your PingOne environment identifier
        */
-      okta_account?: string;
+      ping_env_id?: string;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessOnelogin {
+  export interface AccessSAML {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessOnelogin.Config;
+    config: AccessSAML.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2543,6 +5022,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessSAML.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2550,7 +5050,7 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessOnelogin {
+  export namespace AccessSAML {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
@@ -2558,39 +5058,144 @@ export namespace IdentityProviderListResponse {
      */
     export interface Config {
       /**
-       * Custom claims
+       * A list of SAML attribute names that will be added to your signed JWT token and
+       * can be used in SAML policy rules.
        */
-      claims?: Array<string>;
+      attributes?: Array<string>;
 
       /**
-       * Your OAuth Client ID
+       * The attribute name for email in the SAML response.
        */
-      client_id?: string;
+      email_attribute_name?: string;
 
       /**
-       * Your OAuth Client Secret
+       * Enable SAML assertion encryption. When enabled, the Identity Provider will
+       * encrypt SAML assertions using the certificate from the assigned certificate set.
+       *
+       * To enable encryption:
+       *
+       * 1. Create a certificate set via POST to
+       *    `/identity_providers/{id}/saml_certificate`
+       * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+       *    request
+       * 3. Configure the public certificate in your external Identity Provider
+       *
+       * Note: Requires `saml_certificate_set_id` to be set when `true`.
        */
-      client_secret?: string;
+      enable_encryption?: boolean;
 
       /**
-       * The claim name for email in the id_token response.
+       * Add a list of attribute names that will be returned in the response header from
+       * the Access callback.
        */
-      email_claim_name?: string;
+      header_attributes?: Array<Config.HeaderAttribute>;
 
       /**
-       * Your OneLogin account url
+       * X509 certificate to verify the signature in the SAML authentication response
        */
-      onelogin_account?: string;
+      idp_public_certs?: Array<string>;
+
+      /**
+       * IdP Entity ID or Issuer URL
+       */
+      issuer_url?: string;
+
+      /**
+       * Sign the SAML authentication request with Access credentials. To verify the
+       * signature, use the public key from the Access certs endpoints.
+       */
+      sign_request?: boolean;
+
+      /**
+       * URL to send the SAML authentication requests to
+       */
+      sso_target_url?: string;
+    }
+
+    export namespace Config {
+      export interface HeaderAttribute {
+        /**
+         * attribute name from the IDP
+         */
+        attribute_name?: string;
+
+        /**
+         * header that will be added on the request to the origin
+         */
+        header_name?: string;
+      }
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessPingone {
+  export interface AccessYandex {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessPingone.Config;
+    config: IdentityProvidersAPI.GenericOAuthConfig;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2609,6 +5214,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessYandex.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2616,47 +5242,77 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessPingone {
+  export namespace AccessYandex {
     /**
-     * The configuration parameters for the identity provider. To view the required
-     * parameters for a specific provider, refer to our
-     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
      */
-    export interface Config {
+    export interface SAMLCertificateSet {
       /**
-       * Custom claims
+       * Timestamp when the certificate set was created
        */
-      claims?: Array<string>;
+      created_at: string;
 
       /**
-       * Your OAuth Client ID
+       * Unique identifier for the certificate set
        */
-      client_id?: string;
+      uid: string;
 
       /**
-       * Your OAuth Client Secret
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
        */
-      client_secret?: string;
+      updated_at: string;
 
       /**
-       * The claim name for email in the id_token response.
+       * The currently active certificate used for encrypting SAML assertions
        */
-      email_claim_name?: string;
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
 
       /**
-       * Your PingOne environment identifier
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
        */
-      ping_env_id?: string;
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
     }
   }
 
-  export interface AccessSAML {
+  export interface AccessOnetimepin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: AccessSAML.Config;
+    config: AccessOnetimepin.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2675,6 +5331,27 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessOnetimepin.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -2682,74 +5359,86 @@ export namespace IdentityProviderListResponse {
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
 
-  export namespace AccessSAML {
+  export namespace AccessOnetimepin {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     export interface Config {
-      /**
-       * A list of SAML attribute names that will be added to your signed JWT token and
-       * can be used in SAML policy rules.
-       */
-      attributes?: Array<string>;
+      redirect_url?: string;
+    }
 
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
       /**
-       * The attribute name for email in the SAML response.
+       * Timestamp when the certificate set was created
        */
-      email_attribute_name?: string;
+      created_at: string;
 
       /**
-       * Add a list of attribute names that will be returned in the response header from
-       * the Access callback.
+       * Unique identifier for the certificate set
        */
-      header_attributes?: Array<Config.HeaderAttribute>;
+      uid: string;
 
       /**
-       * X509 certificate to verify the signature in the SAML authentication response
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
        */
-      idp_public_certs?: Array<string>;
+      updated_at: string;
 
       /**
-       * IdP Entity ID or Issuer URL
+       * The currently active certificate used for encrypting SAML assertions
        */
-      issuer_url?: string;
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
 
