cloudflare 6.3.0 → 6.4.0

package/src/resources/zero-trust/identity-providers/identity-providers.ts

@@ -293,6 +293,12 @@ export interface AzureAD {
    */
   id?: string;
 
+  /**
+   * Indicates that the identity provider is immutable and cannot be updated or
+   * deleted via the API.
+   */
+  read_only?: boolean;
+
   /**
    * The SAML encryption certificate set details, including current and previous
    * certificates. Only present for SAML identity providers with a certificate set
@@ -591,6 +597,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -739,6 +751,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -850,6 +868,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -961,6 +985,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1099,6 +1129,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1242,6 +1278,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1353,6 +1395,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1516,6 +1564,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1664,6 +1718,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1807,6 +1867,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -1950,6 +2016,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -2136,6 +2208,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -2247,6 +2325,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -2367,6 +2451,12 @@ export namespace IdentityProvider {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -3513,6 +3603,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -3661,6 +3757,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -3772,6 +3874,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -3883,6 +3991,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4021,6 +4135,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4164,6 +4284,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4275,6 +4401,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4438,6 +4570,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4586,6 +4724,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4729,6 +4873,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -4872,6 +5022,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -5058,6 +5214,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -5169,6 +5331,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set
@@ -5289,6 +5457,12 @@ export namespace IdentityProviderListResponse {
      */
     id?: string;
 
+    /**
+     * Indicates that the identity provider is immutable and cannot be updated or
+     * deleted via the API.
+     */
+    read_only?: boolean;
+
     /**
      * The SAML encryption certificate set details, including current and previous
      * certificates. Only present for SAML identity providers with a certificate set

package/src/resources/zero-trust/networks/hostname-routes.ts

@@ -159,6 +159,11 @@ export interface HostnameRoute {
    */
   hostname?: string;
 
+  /**
+   * The type of tunnel.
+   */
+  tun_type?: 'cfd_tunnel' | 'warp_connector' | 'warp' | 'magic' | 'ip_sec' | 'gre' | 'cni';
+
   /**
    * UUID of the tunnel.
    */

package/src/resources/zero-trust/organizations/organizations.ts

@@ -281,7 +281,9 @@ export interface Organization {
   /**
    * Determines whether global MFA settings apply to applications by default. The
    * organization must have MFA enabled with at least one authentication method and a
-   * session duration configured.
+   * session duration configured. Note: 'allowed_authenticators' cannot only contain
+   * 'ssh_piv_key' if the organization has any non-infrastructure applications
+   * because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 
@@ -481,7 +483,9 @@ export interface OrganizationCreateParams {
   /**
    * Body param: Determines whether global MFA settings apply to applications by
    * default. The organization must have MFA enabled with at least one authentication
-   * method and a session duration configured.
+   * method and a session duration configured. Note: 'allowed_authenticators' cannot
+   * only contain 'ssh_piv_key' if the organization has any non-infrastructure
+   * applications because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 
@@ -663,7 +667,9 @@ export interface OrganizationUpdateParams {
   /**
    * Body param: Determines whether global MFA settings apply to applications by
    * default. The organization must have MFA enabled with at least one authentication
-   * method and a session duration configured.
+   * method and a session duration configured. Note: 'allowed_authenticators' cannot
+   * only contain 'ssh_piv_key' if the organization has any non-infrastructure
+   * applications because PIV keys are only compatible with infrastructure apps.
    */
   mfa_required_for_all_apps?: boolean;
 

