cloudflare 6.3.0 → 6.4.0

package/src/resources/iam/oauth-scopes.ts

@@ -0,0 +1,63 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../resource';
+import * as Core from '../../core';
+import { SinglePage } from '../../pagination';
+
+export class OAuthScopes extends APIResource {
+  /**
+   * List all available OAuth scopes. This endpoint requires authentication but has
+   * no authorization role requirements.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const oauthScopeListResponse of client.iam.oauthScopes.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    options?: Core.RequestOptions,
+  ): Core.PagePromise<OAuthScopeListResponsesSinglePage, OAuthScopeListResponse> {
+    return this._client.getAPIList('/oauth/scopes', OAuthScopeListResponsesSinglePage, options);
+  }
+}
+
+export class OAuthScopeListResponsesSinglePage extends SinglePage<OAuthScopeListResponse> {}
+
+/**
+ * An available OAuth scope that can be assigned to an OAuth client.
+ */
+export interface OAuthScopeListResponse {
+  /**
+   * The scope label to use in the scopes array when creating or updating an OAuth
+   * client.
+   */
+  id: string;
+
+  /**
+   * Human-readable name of the OAuth scope.
+   */
+  name: string;
+
+  /**
+   * Category for grouping scopes in the UI.
+   */
+  category?: string;
+
+  /**
+   * The underlying resource scopes (Bach scopes) that define which resources this
+   * OAuth scope can act upon.
+   */
+  scopes?: Array<string>;
+}
+
+OAuthScopes.OAuthScopeListResponsesSinglePage = OAuthScopeListResponsesSinglePage;
+
+export declare namespace OAuthScopes {
+  export {
+    type OAuthScopeListResponse as OAuthScopeListResponse,
+    OAuthScopeListResponsesSinglePage as OAuthScopeListResponsesSinglePage,
+  };
+}

package/src/resources/index.ts

@@ -3,6 +3,7 @@
 export * from './shared';
 export { ACM } from './acm/acm';
 export { AI } from './ai/ai';
+export { AIAudit } from './ai-audit/ai-audit';
 export { AIGateway } from './ai-gateway/ai-gateway';
 export { AISearch } from './aisearch/aisearch';
 export { AISecurity } from './ai-security/ai-security';
@@ -26,7 +27,9 @@ export { CloudConnector } from './cloud-connector/cloud-connector';
 export { CloudforceOne } from './cloudforce-one/cloudforce-one';
 export { Connectivity } from './connectivity/connectivity';
 export { ContentScanning } from './content-scanning/content-scanning';
+export { CsamScanner } from './csam-scanner';
 export { CustomCertificates } from './custom-certificates/custom-certificates';
+export { CustomCsrs } from './custom-csrs';
 export { CustomHostnames } from './custom-hostnames/custom-hostnames';
 export { CustomNameservers } from './custom-nameservers';
 export { CustomPages } from './custom-pages/custom-pages';
@@ -43,6 +46,7 @@ export { EmailSecurity } from './email-security/email-security';
 export { EmailSending } from './email-sending/email-sending';
 export { Filters } from './filters';
 export { Firewall } from './firewall/firewall';
+export { Flagship } from './flagship/flagship';
 export { Fraud } from './fraud';
 export { GoogleTagGateway } from './google-tag-gateway/google-tag-gateway';
 export { Healthchecks } from './healthchecks/healthchecks';
@@ -69,6 +73,7 @@ export { Organizations } from './organizations/organizations';
 export { OriginCACertificates } from './origin-ca-certificates';
 export { OriginPostQuantumEncryption } from './origin-post-quantum-encryption';
 export { OriginTLSClientAuth } from './origin-tls-client-auth/origin-tls-client-auth';
+export { OriginTLSComplianceModes } from './origin-tls-compliance-modes';
 export { PageRules } from './page-rules';
 export { PageShield } from './page-shield/page-shield';
 export { Pages } from './pages/pages';
@@ -95,6 +100,7 @@ export { Snippets } from './snippets/snippets';
 export { Spectrum } from './spectrum/spectrum';
 export { Speed } from './speed/speed';
 export { Stream } from './stream/stream';
+export { TenantCustomNameservers } from './tenant-custom-nameservers';
 export { TokenValidation } from './token-validation/token-validation';
 export { Turnstile } from './turnstile/turnstile';
 export { URLNormalization } from './url-normalization';

