cloudflare 6.2.0 → 6.4.0

package/resources/zero-trust/identity-providers/identity-providers.d.ts

@@ -1,11 +1,14 @@
 import { APIResource } from "../../../resource.js";
 import * as Core from "../../../core.js";
 import * as IdentityProvidersAPI from "./identity-providers.js";
+import * as SAMLCertificateAPI from "./saml-certificate.js";
+import { SAMLCertificate, SAMLCertificateCreateParams, SAMLCertificateCreateResponse } from "./saml-certificate.js";
 import * as SCIMAPI from "./scim/scim.js";
 import { SCIM } from "./scim/scim.js";
 import { V4PagePaginationArray, type V4PagePaginationArrayParams } from "../../../pagination.js";
 export declare class IdentityProviders extends APIResource {
     scim: SCIMAPI.SCIM;
+    samlCertificate: SAMLCertificateAPI.SAMLCertificate;
     /**
      * Adds a new identity provider to Access.
      *
@@ -106,6 +109,24 @@ export interface AzureAD {
      * UUID.
      */
     id?: string;
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    saml_certificate_set?: AzureAD.SAMLCertificateSet;
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -159,6 +180,59 @@ export declare namespace AzureAD {
          */
         support_groups?: boolean;
     }
+    /**
+     * The SAML encryption certificate set details, including current and previous
+     * certificates. Only present for SAML identity providers with a certificate set
+     * assigned.
+     */
+    interface SAMLCertificateSet {
+        /**
+         * Timestamp when the certificate set was created
+         */
+        created_at: string;
+        /**
+         * Unique identifier for the certificate set
+         */
+        uid: string;
+        /**
+         * Timestamp when the certificate set was last updated (e.g., during rotation)
+         */
+        updated_at: string;
+        /**
+         * The currently active certificate used for encrypting SAML assertions
+         */
+        current_certificate?: SAMLCertificateSet.CurrentCertificate;
+        /**
+         * The previous certificate, maintained during rotation to ensure continuity. Null
+         * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+         */
+        previous_certificate?: unknown | null;
+    }
+    namespace SAMLCertificateSet {
+        /**
+         * The currently active certificate used for encrypting SAML assertions
+         */
+        interface CurrentCertificate {
+            /**
+             * Indicates whether this is the currently active certificate
+             */
+            is_current: boolean;
+            /**
+             * Certificate expiration date. Certificates are automatically rotated 30 days
+             * before expiration.
+             */
+            not_after: string;
+            /**
+             * PEM-encoded X.509 certificate containing the public key. Configure this
+             * certificate in your external SAML Identity Provider to enable encryption.
+             */
+            public_certificate: string;
+            /**
+             * Unique identifier for the certificate
+             */
+            uid: string;
+        }
+    }
 }
 export interface AzureADParam {
     /**
@@ -177,6 +251,13 @@ export interface AzureADParam {
      * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
      */
     type: IdentityProviderTypeParam;
+    /**
+     * The UID of the SAML encryption certificate set assigned to this Identity
+     * Provider. Only present for SAML identity providers with encryption configured.
+     * Create a certificate set via POST to
+     * `/identity_providers/{id}/saml_certificate`.
+     */
+    saml_certificate_set_id?: string;
     /**
      * The configuration settings for enabling a System for Cross-Domain Identity
      * Management (SCIM) with the identity provider.
@@ -251,7 +332,7 @@ export interface GenericOAuthConfigParam {
      */
     client_secret?: string;
 }
-export type IdentityProvider = AzureAD | IdentityProvider.AccessCentrify | IdentityProvider.AccessFacebook | IdentityProvider.AccessGitHub | IdentityProvider.AccessGoogle | IdentityProvider.AccessGoogleApps | IdentityProvider.AccessLinkedin | IdentityProvider.AccessOIDC | IdentityProvider.AccessOkta | IdentityProvider.AccessOnelogin | IdentityProvider.AccessPingone | IdentityProvider.AccessSAML | IdentityProvider.AccessYandex | IdentityProvider.AccessOnetimepin;
+export type IdentityProvider = AzureAD | IdentityProvider.AccessCentrify | IdentityProvider.AccessFacebook | IdentityProvider.AccessGitHub | IdentityProvider.AccessGoogle | IdentityProvider.AccessGoogleApps | IdentityProvider.AccessLinkedin | IdentityProvider.AccessOIDC | IdentityProvider.AccessOkta | IdentityProvider.AccessOnelogin | IdentityProvider.AccessPingone | IdentityProvider.AccessSAML | IdentityProvider.AccessYandex | IdentityProvider.AccessOnetimepin | IdentityProvider.AccessCloudflare;
 export declare namespace IdentityProvider {
     interface AccessCentrify {
         /**
@@ -274,6 +355,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessCentrify.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -312,6 +411,59 @@ export declare namespace IdentityProvider {
              */
             email_claim_name?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessFacebook {
         /**
@@ -334,12 +486,85 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessFacebook.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessFacebook {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessGitHub {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -361,12 +586,85 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGitHub.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessGitHub {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessGoogle {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -388,6 +686,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGoogle.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -418,6 +734,59 @@ export declare namespace IdentityProvider {
              */
             email_claim_name?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessGoogleApps {
         /**
@@ -440,6 +809,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGoogleApps.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -474,6 +861,59 @@ export declare namespace IdentityProvider {
              */
             email_claim_name?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessLinkedin {
         /**
@@ -496,12 +936,85 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessLinkedin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessLinkedin {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessOIDC {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -523,6 +1036,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOIDC.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -573,6 +1104,59 @@ export declare namespace IdentityProvider {
              */
             token_url?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessOkta {
         /**
@@ -596,10 +1180,28 @@ export declare namespace IdentityProvider {
          */
         id?: string;
         /**
-         * The configuration settings for enabling a System for Cross-Domain Identity
-         * Management (SCIM) with the identity provider.