package/src/resources/zero-trust/tunnels/warp-connector/configurations.ts

@@ -0,0 +1,293 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../resource';
+import * as Core from '../../../../core';
+
+export class Configurations extends APIResource {
+  /**
+   * Adds or updates the high-availability configuration for a WARP Connector tunnel.
+   *
+   * @example
+   * ```ts
+   * const configuration =
+   *   await client.zeroTrust.tunnels.warpConnector.configurations.update(
+   *     'f70ff985-a4ef-4643-bbbc-4a0ed4fc8415',
+   *     {
+   *       account_id: '023e105f4ecef8ad9ca31a8372d0c353',
+   *       ha_mode: 'aws',
+   *     },
+   *   );
+   * ```
+   */
+  update(
+    tunnelId: string,
+    params: ConfigurationUpdateParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<ConfigurationUpdateResponse> {
+    const { account_id, ...body } = params;
+    return (
+      this._client.put(`/accounts/${account_id}/warp_connector/${tunnelId}/configurations`, {
+        body,
+        ...options,
+      }) as Core.APIPromise<{ result: ConfigurationUpdateResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+
+  /**
+   * Gets the high-availability configuration for a WARP Connector tunnel.
+   *
+   * @example
+   * ```ts
+   * const configuration =
+   *   await client.zeroTrust.tunnels.warpConnector.configurations.get(
+   *     'f70ff985-a4ef-4643-bbbc-4a0ed4fc8415',
+   *     { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
+   *   );
+   * ```
+   */
+  get(
+    tunnelId: string,
+    params: ConfigurationGetParams,
+    options?: Core.RequestOptions,
+  ): Core.APIPromise<ConfigurationGetResponse> {
+    const { account_id } = params;
+    return (
+      this._client.get(
+        `/accounts/${account_id}/warp_connector/${tunnelId}/configurations`,
+        options,
+      ) as Core.APIPromise<{ result: ConfigurationGetResponse }>
+    )._thenUnwrap((obj) => obj.result);
+  }
+}
+
+export interface ConfigurationUpdateResponse {
+  /**
+   * Monotonically increasing configuration version, incremented on each PUT.
+   */
+  configuration_version: number;
+
+  /**
+   * Timestamp of when the resource was created.
+   */
+  created_at: string;
+
+  /**
+   * High-availability mode for the WARP Connector tunnel. `none` means HA is enabled
+   * but no provider is configured yet (newly created tunnels default to this).
+   * `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move for
+   * failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * UUID of the tunnel.
+   */
+  tunnel_id: string;
+
+  /**
+   * Provider-specific configuration. Present for `aws` and `local` modes.
+   */
+  config?:
+    | ConfigurationUpdateResponse.TunnelMeshAwsConfig
+    | ConfigurationUpdateResponse.TunnelMeshLocalConfig
+    | null;
+
+  /**
+   * Timestamp of the last update. Null if never updated.
+   */
+  updated_at?: string | null;
+}
+
+export namespace ConfigurationUpdateResponse {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationGetResponse {
+  /**
+   * Monotonically increasing configuration version, incremented on each PUT.
+   */
+  configuration_version: number;
+
+  /**
+   * Timestamp of when the resource was created.
+   */
+  created_at: string;
+
+  /**
+   * High-availability mode for the WARP Connector tunnel. `none` means HA is enabled
+   * but no provider is configured yet (newly created tunnels default to this).
+   * `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move for
+   * failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * UUID of the tunnel.
+   */
+  tunnel_id: string;
+
+  /**
+   * Provider-specific configuration. Present for `aws` and `local` modes.
+   */
+  config?:
+    | ConfigurationGetResponse.TunnelMeshAwsConfig
+    | ConfigurationGetResponse.TunnelMeshLocalConfig
+    | null;
+
+  /**
+   * Timestamp of the last update. Null if never updated.
+   */
+  updated_at?: string | null;
+}
+
+export namespace ConfigurationGetResponse {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationUpdateParams {
+  /**
+   * Path param: Identifier.
+   */
+  account_id: string;
+
+  /**
+   * Body param: High-availability mode for the WARP Connector tunnel. `none` means
+   * HA is enabled but no provider is configured yet (newly created tunnels default
+   * to this). `disabled` means HA is explicitly turned off. `aws` uses AWS ENI move
+   * for failover. `local` uses virtual IPs (VIPs) on the local interface.
+   */
+  ha_mode: 'none' | 'disabled' | 'aws' | 'local';
+
+  /**
+   * Body param: Provider-specific configuration. Required shape depends on ha_mode.
+   * For `aws`, must contain `fnr_id`. For `local`, must contain `vips`. For `none`
+   * and `disabled`, must be empty or omitted.
+   */
+  config?:
+    | ConfigurationUpdateParams.TunnelMeshAwsConfig
+    | ConfigurationUpdateParams.TunnelMeshLocalConfig
+    | unknown
+    | null;
+}
+
+export namespace ConfigurationUpdateParams {
+  export interface TunnelMeshAwsConfig {
+    /**
+     * Floating Network Resource ID — the secondary ENI that is moved between nodes on
+     * failover.
+     */
+    fnr_id: string;
+  }
+
+  export interface TunnelMeshLocalConfig {
+    /**
+     * VIPs to assign on the CloudflareWARP interface.
+     */
+    vips: Array<TunnelMeshLocalConfig.Vip>;
+
+    /**
+     * VIPs to clean up on demotion or version drift.
+     */
+    vips_previous?: Array<TunnelMeshLocalConfig.VipsPrevious>;
+  }
+
+  export namespace TunnelMeshLocalConfig {
+    export interface Vip {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+
+    export interface VipsPrevious {
+      /**
+       * Virtual IP address (IPv4 or IPv6).
+       */
+      address: string;
+    }
+  }
+}
+
+export interface ConfigurationGetParams {
+  /**
+   * Identifier.
+   */
+  account_id: string;
+}
+
+export declare namespace Configurations {
+  export {
+    type ConfigurationUpdateResponse as ConfigurationUpdateResponse,
+    type ConfigurationGetResponse as ConfigurationGetResponse,
+    type ConfigurationUpdateParams as ConfigurationUpdateParams,
+    type ConfigurationGetParams as ConfigurationGetParams,
+  };
+}