cloudflare 6.3.0 → 6.5.0

package/src/resources/zero-trust/access/access.ts

@@ -53,6 +53,17 @@ import {
   Groups,
   ZeroTrustGroup,
 } from './groups';
+import * as IdPFederationGrantsAPI from './idp-federation-grants';
+import {
+  IdPFederationGrant,
+  IdPFederationGrantCreateParams,
+  IdPFederationGrantDeleteParams,
+  IdPFederationGrantDeleteResponse,
+  IdPFederationGrantGetParams,
+  IdPFederationGrantListParams,
+  IdPFederationGrantListResponse,
+  IdPFederationGrants,
+} from './idp-federation-grants';
 import * as KeysAPI from './keys';
 import {
   KeyGetParams,
@@ -141,7 +152,6 @@ import {
   ApplicationPolicy,
   ApplicationRevokeTokensParams,
   ApplicationRevokeTokensResponse,
-  ApplicationSCIMConfig,
   ApplicationType,
   ApplicationUpdateParams,
   ApplicationUpdateResponse,
@@ -194,6 +204,8 @@ import {
 export class Access extends APIResource {
   aiControls: AIControlsAPI.AIControls = new AIControlsAPI.AIControls(this._client);
   gatewayCA: GatewayCAAPI.GatewayCA = new GatewayCAAPI.GatewayCA(this._client);
+  IdPFederationGrants: IdPFederationGrantsAPI.IdPFederationGrants =
+    new IdPFederationGrantsAPI.IdPFederationGrants(this._client);
   samlCertificates: SAMLCertificatesAPI.SAMLCertificates = new SAMLCertificatesAPI.SAMLCertificates(
     this._client,
   );
@@ -214,6 +226,7 @@ export class Access extends APIResource {
 Access.AIControls = AIControls;
 Access.GatewayCA = GatewayCA;
 Access.GatewayCAListResponsesSinglePage = GatewayCAListResponsesSinglePage;
+Access.IdPFederationGrants = IdPFederationGrants;
 Access.SAMLCertificates = SAMLCertificates;
 Access.SAMLCertificateListResponsesV4PagePaginationArray = SAMLCertificateListResponsesV4PagePaginationArray;
 Access.Infrastructure = Infrastructure;
@@ -252,6 +265,17 @@ export declare namespace Access {
     type GatewayCADeleteParams as GatewayCADeleteParams,
   };
 
+  export {
+    IdPFederationGrants as IdPFederationGrants,
+    type IdPFederationGrant as IdPFederationGrant,
+    type IdPFederationGrantListResponse as IdPFederationGrantListResponse,
+    type IdPFederationGrantDeleteResponse as IdPFederationGrantDeleteResponse,
+    type IdPFederationGrantCreateParams as IdPFederationGrantCreateParams,
+    type IdPFederationGrantListParams as IdPFederationGrantListParams,
+    type IdPFederationGrantDeleteParams as IdPFederationGrantDeleteParams,
+    type IdPFederationGrantGetParams as IdPFederationGrantGetParams,
+  };
+
   export {
     SAMLCertificates as SAMLCertificates,
     type SAMLCertificateListResponse as SAMLCertificateListResponse,
@@ -275,7 +299,6 @@ export declare namespace Access {
     type AppID as AppID,
     type Application as Application,
     type ApplicationPolicy as ApplicationPolicy,
-    type ApplicationSCIMConfig as ApplicationSCIMConfig,
     type ApplicationType as ApplicationType,
     type CORSHeaders as CORSHeaders,
     type Decision as Decision,