package/src/resources/intel/indicator-feeds/snapshots.ts

@@ -7,6 +7,14 @@ export class Snapshots extends APIResource {
   /**
    * Revises the raw data entries in a custom threat indicator feed.
    *
+   * Accepts both plain and gzipped STIX2/CRDF bodies. Gzip is detected by RFC 1952
+   * magic bytes (`0x1f 0x8b`) and/or a `.gz` filename suffix (case-insensitive) —
+   * either signal alone is sufficient to trigger the gzip path; if the body is not
+   * valid gzip, the upload fails fast. Customers are encouraged to gzip larger
+   * uploads — the api-gateway 500 MB body cap applies to the on-the-wire
+   * (compressed) size, so gzip lets a single upload carry several GiB of
+   * decompressed STIX.
+   *
    * @example
    * ```ts
    * const snapshot =
@@ -54,7 +62,8 @@ export interface SnapshotUpdateParams {
   account_id: string;
 
   /**
-   * Body param: The file to upload
+   * Body param: The file to upload. Either a plain STIX2/CRDF body or a gzipped one
+   * (recognised by `0x1f 0x8b` magic bytes or a `.gz` filename suffix).
    */
   source?: string;
 }

package/src/resources/intel/sinkholes.ts

@@ -33,7 +33,7 @@ export interface Sinkhole {
   /**
    * The unique identifier for the sinkhole.
    */
-  id?: number;
+  id?: string;
 
   /**
    * The account tag that owns this sinkhole.

package/src/resources/keyless-certificates/keyless-certificates.ts

@@ -191,37 +191,37 @@ export interface KeylessCertificate {
   status: 'active' | 'deleted';
 
   /**
-   * Configuration for using Keyless SSL through a Cloudflare Tunnel
+   * Configuration for using Keyless SSL through a Cloudflare Tunnel.
    */
   tunnel?: Tunnel;
 }
 
 /**
- * Configuration for using Keyless SSL through a Cloudflare Tunnel
+ * Configuration for using Keyless SSL through a Cloudflare Tunnel.
  */
 export interface Tunnel {
   /**
-   * Private IP of the Key Server Host
+   * Private IP of the Key Server Host.
    */
   private_ip: string;
 
   /**
-   * Cloudflare Tunnel Virtual Network ID
+   * Cloudflare Tunnel Virtual Network ID.
    */
   vnet_id: string;
 }
 
 /**
- * Configuration for using Keyless SSL through a Cloudflare Tunnel
+ * Configuration for using Keyless SSL through a Cloudflare Tunnel.
  */
 export interface TunnelParam {
   /**
-   * Private IP of the Key Server Host
+   * Private IP of the Key Server Host.
    */
   private_ip: string;
 
   /**
-   * Cloudflare Tunnel Virtual Network ID
+   * Cloudflare Tunnel Virtual Network ID.
    */
   vnet_id: string;
 }
@@ -269,7 +269,7 @@ export interface KeylessCertificateCreateParams {
   name?: string;
 
   /**
-   * Body param: Configuration for using Keyless SSL through a Cloudflare Tunnel
+   * Body param: Configuration for using Keyless SSL through a Cloudflare Tunnel.
    */
   tunnel?: TunnelParam;
 }
@@ -316,7 +316,7 @@ export interface KeylessCertificateEditParams {
   port?: number;
 
   /**
-   * Body param: Configuration for using Keyless SSL through a Cloudflare Tunnel
+   * Body param: Configuration for using Keyless SSL through a Cloudflare Tunnel.
    */
   tunnel?: TunnelParam;
 }

package/src/resources/logpush/datasets/fields.ts

@@ -48,8 +48,10 @@ export class Fields extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',
@@ -86,8 +88,10 @@ export class Fields extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',
@@ -123,8 +127,10 @@ export class Fields extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',

