cloudflare 6.3.0 → 6.4.0

package/src/resources/zero-trust/access/access.ts

@@ -53,6 +53,17 @@ import {
   Groups,
   ZeroTrustGroup,
 } from './groups';
+import * as IdPFederationGrantsAPI from './idp-federation-grants';
+import {
+  IdPFederationGrant,
+  IdPFederationGrantCreateParams,
+  IdPFederationGrantDeleteParams,
+  IdPFederationGrantDeleteResponse,
+  IdPFederationGrantGetParams,
+  IdPFederationGrantListParams,
+  IdPFederationGrantListResponse,
+  IdPFederationGrants,
+} from './idp-federation-grants';
 import * as KeysAPI from './keys';
 import {
   KeyGetParams,
@@ -194,6 +205,8 @@ import {
 export class Access extends APIResource {
   aiControls: AIControlsAPI.AIControls = new AIControlsAPI.AIControls(this._client);
   gatewayCA: GatewayCAAPI.GatewayCA = new GatewayCAAPI.GatewayCA(this._client);
+  IdPFederationGrants: IdPFederationGrantsAPI.IdPFederationGrants =
+    new IdPFederationGrantsAPI.IdPFederationGrants(this._client);
   samlCertificates: SAMLCertificatesAPI.SAMLCertificates = new SAMLCertificatesAPI.SAMLCertificates(
     this._client,
   );
@@ -214,6 +227,7 @@ export class Access extends APIResource {
 Access.AIControls = AIControls;
 Access.GatewayCA = GatewayCA;
 Access.GatewayCAListResponsesSinglePage = GatewayCAListResponsesSinglePage;
+Access.IdPFederationGrants = IdPFederationGrants;
 Access.SAMLCertificates = SAMLCertificates;
 Access.SAMLCertificateListResponsesV4PagePaginationArray = SAMLCertificateListResponsesV4PagePaginationArray;
 Access.Infrastructure = Infrastructure;
@@ -252,6 +266,17 @@ export declare namespace Access {
     type GatewayCADeleteParams as GatewayCADeleteParams,
   };
 
+  export {
+    IdPFederationGrants as IdPFederationGrants,
+    type IdPFederationGrant as IdPFederationGrant,
+    type IdPFederationGrantListResponse as IdPFederationGrantListResponse,
+    type IdPFederationGrantDeleteResponse as IdPFederationGrantDeleteResponse,
+    type IdPFederationGrantCreateParams as IdPFederationGrantCreateParams,
+    type IdPFederationGrantListParams as IdPFederationGrantListParams,
+    type IdPFederationGrantDeleteParams as IdPFederationGrantDeleteParams,
+    type IdPFederationGrantGetParams as IdPFederationGrantGetParams,
+  };
+
   export {
     SAMLCertificates as SAMLCertificates,
     type SAMLCertificateListResponse as SAMLCertificateListResponse,

package/src/resources/zero-trust/access/ai-controls/mcp/portals.ts

@@ -202,9 +202,9 @@ export namespace PortalCreateResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. New public server creates default to true; existing
+     * servers default to false from migration until explicitly updated. Effective
+     * behavior is gated by the gateway worker's per-env rollout mode KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -218,6 +218,11 @@ export namespace PortalCreateResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -256,14 +261,6 @@ export namespace PortalCreateResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -278,14 +275,6 @@ export namespace PortalCreateResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -364,9 +353,9 @@ export namespace PortalUpdateResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. New public server creates default to true; existing
+     * servers default to false from migration until explicitly updated. Effective
+     * behavior is gated by the gateway worker's per-env rollout mode KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -380,6 +369,11 @@ export namespace PortalUpdateResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -418,14 +412,6 @@ export namespace PortalUpdateResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -440,14 +426,6 @@ export namespace PortalUpdateResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -526,9 +504,9 @@ export namespace PortalListResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. New public server creates default to true; existing
+     * servers default to false from migration until explicitly updated. Effective
+     * behavior is gated by the gateway worker's per-env rollout mode KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -542,6 +520,11 @@ export namespace PortalListResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -580,14 +563,6 @@ export namespace PortalListResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -602,14 +577,6 @@ export namespace PortalListResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -719,9 +686,9 @@ export namespace PortalReadResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. New public server creates default to true; existing
+     * servers default to false from migration until explicitly updated. Effective
+     * behavior is gated by the gateway worker's per-env rollout mode KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -735,6 +702,11 @@ export namespace PortalReadResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -773,14 +745,6 @@ export namespace PortalReadResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -795,14 +759,6 @@ export namespace PortalReadResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -867,8 +823,6 @@ export namespace PortalCreateParams {
 