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
          */
-        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOkta.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
     namespace AccessOkta {
         /**
@@ -633,6 +1235,59 @@ export declare namespace IdentityProvider {
              */
             okta_account?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessOnelogin {
         /**
@@ -655,6 +1310,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOnelogin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -689,6 +1362,59 @@ export declare namespace IdentityProvider {
              */
             onelogin_account?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessPingone {
         /**
@@ -711,6 +1437,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessPingone.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -745,6 +1489,59 @@ export declare namespace IdentityProvider {
              */
             ping_env_id?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessSAML {
         /**
@@ -767,6 +1564,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessSAML.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -789,6 +1604,21 @@ export declare namespace IdentityProvider {
              * The attribute name for email in the SAML response.
              */
             email_attribute_name?: string;
+            /**
+             * Enable SAML assertion encryption. When enabled, the Identity Provider will
+             * encrypt SAML assertions using the certificate from the assigned certificate set.
+             *
+             * To enable encryption:
+             *
+             * 1. Create a certificate set via POST to
+             *    `/identity_providers/{id}/saml_certificate`
+             * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+             *    request
+             * 3. Configure the public certificate in your external Identity Provider
+             *
+             * Note: Requires `saml_certificate_set_id` to be set when `true`.
+             */
+            enable_encryption?: boolean;
             /**
              * Add a list of attribute names that will be returned in the response header from
              * the Access callback.
@@ -824,6 +1654,59 @@ export declare namespace IdentityProvider {
                 header_name?: string;
             }
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessYandex {
         /**
@@ -846,12 +1729,85 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessYandex.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessYandex {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessOnetimepin {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -873,6 +1829,24 @@ export declare namespace IdentityProvider {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOnetimepin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -888,17 +1862,67 @@ export declare namespace IdentityProvider {
         interface Config {
             redirect_url?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
-}
-export type IdentityProviderParam = AzureADParam | IdentityProviderParam.AccessCentrify | IdentityProviderParam.AccessFacebook | IdentityProviderParam.AccessGitHub | IdentityProviderParam.AccessGoogle | IdentityProviderParam.AccessGoogleApps | IdentityProviderParam.AccessLinkedin | IdentityProviderParam.AccessOIDC | IdentityProviderParam.AccessOkta | IdentityProviderParam.AccessOnelogin | IdentityProviderParam.AccessPingone | IdentityProviderParam.AccessSAML | IdentityProviderParam.AccessYandex | IdentityProviderParam.AccessOnetimepin;
-export declare namespace IdentityProviderParam {
-    interface AccessCentrify {
+    interface AccessCloudflare {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        config: AccessCentrify.Config;
+        config: AccessCloudflare.Config;
         /**
          * The name of the identity provider, shown to users on the login page.
          */
@@ -908,53 +1932,114 @@ export declare namespace IdentityProviderParam {
          * refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        type: IdentityProvidersAPI.IdentityProviderType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessCloudflare.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
-        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
-    namespace AccessCentrify {
+    namespace AccessCloudflare {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         interface Config {
+            redirect_url?: string;
             /**
-             * Your centrify account url
+             * When enabled, only users who are members of your Cloudflare account can
+             * authenticate through this identity provider. When disabled, any user with a
+             * Cloudflare account can authenticate, subject to your Access policies.