       /**
-       * Sign the SAML authentication request with Access credentials. To verify the
-       * signature, use the public key from the Access certs endpoints.
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
        */
-      sign_request?: boolean;
+      previous_certificate?: unknown | null;
+    }
 
+    export namespace SAMLCertificateSet {
       /**
-       * URL to send the SAML authentication requests to
+       * The currently active certificate used for encrypting SAML assertions
        */
-      sso_target_url?: string;
-    }
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
 
-    export namespace Config {
-      export interface HeaderAttribute {
         /**
-         * attribute name from the IDP
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
          */
-        attribute_name?: string;
+        public_certificate: string;
 
         /**
-         * header that will be added on the request to the origin
+         * Unique identifier for the certificate
          */
-        header_name?: string;
+        uid: string;
       }
     }
   }
 
-  export interface AccessYandex {
+  export interface AccessCloudflare {
     /**
      * The configuration parameters for the identity provider. To view the required
      * parameters for a specific provider, refer to our
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
-    config: IdentityProvidersAPI.GenericOAuthConfig;
+    config: AccessCloudflare.Config;
 
     /**
      * The name of the identity provider, shown to users on the login page.
@@ -2768,12 +5457,113 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AccessCloudflare.SAMLCertificateSet;
+
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
      */
     scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
   }
+
+  export namespace AccessCloudflare {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      redirect_url?: string;
+
+      /**
+       * When enabled, only users who are members of your Cloudflare account can
+       * authenticate through this identity provider. When disabled, any user with a
+       * Cloudflare account can authenticate, subject to your Access policies.
+       */
+      restrict_to_account_members?: boolean;
+    }
+
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    export interface SAMLCertificateSet {
+      /**
+       * Timestamp when the certificate set was created
+       */
+      created_at: string;
+
+      /**
+       * Unique identifier for the certificate set
+       */
+      uid: string;
+
+      /**
+       * Timestamp when the certificate set was last updated (e.g., during rotation)
+       */
+      updated_at: string;
+
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      current_certificate?: SAMLCertificateSet.CurrentCertificate;
+
+      /**
+       * The previous certificate, maintained during rotation to ensure continuity. Null
+       * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+       */
+      previous_certificate?: unknown | null;
+    }
+
+    export namespace SAMLCertificateSet {
+      /**
+       * The currently active certificate used for encrypting SAML assertions
+       */
+      export interface CurrentCertificate {
+        /**
+         * Indicates whether this is the currently active certificate
+         */
+        is_current: boolean;
+
+        /**
+         * Certificate expiration date. Certificates are automatically rotated 30 days
+         * before expiration.
+         */
+        not_after: string;
+
+        /**
+         * PEM-encoded X.509 certificate containing the public key. Configure this
+         * certificate in your external SAML Identity Provider to enable encryption.
+         */
+        public_certificate: string;
+
+        /**
+         * Unique identifier for the certificate
+         */
+        uid: string;
+      }
+    }
+  }
 }
 
 export interface IdentityProviderDeleteResponse {
@@ -2797,7 +5587,8 @@ export type IdentityProviderCreateParams =
   | IdentityProviderCreateParams.AccessPingone
   | IdentityProviderCreateParams.AccessSAML
   | IdentityProviderCreateParams.AccessYandex
-  | IdentityProviderCreateParams.AccessOnetimepin;
+  | IdentityProviderCreateParams.AccessOnetimepin
+  | IdentityProviderCreateParams.AccessCloudflare;
 
 export declare namespace IdentityProviderCreateParams {
   export interface AzureAD {
@@ -2832,6 +5623,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -2927,6 +5726,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3005,6 +5812,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3044,6 +5859,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3083,6 +5906,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3151,6 +5982,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3224,6 +6063,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3263,6 +6110,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3356,6 +6211,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3434,6 +6297,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3507,6 +6378,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3580,6 +6459,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3605,6 +6492,22 @@ export declare namespace IdentityProviderCreateParams {
        */
       email_attribute_name?: string;
 
+      /**
+       * Enable SAML assertion encryption. When enabled, the Identity Provider will
+       * encrypt SAML assertions using the certificate from the assigned certificate set.
+       *
+       * To enable encryption:
+       *
+       * 1. Create a certificate set via POST to
+       *    `/identity_providers/{id}/saml_certificate`
+       * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+       *    request
+       * 3. Configure the public certificate in your external Identity Provider
+       *
+       * Note: Requires `saml_certificate_set_id` to be set when `true`.
+       */
+      enable_encryption?: boolean;
+
       /**
        * Add a list of attribute names that will be returned in the response header from
        * the Access callback.
@@ -3680,6 +6583,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3719,6 +6630,14 @@ export declare namespace IdentityProviderCreateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3734,6 +6653,69 @@ export declare namespace IdentityProviderCreateParams {
      */
     export interface Config {}
   }
+
+  export interface AccessCloudflare {
+    /**
+     * Body param: The configuration parameters for the identity provider. To view the
+     * required parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessCloudflare.Config;
+
+    /**
+     * Body param: The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * Body param: The type of identity provider. To determine the value for a specific
+     * provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProviderTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * Body param: The configuration settings for enabling a System for Cross-Domain
+     * Identity Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProviderSCIMConfigParam;
+  }
+
+  export namespace AccessCloudflare {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * When enabled, only users who are members of your Cloudflare account can
+       * authenticate through this identity provider. When disabled, any user with a
+       * Cloudflare account can authenticate, subject to your Access policies.
+       */
+      restrict_to_account_members?: boolean;
+    }
+  }
 }
 