     default_disabled?: boolean;
 
-    is_shared_oauth_callback_enabled?: boolean;
-
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -945,8 +899,6 @@ export namespace PortalUpdateParams {
 
     default_disabled?: boolean;
 
-    is_shared_oauth_callback_enabled?: boolean;
-
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;

package/src/resources/zero-trust/access/ai-controls/mcp/servers.ts

@@ -194,9 +194,9 @@ export interface ServerCreateResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -208,6 +208,11 @@ export interface ServerCreateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerCreateResponse.UpdatedPrompt>;
@@ -293,9 +298,9 @@ export interface ServerUpdateResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -307,6 +312,11 @@ export interface ServerUpdateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerUpdateResponse.UpdatedPrompt>;
@@ -392,9 +402,9 @@ export interface ServerListResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -406,6 +416,11 @@ export interface ServerListResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerListResponse.UpdatedPrompt>;
@@ -491,9 +506,9 @@ export interface ServerDeleteResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -505,6 +520,11 @@ export interface ServerDeleteResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerDeleteResponse.UpdatedPrompt>;
@@ -590,9 +610,9 @@ export interface ServerReadResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. New public server creates default to true; existing
+   * servers default to false from migration until explicitly updated. Effective
+   * behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -604,6 +624,11 @@ export interface ServerReadResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerReadResponse.UpdatedPrompt>;
@@ -736,12 +761,18 @@ export interface ServerCreateParams {
   /**
    * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
    * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
-   * the customer portal hostname. New servers default to true; existing servers
-   * default to false. Effective behavior is gated by the gateway worker's per-env
-   * rollout mode KV key.
+   * the customer portal hostname. New public server creates default to true;
+   * existing servers default to false from migration until explicitly updated.
+   * Effective behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */
@@ -794,9 +825,9 @@ export interface ServerUpdateParams {
   /**
    * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
    * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
-   * the customer portal hostname. New servers default to true; existing servers
-   * default to false. Effective behavior is gated by the gateway worker's per-env
-   * rollout mode KV key.
+   * the customer portal hostname. New public server creates default to true;
+   * existing servers default to false from migration until explicitly updated.
+   * Effective behavior is gated by the gateway worker's per-env rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -805,6 +836,12 @@ export interface ServerUpdateParams {
    */
   name?: string;
 