              */
-            centrify_account?: string;
+            restrict_to_account_members?: boolean;
+        }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
             /**
-             * Your centrify app id
+             * Timestamp when the certificate set was created
              */
-            centrify_app_id?: string;
+            created_at: string;
             /**
-             * Custom claims
+             * Unique identifier for the certificate set
              */
-            claims?: Array<string>;
+            uid: string;
             /**
-             * Your OAuth Client ID
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
              */
-            client_id?: string;
+            updated_at: string;
             /**
-             * Your OAuth Client Secret
+             * The currently active certificate used for encrypting SAML assertions
              */
-            client_secret?: string;
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
             /**
-             * The claim name for email in the id_token response.
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
              */
-            email_claim_name?: string;
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
         }
     }
-    interface AccessFacebook {
+}
+export type IdentityProviderParam = AzureADParam | IdentityProviderParam.AccessCentrify | IdentityProviderParam.AccessFacebook | IdentityProviderParam.AccessGitHub | IdentityProviderParam.AccessGoogle | IdentityProviderParam.AccessGoogleApps | IdentityProviderParam.AccessLinkedin | IdentityProviderParam.AccessOIDC | IdentityProviderParam.AccessOkta | IdentityProviderParam.AccessOnelogin | IdentityProviderParam.AccessPingone | IdentityProviderParam.AccessSAML | IdentityProviderParam.AccessYandex | IdentityProviderParam.AccessOnetimepin | IdentityProviderParam.AccessCloudflare;
+export declare namespace IdentityProviderParam {
+    interface AccessCentrify {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        config: IdentityProvidersAPI.GenericOAuthConfigParam;
+        config: AccessCentrify.Config;
         /**
          * The name of the identity provider, shown to users on the login page.
          */
@@ -965,29 +2050,106 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
     }
-    interface AccessGitHub {
+    namespace AccessCentrify {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        config: IdentityProvidersAPI.GenericOAuthConfigParam;
-        /**
-         * The name of the identity provider, shown to users on the login page.
-         */
-        name: string;
-        /**
-         * The type of identity provider. To determine the value for a specific provider,
-         * refer to our
+        interface Config {
+            /**
+             * Your centrify account url
+             */
+            centrify_account?: string;
+            /**
+             * Your centrify app id
+             */
+            centrify_app_id?: string;
+            /**
+             * Custom claims
+             */
+            claims?: Array<string>;
+            /**
+             * Your OAuth Client ID
+             */
+            client_id?: string;
+            /**
+             * Your OAuth Client Secret
+             */
+            client_secret?: string;
+            /**
+             * The claim name for email in the id_token response.
+             */
+            email_claim_name?: string;
+        }
+    }
+    interface AccessFacebook {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: IdentityProvidersAPI.GenericOAuthConfigParam;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+    }
+    interface AccessGitHub {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: IdentityProvidersAPI.GenericOAuthConfigParam;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1011,6 +2173,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1059,6 +2228,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1111,6 +2287,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1134,6 +2317,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1202,6 +2392,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1258,6 +2455,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1310,6 +2514,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1362,6 +2573,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1384,6 +2602,21 @@ export declare namespace IdentityProviderParam {
              * The attribute name for email in the SAML response.
              */
             email_attribute_name?: string;
+            /**
+             * Enable SAML assertion encryption. When enabled, the Identity Provider will
+             * encrypt SAML assertions using the certificate from the assigned certificate set.
+             *
+             * To enable encryption:
+             *
+             * 1. Create a certificate set via POST to
+             *    `/identity_providers/{id}/saml_certificate`
+             * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+             *    request
+             * 3. Configure the public certificate in your external Identity Provider
+             *
+             * Note: Requires `saml_certificate_set_id` to be set when `true`.
+             */
+            enable_encryption?: boolean;
             /**
              * Add a list of attribute names that will be returned in the response header from
              * the Access callback.
@@ -1437,6 +2670,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1460,6 +2700,13 @@ export declare namespace IdentityProviderParam {
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1475,6 +2722,51 @@ export declare namespace IdentityProviderParam {
         interface Config {
         }
     }
+    interface AccessCloudflare {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: AccessCloudflare.Config;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProvidersAPI.IdentityProviderTypeParam;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfigParam;
+    }
+    namespace AccessCloudflare {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        interface Config {
+            /**
+             * When enabled, only users who are members of your Cloudflare account can
+             * authenticate through this identity provider. When disabled, any user with a
+             * Cloudflare account can authenticate, subject to your Access policies.