package/src/resources/logpush/datasets/jobs.ts

@@ -52,8 +52,10 @@ export class Jobs extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',
@@ -90,8 +92,10 @@ export class Jobs extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',
@@ -127,8 +131,10 @@ export class Jobs extends APIResource {
       | 'sinkhole_http_logs'
       | 'spectrum_events'
       | 'ssh_logs'
+      | 'turnstile_events'
       | 'warp_config_changes'
       | 'warp_toggle_changes'
+      | 'websocket_analytics'
       | 'workers_trace_events'
       | 'zaraz_events'
       | 'zero_trust_network_sessions',

package/src/resources/logpush/jobs.ts

@@ -314,8 +314,10 @@ export interface LogpushJob {
     | 'sinkhole_http_logs'
     | 'spectrum_events'
     | 'ssh_logs'
+    | 'turnstile_events'
     | 'warp_config_changes'
     | 'warp_toggle_changes'
+    | 'websocket_analytics'
     | 'workers_trace_events'
     | 'zaraz_events'
     | 'zero_trust_network_sessions'
@@ -643,8 +645,10 @@ export interface JobCreateParams {
     | 'sinkhole_http_logs'
     | 'spectrum_events'
     | 'ssh_logs'
+    | 'turnstile_events'
     | 'warp_config_changes'
     | 'warp_toggle_changes'
+    | 'websocket_analytics'
     | 'workers_trace_events'
     | 'zaraz_events'
     | 'zero_trust_network_sessions'

package/src/resources/magic-transit/connectors/events/events.ts

@@ -121,7 +121,12 @@ export interface EventGetResponse {
     | EventGetResponse.FinishUpgradeSuccess
     | EventGetResponse.FinishUpgradeFailure
     | EventGetResponse.Reconcile
-    | EventGetResponse.ConfigureCloudflaredTunnel;
+    | EventGetResponse.ConfigureCloudflaredTunnel
+    | EventGetResponse.RekeyInstallBoth
+    | EventGetResponse.RekeyStart
+    | EventGetResponse.RekeyAdvance
+    | EventGetResponse.RekeyComplete
+    | EventGetResponse.RekeyReset;
 
   /**
    * Sequence number, used to order events with the same timestamp
@@ -256,6 +261,66 @@ export namespace EventGetResponse {
      */
     k: 'ConfigureCloudflaredTunnel';
   }
+
+  export interface RekeyInstallBoth {
+    /**
+     * Installed initial inbound and outbound keys
+     */
+    k: 'RekeyInstallBoth';
+
+    /**
+     * Tunnel identifier
+     */
+    tunnel_id: string;
+  }
+
+  export interface RekeyStart {
+    /**
+     * Installed new inbound key, kept old outbound
+     */
+    k: 'RekeyStart';
+
+    /**
+     * Tunnel identifier
+     */
+    tunnel_id: string;
+  }
+
+  export interface RekeyAdvance {
+    /**
+     * Confirmed traffic on new inbound key, swapped outbound to new
+     */
+    k: 'RekeyAdvance';
+
+    /**
+     * Tunnel identifier
+     */
+    tunnel_id: string;
+  }
+
+  export interface RekeyComplete {
+    /**
+     * Deleted old keys
+     */
+    k: 'RekeyComplete';
+
+    /**
+     * Tunnel identifier
+     */
+    tunnel_id: string;
+  }
+
+  export interface RekeyReset {
+    /**
+     * Deleted all keys after receiving an unexpected key
+     */
+    k: 'RekeyReset';
+
+    /**
+     * Tunnel identifier
+     */
+    tunnel_id: string;
+  }
 }
 
 export interface EventListParams {

package/src/resources/magic-transit/connectors/events/latest.ts

@@ -58,7 +58,12 @@ export namespace LatestListResponse {
       | Item.FinishUpgradeSuccess
       | Item.FinishUpgradeFailure
       | Item.Reconcile
-      | Item.ConfigureCloudflaredTunnel;
+      | Item.ConfigureCloudflaredTunnel
+      | Item.RekeyInstallBoth
+      | Item.RekeyStart
+      | Item.RekeyAdvance
+      | Item.RekeyComplete
+      | Item.RekeyReset;
 