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */

package/src/resources/zero-trust/access/idp-federation-grants.ts

@@ -0,0 +1,185 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../resource';
+import * as Core from '../../../core';
+
+export class IdPFederationGrants extends APIResource {
+  /**
+   * Creates an IdP federation grant for the specified identity provider, making it
+   * available for federation to other accounts in the same Cloudflare organization.
+   *
+   * The account must belong to a Cloudflare organization. One-time pin and
+   * Cloudflare-managed identity providers cannot be federated. An identity provider
+   * may only have one active grant at a time.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.create({
+   *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *     idp_id: 'a79de439-0e7f-4ebb-8a02-222222222222',
+   *   });
+   * ```
+   */
+  create(
+    params: IdPFederationGrantCreateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrant> {
+    const { account_id, ...body } = params;
+    return (
+      this._client.post(`/accounts/${account_id}/access/idp_federation_grants`, {
+        body,
+        ...options,
+      }) as Core.APIPromise<{ result: IdPFederationGrant }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Lists the IdP federation grants owned by the account.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrants =
+   *   await client.zeroTrust.access.IdPFederationGrants.list({
+   *     account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *   });
+   * ```
+   */
+  list(
+    params: IdPFederationGrantListParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrantListResponse> {
+    const { account_id } = params;
+    return (
+      this._client.get(`/accounts/${account_id}/access/idp_federation_grants`, options) as Core.APIPromise<{
+        result: IdPFederationGrantListResponse;
+      }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Deletes an IdP federation grant. The identity provider remains in the account,
+   * but it is no longer available for federation to other accounts.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.delete(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  delete(
+    grantId: string,
+    params: IdPFederationGrantDeleteParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrantDeleteResponse> {
+    const { account_id } = params;
+    return (
+      this._client.delete(
+        `/accounts/${account_id}/access/idp_federation_grants/${grantId}`,
+        options,
+      ) as Core.APIPromise<{ result: IdPFederationGrantDeleteResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Retrieves a single IdP federation grant by its UID.
+   *
+   * @example
+   * ```ts
+   * const IdPFederationGrant =
+   *   await client.zeroTrust.access.IdPFederationGrants.get(
+   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  get(
+    grantId: string,
+    params: IdPFederationGrantGetParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<IdPFederationGrant> {
+    const { account_id } = params;
+    return (
+      this._client.get(
+        `/accounts/${account_id}/access/idp_federation_grants/${grantId}`,
+        options,
+      ) as Core.APIPromise<{ result: IdPFederationGrant }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export interface IdPFederationGrant {
+  /**
+   * UID of the IdP federation grant.
+   */
+  id: string;
+
+  /**
+   * When the grant was created.
+   */
+  created_at: string;
+
+  /**
+   * UID of the identity provider being federated.
+   */
+  idp_id: string;
+}
+
+export type IdPFederationGrantListResponse = Array<IdPFederationGrant>;
+
+export interface IdPFederationGrantDeleteResponse {
+  /**
+   * UID of the deleted IdP federation grant.
+   */
+  id?: string;
+}
+
+export interface IdPFederationGrantCreateParams {
+  /**
+   * Path param: Identifier.
+   */
+  account_id: string;
+
+  /**
+   * Body param: UID of the identity provider to federate. Must be an existing
+   * identity provider in this account. One-time pin and Cloudflare-managed identity
+   * providers cannot be federated.
+   */
+  idp_id: string;
+}
+
+export interface IdPFederationGrantListParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface IdPFederationGrantDeleteParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export interface IdPFederationGrantGetParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export declare namespace IdPFederationGrants {
+  export {
+    type IdPFederationGrant as IdPFederationGrant,
+    type IdPFederationGrantListResponse as IdPFederationGrantListResponse,
+    type IdPFederationGrantDeleteResponse as IdPFederationGrantDeleteResponse,
+    type IdPFederationGrantCreateParams as IdPFederationGrantCreateParams,
+    type IdPFederationGrantListParams as IdPFederationGrantListParams,
+    type IdPFederationGrantDeleteParams as IdPFederationGrantDeleteParams,
+    type IdPFederationGrantGetParams as IdPFederationGrantGetParams,
+  };
+}

package/src/resources/zero-trust/access/index.ts

@@ -98,6 +98,16 @@ export {
   type GatewayCAListParams,
   type GatewayCADeleteParams,
 } from './gateway-ca';
+export {
+  IdPFederationGrants,
+  type IdPFederationGrant,
+  type IdPFederationGrantListResponse,
+  type IdPFederationGrantDeleteResponse,
+  type IdPFederationGrantCreateParams,
+  type IdPFederationGrantListParams,
+  type IdPFederationGrantDeleteParams,
+  type IdPFederationGrantGetParams,
+} from './idp-federation-grants';
 export { Infrastructure } from './infrastructure/index';
 export {
   Keys,