+             */
+            restrict_to_account_members?: boolean;
+        }
+    }
 }
 /**
  * The configuration settings for enabling a System for Cross-Domain Identity
@@ -1553,14 +2845,14 @@ export interface IdentityProviderSCIMConfigParam {
  * refer to our
  * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
  */
-export type IdentityProviderType = 'onetimepin' | 'azureAD' | 'saml' | 'centrify' | 'facebook' | 'github' | 'google-apps' | 'google' | 'linkedin' | 'oidc' | 'okta' | 'onelogin' | 'pingone' | 'yandex';
+export type IdentityProviderType = 'onetimepin' | 'azureAD' | 'saml' | 'centrify' | 'facebook' | 'github' | 'google-apps' | 'google' | 'linkedin' | 'oidc' | 'okta' | 'onelogin' | 'pingone' | 'yandex' | 'cloudflare';
 /**
  * The type of identity provider. To determine the value for a specific provider,
  * refer to our
  * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
  */
-export type IdentityProviderTypeParam = 'onetimepin' | 'azureAD' | 'saml' | 'centrify' | 'facebook' | 'github' | 'google-apps' | 'google' | 'linkedin' | 'oidc' | 'okta' | 'onelogin' | 'pingone' | 'yandex';
-export type IdentityProviderListResponse = AzureAD | IdentityProviderListResponse.AccessCentrify | IdentityProviderListResponse.AccessFacebook | IdentityProviderListResponse.AccessGitHub | IdentityProviderListResponse.AccessGoogle | IdentityProviderListResponse.AccessGoogleApps | IdentityProviderListResponse.AccessLinkedin | IdentityProviderListResponse.AccessOIDC | IdentityProviderListResponse.AccessOkta | IdentityProviderListResponse.AccessOnelogin | IdentityProviderListResponse.AccessPingone | IdentityProviderListResponse.AccessSAML | IdentityProviderListResponse.AccessYandex;
+export type IdentityProviderTypeParam = 'onetimepin' | 'azureAD' | 'saml' | 'centrify' | 'facebook' | 'github' | 'google-apps' | 'google' | 'linkedin' | 'oidc' | 'okta' | 'onelogin' | 'pingone' | 'yandex' | 'cloudflare';
+export type IdentityProviderListResponse = AzureAD | IdentityProviderListResponse.AccessCentrify | IdentityProviderListResponse.AccessFacebook | IdentityProviderListResponse.AccessGitHub | IdentityProviderListResponse.AccessGoogle | IdentityProviderListResponse.AccessGoogleApps | IdentityProviderListResponse.AccessLinkedin | IdentityProviderListResponse.AccessOIDC | IdentityProviderListResponse.AccessOkta | IdentityProviderListResponse.AccessOnelogin | IdentityProviderListResponse.AccessPingone | IdentityProviderListResponse.AccessSAML | IdentityProviderListResponse.AccessYandex | IdentityProviderListResponse.AccessOnetimepin | IdentityProviderListResponse.AccessCloudflare;
 export declare namespace IdentityProviderListResponse {
     interface AccessCentrify {
         /**
@@ -1583,6 +2875,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessCentrify.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1621,6 +2931,59 @@ export declare namespace IdentityProviderListResponse {
              */
             email_claim_name?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessFacebook {
         /**
@@ -1643,12 +3006,85 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessFacebook.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessFacebook {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessGitHub {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -1670,12 +3106,85 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGitHub.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessGitHub {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessGoogle {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -1697,6 +3206,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGoogle.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1727,6 +3254,59 @@ export declare namespace IdentityProviderListResponse {
              */
             email_claim_name?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessGoogleApps {
         /**
@@ -1749,6 +3329,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessGoogleApps.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1783,8 +3381,61 @@ export declare namespace IdentityProviderListResponse {
              */
             email_claim_name?: string;
         }
-    }
-    interface AccessLinkedin {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
+    interface AccessLinkedin {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
@@ -1805,12 +3456,85 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessLinkedin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
+    namespace AccessLinkedin {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
     interface AccessOIDC {
         /**
          * The configuration parameters for the identity provider. To view the required
@@ -1832,6 +3556,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOIDC.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1882,6 +3624,59 @@ export declare namespace IdentityProviderListResponse {
              */
             token_url?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessOkta {
         /**
@@ -1904,6 +3699,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOkta.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1942,6 +3755,59 @@ export declare namespace IdentityProviderListResponse {
              */
             okta_account?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
     interface AccessOnelogin {
         /**
@@ -1964,6 +3830,24 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOnelogin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
@@ -1998,14 +3882,459 @@ export declare namespace IdentityProviderListResponse {
              */
             onelogin_account?: string;
         }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
+    interface AccessPingone {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: AccessPingone.Config;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProvidersAPI.IdentityProviderType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessPingone.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+    }
+    namespace AccessPingone {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        interface Config {
+            /**
+             * Custom claims
+             */
+            claims?: Array<string>;
+            /**
+             * Your OAuth Client ID
+             */
+            client_id?: string;
+            /**
+             * Your OAuth Client Secret
+             */
+            client_secret?: string;
+            /**
+             * The claim name for email in the id_token response.