     /**
      * Sequence number, used to order events with the same timestamp
@@ -193,6 +198,66 @@ export namespace LatestListResponse {
        */
       k: 'ConfigureCloudflaredTunnel';
     }
+
+    export interface RekeyInstallBoth {
+      /**
+       * Installed initial inbound and outbound keys
+       */
+      k: 'RekeyInstallBoth';
+
+      /**
+       * Tunnel identifier
+       */
+      tunnel_id: string;
+    }
+
+    export interface RekeyStart {
+      /**
+       * Installed new inbound key, kept old outbound
+       */
+      k: 'RekeyStart';
+
+      /**
+       * Tunnel identifier
+       */
+      tunnel_id: string;
+    }
+
+    export interface RekeyAdvance {
+      /**
+       * Confirmed traffic on new inbound key, swapped outbound to new
+       */
+      k: 'RekeyAdvance';
+
+      /**
+       * Tunnel identifier
+       */
+      tunnel_id: string;
+    }
+
+    export interface RekeyComplete {
+      /**
+       * Deleted old keys
+       */
+      k: 'RekeyComplete';
+
+      /**
+       * Tunnel identifier
+       */
+      tunnel_id: string;
+    }
+
+    export interface RekeyReset {
+      /**
+       * Deleted all keys after receiving an unexpected key
+       */
+      k: 'RekeyReset';
+
+      /**
+       * Tunnel identifier
+       */
+      tunnel_id: string;
+    }
   }
 }
 

package/src/resources/magic-transit/ipsec-tunnels.ts

@@ -207,10 +207,10 @@ export class IPSECTunnels extends APIResource {
   }
 
   /**
-   * Generates a Pre Shared Key for a specific IPsec tunnel used in the IKE session.
+   * Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session.
    * Use `?validate_only=true` as an optional query parameter to only run validation
    * without persisting changes. After a PSK is generated, the PSK is immediately
-   * persisted to Cloudflare's edge and cannot be retrieved later. Note the PSK in a
+   * persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a
    * safe place.
    *
    * @example

package/src/resources/managed-transforms/managed-transforms.ts

@@ -207,12 +207,12 @@ export interface ManagedTransformEditParams {
   /**
    * Body param: The list of Managed Request Transforms.
    */
-  managed_request_headers: Array<ManagedTransformEditParams.ManagedRequestHeader>;
+  managed_request_headers?: Array<ManagedTransformEditParams.ManagedRequestHeader>;
 
   /**
    * Body param: The list of Managed Response Transforms.
    */
-  managed_response_headers: Array<ManagedTransformEditParams.ManagedResponseHeader>;
+  managed_response_headers?: Array<ManagedTransformEditParams.ManagedResponseHeader>;
 }
 
 export namespace ManagedTransformEditParams {

package/src/resources/organizations/api.md

@@ -22,7 +22,7 @@ Types:
 Methods:
 
 - <code title="put /organizations/{organization_id}/profile">client.organizations.organizationProfile.<a href="./src/resources/organizations/organization-profile.ts">update</a>(organizationId, { ...params }) -> void</code>
-- <code title="get /organizations/{organization_id}/profile">client.organizations.organizationProfile.<a href="./src/resources/organizations/organization-profile.ts">get</a>(organizationId) -> organizations_api_ProfileResponse.Result</code>
+- <code title="get /organizations/{organization_id}/profile">client.organizations.organizationProfile.<a href="./src/resources/organizations/organization-profile.ts">get</a>(organizationId) -> OrganizationProfile</code>
 
 ## Logs
 

package/src/resources/organizations/organization-profile.ts

@@ -45,6 +45,18 @@ export interface OrganizationProfile {
   external_metadata: string;
 }
 
+export interface OrganizationProfileParam {
+  business_address: string;
+
+  business_email: string;
+
+  business_name: string;
+
+  business_phone: string;
+
+  external_metadata: string;
+}
+
 export interface OrganizationProfileUpdateParams {
   business_address: string;
 

package/src/resources/organizations/organizations.ts

@@ -70,6 +70,8 @@ export class Organizations extends APIResource {
    * Delete an organization. The organization MUST be empty before deleting. It must
    * not contain any sub-organizations, accounts, members or users. (Currently in
    * Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
+   *
+   * **Access Control:** Restricted to enterprise organizations.
    */
   delete(organizationId: string, options?: Core.RequestOptions): Core.APIPromise<OrganizationDeleteResponse> {
     return (
@@ -108,7 +110,7 @@ export interface Organization {
 
   parent?: Organization.Parent;
 