 export type IdentityProviderUpdateParams =
@@ -3750,7 +6732,8 @@ export type IdentityProviderUpdateParams =
   | IdentityProviderUpdateParams.AccessPingone
   | IdentityProviderUpdateParams.AccessSAML
   | IdentityProviderUpdateParams.AccessYandex
-  | IdentityProviderUpdateParams.AccessOnetimepin;
+  | IdentityProviderUpdateParams.AccessOnetimepin
+  | IdentityProviderUpdateParams.AccessCloudflare;
 
 export declare namespace IdentityProviderUpdateParams {
   export interface AzureAD {
@@ -3785,6 +6768,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3880,6 +6871,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3958,6 +6957,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -3997,6 +7004,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4036,6 +7051,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4104,6 +7127,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4177,6 +7208,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4216,6 +7255,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4309,6 +7356,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4387,6 +7442,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4460,6 +7523,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4533,6 +7604,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4558,6 +7637,22 @@ export declare namespace IdentityProviderUpdateParams {
        */
       email_attribute_name?: string;
 
+      /**
+       * Enable SAML assertion encryption. When enabled, the Identity Provider will
+       * encrypt SAML assertions using the certificate from the assigned certificate set.
+       *
+       * To enable encryption:
+       *
+       * 1. Create a certificate set via POST to
+       *    `/identity_providers/{id}/saml_certificate`
+       * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+       *    request
+       * 3. Configure the public certificate in your external Identity Provider
+       *
+       * Note: Requires `saml_certificate_set_id` to be set when `true`.
+       */
+      enable_encryption?: boolean;
+
       /**
        * Add a list of attribute names that will be returned in the response header from
        * the Access callback.
@@ -4633,6 +7728,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4672,6 +7775,14 @@ export declare namespace IdentityProviderUpdateParams {
      */
     zone_id?: string;
 
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
     /**
      * Body param: The configuration settings for enabling a System for Cross-Domain
      * Identity Management (SCIM) with the identity provider.
@@ -4687,6 +7798,69 @@ export declare namespace IdentityProviderUpdateParams {
      */
     export interface Config {}
   }
+
+  export interface AccessCloudflare {
+    /**
+     * Body param: The configuration parameters for the identity provider. To view the
+     * required parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    config: AccessCloudflare.Config;
+
+    /**
+     * Body param: The name of the identity provider, shown to users on the login page.
+     */
+    name: string;
+
+    /**
+     * Body param: The type of identity provider. To determine the value for a specific
+     * provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    type: IdentityProviderTypeParam;
+
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
+
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The UID of the SAML encryption certificate set assigned to this
+     * Identity Provider. Only present for SAML identity providers with encryption
+     * configured. Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
+
+    /**
+     * Body param: The configuration settings for enabling a System for Cross-Domain
+     * Identity Management (SCIM) with the identity provider.
+     */
+    scim_config?: IdentityProviderSCIMConfigParam;
+  }
+
+  export namespace AccessCloudflare {
+    /**
+     * The configuration parameters for the identity provider. To view the required
+     * parameters for a specific provider, refer to our
+     * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+     */
+    export interface Config {
+      /**
+       * When enabled, only users who are members of your Cloudflare account can
+       * authenticate through this identity provider. When disabled, any user with a
+       * Cloudflare account can authenticate, subject to your Access policies.
+       */
+      restrict_to_account_members?: boolean;
+    }
+  }
 }
 
 export interface IdentityProviderListParams extends V4PagePaginationArrayParams {
@@ -4736,6 +7910,7 @@ export interface IdentityProviderGetParams {
 IdentityProviders.IdentityProviderListResponsesV4PagePaginationArray =
   IdentityProviderListResponsesV4PagePaginationArray;
 IdentityProviders.SCIM = SCIM;
+IdentityProviders.SAMLCertificate = SAMLCertificate;
 
 export declare namespace IdentityProviders {
   export {
@@ -4755,4 +7930,10 @@ export declare namespace IdentityProviders {
   };
 
   export { SCIM as SCIM };
+
+  export {
+    SAMLCertificate as SAMLCertificate,
+    type SAMLCertificateCreateResponse as SAMLCertificateCreateResponse,
+    type SAMLCertificateCreateParams as SAMLCertificateCreateParams,
+  };
 }