+             */
+            email_claim_name?: string;
+            /**
+             * Your PingOne environment identifier
+             */
+            ping_env_id?: string;
+        }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
+    interface AccessSAML {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: AccessSAML.Config;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProvidersAPI.IdentityProviderType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessSAML.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+    }
+    namespace AccessSAML {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        interface Config {
+            /**
+             * A list of SAML attribute names that will be added to your signed JWT token and
+             * can be used in SAML policy rules.
+             */
+            attributes?: Array<string>;
+            /**
+             * The attribute name for email in the SAML response.
+             */
+            email_attribute_name?: string;
+            /**
+             * Enable SAML assertion encryption. When enabled, the Identity Provider will
+             * encrypt SAML assertions using the certificate from the assigned certificate set.
+             *
+             * To enable encryption:
+             *
+             * 1. Create a certificate set via POST to
+             *    `/identity_providers/{id}/saml_certificate`
+             * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+             *    request
+             * 3. Configure the public certificate in your external Identity Provider
+             *
+             * Note: Requires `saml_certificate_set_id` to be set when `true`.
+             */
+            enable_encryption?: boolean;
+            /**
+             * Add a list of attribute names that will be returned in the response header from
+             * the Access callback.
+             */
+            header_attributes?: Array<Config.HeaderAttribute>;
+            /**
+             * X509 certificate to verify the signature in the SAML authentication response
+             */
+            idp_public_certs?: Array<string>;
+            /**
+             * IdP Entity ID or Issuer URL
+             */
+            issuer_url?: string;
+            /**
+             * Sign the SAML authentication request with Access credentials. To verify the
+             * signature, use the public key from the Access certs endpoints.
+             */
+            sign_request?: boolean;
+            /**
+             * URL to send the SAML authentication requests to
+             */
+            sso_target_url?: string;
+        }
+        namespace Config {
+            interface HeaderAttribute {
+                /**
+                 * attribute name from the IDP
+                 */
+                attribute_name?: string;
+                /**
+                 * header that will be added on the request to the origin
+                 */
+                header_name?: string;
+            }
+        }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
+    }
+    interface AccessYandex {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: IdentityProvidersAPI.GenericOAuthConfig;
+        /**
+         * The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * The type of identity provider. To determine the value for a specific provider,
+         * refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProvidersAPI.IdentityProviderType;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessYandex.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * The configuration settings for enabling a System for Cross-Domain Identity
+         * Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
+    }
+    namespace AccessYandex {
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
+            /**
+             * Timestamp when the certificate set was created
+             */
+            created_at: string;
+            /**
+             * Unique identifier for the certificate set
+             */
+            uid: string;
+            /**
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
+             */
+            updated_at: string;
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
+            /**
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
+             */
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
+        }
     }
-    interface AccessPingone {
+    interface AccessOnetimepin {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        config: AccessPingone.Config;
+        config: AccessOnetimepin.Config;
         /**
          * The name of the identity provider, shown to users on the login page.
          */
@@ -2020,48 +4349,100 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessOnetimepin.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
-    namespace AccessPingone {
+    namespace AccessOnetimepin {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         interface Config {
+            redirect_url?: string;
+        }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
             /**
-             * Custom claims
+             * Timestamp when the certificate set was created
              */
-            claims?: Array<string>;
+            created_at: string;
             /**
-             * Your OAuth Client ID
+             * Unique identifier for the certificate set
              */
-            client_id?: string;
+            uid: string;
             /**
-             * Your OAuth Client Secret
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
              */
-            client_secret?: string;
+            updated_at: string;
             /**
-             * The claim name for email in the id_token response.
+             * The currently active certificate used for encrypting SAML assertions
              */
-            email_claim_name?: string;
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
             /**
-             * Your PingOne environment identifier
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
              */
-            ping_env_id?: string;
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
+            /**
+             * The currently active certificate used for encrypting SAML assertions
+             */
+            interface CurrentCertificate {
+                /**
+                 * Indicates whether this is the currently active certificate
+                 */
+                is_current: boolean;
+                /**
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
+                 */
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
+            }
         }
     }
-    interface AccessSAML {
+    interface AccessCloudflare {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
-        config: AccessSAML.Config;
+        config: AccessCloudflare.Config;
         /**
          * The name of the identity provider, shown to users on the login page.
          */
@@ -2076,91 +4457,99 @@ export declare namespace IdentityProviderListResponse {
          * UUID.
          */
         id?: string;
+        /**
+         * Indicates that the identity provider is immutable and cannot be updated or
+         * deleted via the API.
+         */
+        read_only?: boolean;
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        saml_certificate_set?: AccessCloudflare.SAMLCertificateSet;
+        /**
+         * The UID of the SAML encryption certificate set assigned to this Identity
+         * Provider. Only present for SAML identity providers with encryption configured.