-  profile?: Organization.Profile;
+  profile?: OrganizationProfileAPI.OrganizationProfile;
 }
 
 export namespace Organization {
@@ -118,6 +120,15 @@ export namespace Organization {
      */
     flags?: Meta.Flags;
 
+    /**
+     * Ordered chain of organization tags from the root organization down to (and
+     * including) this organization itself. Root organizations return a single-element
+     * array containing their own tag; sub-organizations return
+     * `[rootTag, ...intermediateTags, parentTag, selfTag]`. Useful for constructing
+     * authorization scopes that need to cover every ancestor in the hierarchy.
+     */
+    hierarchy_tags?: Array<string>;
+
     managed_by?: string;
 
     [k: string]: unknown;
@@ -145,18 +156,6 @@ export namespace Organization {
 
     name: string;
   }
-
-  export interface Profile {
-    business_address: string;
-
-    business_email: string;
-
-    business_name: string;
-
-    business_phone: string;
-
-    external_metadata: string;
-  }
 }
 
 export interface OrganizationDeleteResponse {
@@ -168,25 +167,13 @@ export interface OrganizationCreateParams {
 
   parent?: OrganizationCreateParams.Parent;
 
-  profile?: OrganizationCreateParams.Profile;
+  profile?: OrganizationProfileAPI.OrganizationProfileParam;
 }
 
 export namespace OrganizationCreateParams {
   export interface Parent {
     id: string;
   }
-
-  export interface Profile {
-    business_address: string;
-
-    business_email: string;
-
-    business_name: string;
-
-    business_phone: string;
-
-    external_metadata: string;
-  }
 }
 
 export interface OrganizationUpdateParams {
@@ -194,25 +181,13 @@ export interface OrganizationUpdateParams {
 
   parent?: OrganizationUpdateParams.Parent;
 
-  profile?: OrganizationUpdateParams.Profile;
+  profile?: OrganizationProfileAPI.OrganizationProfileParam;
 }
 
 export namespace OrganizationUpdateParams {
   export interface Parent {
     id: string;
   }
-
-  export interface Profile {
-    business_address: string;
-
-    business_email: string;
-
-    business_name: string;
-
-    business_phone: string;
-
-    external_metadata: string;
-  }
 }
 
 export interface OrganizationListParams {

package/src/resources/origin-ca-certificates/origin-ca-certificates.ts

@@ -208,7 +208,7 @@ export interface OriginCACertificateListParams extends V4PagePaginationArrayPara
   limit?: number;
 
   /**
-   * Offset the results
+   * Offset the results.
    */
   offset?: number;
 }

package/src/resources/origin-tls-compliance-modes/api.md

@@ -0,0 +1 @@
+# OriginTLSComplianceModes

package/src/resources/origin-tls-compliance-modes/index.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export { OriginTLSComplianceModes } from './origin-tls-compliance-modes';

package/src/resources/origin-tls-compliance-modes/origin-tls-compliance-modes.ts

@@ -0,0 +1,5 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../resource';
+
+export class OriginTLSComplianceModes extends APIResource {}

package/src/resources/origin-tls-compliance-modes.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './origin-tls-compliance-modes/index';

package/src/resources/pipelines/pipelines.ts

@@ -1406,6 +1406,11 @@ export interface PipelineListV1Params extends V4PagePaginationArrayParams {
    * Path param: Specifies the public ID of the account.
    */
   account_id: string;
+
+  /**
+   * Query param: Filters pipelines by name (case-insensitive substring).
+   */
+  name?: string;
 }
 
 export interface PipelineValidateSqlParams {

package/src/resources/pipelines/sinks.ts

@@ -1546,6 +1546,11 @@ export interface SinkListParams extends V4PagePaginationArrayParams {
    */
   account_id: string;
 
+  /**
+   * Query param: Filters sinks by name (case-insensitive substring).
+   */
+  name?: string;
+
   /**
    * Query param
    */