+         * Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * The configuration settings for enabling a System for Cross-Domain Identity
          * Management (SCIM) with the identity provider.
          */
         scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
     }
-    namespace AccessSAML {
+    namespace AccessCloudflare {
         /**
          * The configuration parameters for the identity provider. To view the required
          * parameters for a specific provider, refer to our
          * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
          */
         interface Config {
+            redirect_url?: string;
             /**
-             * A list of SAML attribute names that will be added to your signed JWT token and
-             * can be used in SAML policy rules.
+             * When enabled, only users who are members of your Cloudflare account can
+             * authenticate through this identity provider. When disabled, any user with a
+             * Cloudflare account can authenticate, subject to your Access policies.
              */
-            attributes?: Array<string>;
+            restrict_to_account_members?: boolean;
+        }
+        /**
+         * The SAML encryption certificate set details, including current and previous
+         * certificates. Only present for SAML identity providers with a certificate set
+         * assigned.
+         */
+        interface SAMLCertificateSet {
             /**
-             * The attribute name for email in the SAML response.
+             * Timestamp when the certificate set was created
              */
-            email_attribute_name?: string;
+            created_at: string;
             /**
-             * Add a list of attribute names that will be returned in the response header from
-             * the Access callback.
+             * Unique identifier for the certificate set
              */
-            header_attributes?: Array<Config.HeaderAttribute>;
+            uid: string;
             /**
-             * X509 certificate to verify the signature in the SAML authentication response
+             * Timestamp when the certificate set was last updated (e.g., during rotation)
              */
-            idp_public_certs?: Array<string>;
+            updated_at: string;
             /**
-             * IdP Entity ID or Issuer URL
+             * The currently active certificate used for encrypting SAML assertions
              */
-            issuer_url?: string;
+            current_certificate?: SAMLCertificateSet.CurrentCertificate;
             /**
-             * Sign the SAML authentication request with Access credentials. To verify the
-             * signature, use the public key from the Access certs endpoints.
+             * The previous certificate, maintained during rotation to ensure continuity. Null
+             * if no rotation has occurred. Mirrors the structure of `saml_certificate`.
              */
-            sign_request?: boolean;
+            previous_certificate?: unknown | null;
+        }
+        namespace SAMLCertificateSet {
             /**
-             * URL to send the SAML authentication requests to
+             * The currently active certificate used for encrypting SAML assertions
              */
-            sso_target_url?: string;
-        }
-        namespace Config {
-            interface HeaderAttribute {
+            interface CurrentCertificate {
                 /**
-                 * attribute name from the IDP
+                 * Indicates whether this is the currently active certificate
                  */
-                attribute_name?: string;
+                is_current: boolean;
                 /**
-                 * header that will be added on the request to the origin
+                 * Certificate expiration date. Certificates are automatically rotated 30 days
+                 * before expiration.
                  */
-                header_name?: string;
+                not_after: string;
+                /**
+                 * PEM-encoded X.509 certificate containing the public key. Configure this
+                 * certificate in your external SAML Identity Provider to enable encryption.
+                 */
+                public_certificate: string;
+                /**
+                 * Unique identifier for the certificate
+                 */
+                uid: string;
             }
         }
     }
-    interface AccessYandex {
-        /**
-         * The configuration parameters for the identity provider. To view the required
-         * parameters for a specific provider, refer to our
-         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-         */
-        config: IdentityProvidersAPI.GenericOAuthConfig;
-        /**
-         * The name of the identity provider, shown to users on the login page.
-         */
-        name: string;
-        /**
-         * The type of identity provider. To determine the value for a specific provider,
-         * refer to our
-         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
-         */
-        type: IdentityProvidersAPI.IdentityProviderType;
-        /**
-         * UUID.
-         */
-        id?: string;
-        /**
-         * The configuration settings for enabling a System for Cross-Domain Identity
-         * Management (SCIM) with the identity provider.
-         */
-        scim_config?: IdentityProvidersAPI.IdentityProviderSCIMConfig;
-    }
 }
 export interface IdentityProviderDeleteResponse {
     /**
@@ -2168,7 +4557,7 @@ export interface IdentityProviderDeleteResponse {
      */
     id?: string;
 }
-export type IdentityProviderCreateParams = IdentityProviderCreateParams.AzureAD | IdentityProviderCreateParams.AccessCentrify | IdentityProviderCreateParams.AccessFacebook | IdentityProviderCreateParams.AccessGitHub | IdentityProviderCreateParams.AccessGoogle | IdentityProviderCreateParams.AccessGoogleApps | IdentityProviderCreateParams.AccessLinkedin | IdentityProviderCreateParams.AccessOIDC | IdentityProviderCreateParams.AccessOkta | IdentityProviderCreateParams.AccessOnelogin | IdentityProviderCreateParams.AccessPingone | IdentityProviderCreateParams.AccessSAML | IdentityProviderCreateParams.AccessYandex | IdentityProviderCreateParams.AccessOnetimepin;
+export type IdentityProviderCreateParams = IdentityProviderCreateParams.AzureAD | IdentityProviderCreateParams.AccessCentrify | IdentityProviderCreateParams.AccessFacebook | IdentityProviderCreateParams.AccessGitHub | IdentityProviderCreateParams.AccessGoogle | IdentityProviderCreateParams.AccessGoogleApps | IdentityProviderCreateParams.AccessLinkedin | IdentityProviderCreateParams.AccessOIDC | IdentityProviderCreateParams.AccessOkta | IdentityProviderCreateParams.AccessOnelogin | IdentityProviderCreateParams.AccessPingone | IdentityProviderCreateParams.AccessSAML | IdentityProviderCreateParams.AccessYandex | IdentityProviderCreateParams.AccessOnetimepin | IdentityProviderCreateParams.AccessCloudflare;
 export declare namespace IdentityProviderCreateParams {
     interface AzureAD {
         /**
@@ -2197,6 +4586,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2278,6 +4674,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2344,6 +4747,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2377,6 +4787,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2410,6 +4827,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2468,6 +4892,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2530,6 +4961,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2563,6 +5001,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2641,6 +5086,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2707,6 +5159,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2769,6 +5228,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2831,6 +5297,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2853,6 +5326,21 @@ export declare namespace IdentityProviderCreateParams {
              * The attribute name for email in the SAML response.
              */
             email_attribute_name?: string;
+            /**
+             * Enable SAML assertion encryption. When enabled, the Identity Provider will
+             * encrypt SAML assertions using the certificate from the assigned certificate set.
+             *
+             * To enable encryption:
+             *
+             * 1. Create a certificate set via POST to
+             *    `/identity_providers/{id}/saml_certificate`
+             * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+             *    request
+             * 3. Configure the public certificate in your external Identity Provider
+             *
+             * Note: Requires `saml_certificate_set_id` to be set when `true`.
+             */
+            enable_encryption?: boolean;
             /**
              * Add a list of attribute names that will be returned in the response header from
              * the Access callback.
@@ -2916,6 +5404,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2949,6 +5444,13 @@ export declare namespace IdentityProviderCreateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -2964,8 +5466,63 @@ export declare namespace IdentityProviderCreateParams {
         interface Config {
         }
     }
+    interface AccessCloudflare {
+        /**
+         * Body param: The configuration parameters for the identity provider. To view the
+         * required parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: AccessCloudflare.Config;
+        /**
+         * Body param: The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * Body param: The type of identity provider. To determine the value for a specific
+         * provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProviderTypeParam;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * Body param: The configuration settings for enabling a System for Cross-Domain
+         * Identity Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProviderSCIMConfigParam;
+    }
+    namespace AccessCloudflare {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        interface Config {
+            /**
+             * When enabled, only users who are members of your Cloudflare account can
+             * authenticate through this identity provider. When disabled, any user with a
+             * Cloudflare account can authenticate, subject to your Access policies.
+             */
+            restrict_to_account_members?: boolean;
+        }
+    }
 }
-export type IdentityProviderUpdateParams = IdentityProviderUpdateParams.AzureAD | IdentityProviderUpdateParams.AccessCentrify | IdentityProviderUpdateParams.AccessFacebook | IdentityProviderUpdateParams.AccessGitHub | IdentityProviderUpdateParams.AccessGoogle | IdentityProviderUpdateParams.AccessGoogleApps | IdentityProviderUpdateParams.AccessLinkedin | IdentityProviderUpdateParams.AccessOIDC | IdentityProviderUpdateParams.AccessOkta | IdentityProviderUpdateParams.AccessOnelogin | IdentityProviderUpdateParams.AccessPingone | IdentityProviderUpdateParams.AccessSAML | IdentityProviderUpdateParams.AccessYandex | IdentityProviderUpdateParams.AccessOnetimepin;
+export type IdentityProviderUpdateParams = IdentityProviderUpdateParams.AzureAD | IdentityProviderUpdateParams.AccessCentrify | IdentityProviderUpdateParams.AccessFacebook | IdentityProviderUpdateParams.AccessGitHub | IdentityProviderUpdateParams.AccessGoogle | IdentityProviderUpdateParams.AccessGoogleApps | IdentityProviderUpdateParams.AccessLinkedin | IdentityProviderUpdateParams.AccessOIDC | IdentityProviderUpdateParams.AccessOkta | IdentityProviderUpdateParams.AccessOnelogin | IdentityProviderUpdateParams.AccessPingone | IdentityProviderUpdateParams.AccessSAML | IdentityProviderUpdateParams.AccessYandex | IdentityProviderUpdateParams.AccessOnetimepin | IdentityProviderUpdateParams.AccessCloudflare;
 export declare namespace IdentityProviderUpdateParams {
     interface AzureAD {
         /**
@@ -2994,6 +5551,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3075,6 +5639,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3141,6 +5712,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3174,6 +5752,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3207,6 +5792,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3265,6 +5857,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3327,6 +5926,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3360,6 +5966,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3438,6 +6051,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3504,6 +6124,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3566,6 +6193,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3628,6 +6262,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3650,6 +6291,21 @@ export declare namespace IdentityProviderUpdateParams {
              * The attribute name for email in the SAML response.
              */
             email_attribute_name?: string;
+            /**
+             * Enable SAML assertion encryption. When enabled, the Identity Provider will
+             * encrypt SAML assertions using the certificate from the assigned certificate set.
+             *
+             * To enable encryption:
+             *
+             * 1. Create a certificate set via POST to
+             *    `/identity_providers/{id}/saml_certificate`
+             * 2. Set this field to `true` and include `saml_certificate_set_id` in the PUT
+             *    request
+             * 3. Configure the public certificate in your external Identity Provider
+             *
+             * Note: Requires `saml_certificate_set_id` to be set when `true`.
+             */
+            enable_encryption?: boolean;
             /**
              * Add a list of attribute names that will be returned in the response header from
              * the Access callback.
@@ -3713,6 +6369,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3746,6 +6409,13 @@ export declare namespace IdentityProviderUpdateParams {
          * Account ID.
          */
         zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
         /**
          * Body param: The configuration settings for enabling a System for Cross-Domain
          * Identity Management (SCIM) with the identity provider.
@@ -3761,6 +6431,61 @@ export declare namespace IdentityProviderUpdateParams {
         interface Config {
         }
     }
+    interface AccessCloudflare {
+        /**
+         * Body param: The configuration parameters for the identity provider. To view the
+         * required parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        config: AccessCloudflare.Config;
+        /**
+         * Body param: The name of the identity provider, shown to users on the login page.
+         */
+        name: string;
+        /**
+         * Body param: The type of identity provider. To determine the value for a specific
+         * provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        type: IdentityProviderTypeParam;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The UID of the SAML encryption certificate set assigned to this
+         * Identity Provider. Only present for SAML identity providers with encryption
+         * configured. Create a certificate set via POST to
+         * `/identity_providers/{id}/saml_certificate`.
+         */
+        saml_certificate_set_id?: string;
+        /**
+         * Body param: The configuration settings for enabling a System for Cross-Domain
+         * Identity Management (SCIM) with the identity provider.
+         */
+        scim_config?: IdentityProviderSCIMConfigParam;
+    }
+    namespace AccessCloudflare {
+        /**
+         * The configuration parameters for the identity provider. To view the required
+         * parameters for a specific provider, refer to our
+         * [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
+         */
+        interface Config {
+            /**
+             * When enabled, only users who are members of your Cloudflare account can
+             * authenticate through this identity provider. When disabled, any user with a
+             * Cloudflare account can authenticate, subject to your Access policies.
+             */
+            restrict_to_account_members?: boolean;
+        }
+    }
 }
 export interface IdentityProviderListParams extends V4PagePaginationArrayParams {
     /**
@@ -3802,5 +6527,6 @@ export interface IdentityProviderGetParams {
 export declare namespace IdentityProviders {
     export { type AzureAD as AzureAD, type GenericOAuthConfig as GenericOAuthConfig, type IdentityProvider as IdentityProvider, type IdentityProviderSCIMConfig as IdentityProviderSCIMConfig, type IdentityProviderType as IdentityProviderType, type IdentityProviderListResponse as IdentityProviderListResponse, type IdentityProviderDeleteResponse as IdentityProviderDeleteResponse, IdentityProviderListResponsesV4PagePaginationArray as IdentityProviderListResponsesV4PagePaginationArray, type IdentityProviderCreateParams as IdentityProviderCreateParams, type IdentityProviderUpdateParams as IdentityProviderUpdateParams, type IdentityProviderListParams as IdentityProviderListParams, type IdentityProviderDeleteParams as IdentityProviderDeleteParams, type IdentityProviderGetParams as IdentityProviderGetParams, };
     export { SCIM as SCIM };
+    export { SAMLCertificate as SAMLCertificate, type SAMLCertificateCreateResponse as SAMLCertificateCreateResponse, type SAMLCertificateCreateParams as SAMLCertificateCreateParams, };
 }
 //# sourceMappingURL=identity-providers.d.ts.map