package/src/resources/zero-trust/access/ai-controls/mcp/portals.ts

@@ -202,9 +202,9 @@ export namespace PortalCreateResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. Defaults to false (off); opt in per server by setting
+     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+     * KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -218,6 +218,11 @@ export namespace PortalCreateResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -256,14 +261,6 @@ export namespace PortalCreateResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -278,14 +275,6 @@ export namespace PortalCreateResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -364,9 +353,9 @@ export namespace PortalUpdateResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. Defaults to false (off); opt in per server by setting
+     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+     * KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -380,6 +369,11 @@ export namespace PortalUpdateResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -418,14 +412,6 @@ export namespace PortalUpdateResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -440,14 +426,6 @@ export namespace PortalUpdateResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -526,9 +504,9 @@ export namespace PortalListResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. Defaults to false (off); opt in per server by setting
+     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+     * KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -542,6 +520,11 @@ export namespace PortalListResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -580,14 +563,6 @@ export namespace PortalListResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -602,14 +577,6 @@ export namespace PortalListResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -719,9 +686,9 @@ export namespace PortalReadResponse {
     /**
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-     * customer portal hostname. New servers default to true; existing servers default
-     * to false. Effective behavior is gated by the gateway worker's per-env rollout
-     * mode KV key.
+     * customer portal hostname. Defaults to false (off); opt in per server by setting
+     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+     * KV key.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -735,6 +702,11 @@ export namespace PortalReadResponse {
 
     on_behalf?: boolean;
 
+    /**
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     */
+    secure_web_gateway?: boolean;
+
     status?: string;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -773,14 +745,6 @@ export namespace PortalReadResponse {
     export interface UpdatedPrompt {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -795,14 +759,6 @@ export namespace PortalReadResponse {
     export interface UpdatedTool {
       name: string;
 
-      /**
-       * @deprecated Deprecated: use `portal_description` or `server_description`
-       * instead. Populated for backward compatibility — portal-level wins when present,
-       * otherwise falls back to server-level. Will be removed after the deprecation
-       * window.
-       */
-      description?: string;
-
       enabled?: boolean;
 
       portal_alias?: string;
@@ -867,8 +823,6 @@ export namespace PortalCreateParams {
 
     default_disabled?: boolean;
 
-    is_shared_oauth_callback_enabled?: boolean;
-
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
@@ -945,8 +899,6 @@ export namespace PortalUpdateParams {
 
     default_disabled?: boolean;
 
-    is_shared_oauth_callback_enabled?: boolean;
-
     on_behalf?: boolean;
 
     updated_prompts?: Array<Server.UpdatedPrompt>;

package/src/resources/zero-trust/access/ai-controls/mcp/servers.ts

@@ -194,9 +194,9 @@ export interface ServerCreateResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. Defaults to false (off); opt in per server by setting
+   * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+   * KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -208,6 +208,11 @@ export interface ServerCreateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerCreateResponse.UpdatedPrompt>;
@@ -293,9 +298,9 @@ export interface ServerUpdateResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. Defaults to false (off); opt in per server by setting
+   * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+   * KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -307,6 +312,11 @@ export interface ServerUpdateResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerUpdateResponse.UpdatedPrompt>;
@@ -392,9 +402,9 @@ export interface ServerListResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. Defaults to false (off); opt in per server by setting
+   * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+   * KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -406,6 +416,11 @@ export interface ServerListResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerListResponse.UpdatedPrompt>;
@@ -491,9 +506,9 @@ export interface ServerDeleteResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. Defaults to false (off); opt in per server by setting
+   * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+   * KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -505,6 +520,11 @@ export interface ServerDeleteResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerDeleteResponse.UpdatedPrompt>;
@@ -590,9 +610,9 @@ export interface ServerReadResponse {
   /**
    * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
    * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
-   * customer portal hostname. New servers default to true; existing servers default
-   * to false. Effective behavior is gated by the gateway worker's per-env rollout
-   * mode KV key.
+   * customer portal hostname. Defaults to false (off); opt in per server by setting
+   * true. Effective behavior is gated by the gateway worker's per-env rollout mode
+   * KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
@@ -604,6 +624,11 @@ export interface ServerReadResponse {
 
   modified_by?: string;
 
+  /**
+   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   status?: string;
 
   updated_prompts?: Array<ServerReadResponse.UpdatedPrompt>;
@@ -736,12 +761,18 @@ export interface ServerCreateParams {
   /**
    * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
    * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
-   * the customer portal hostname. New servers default to true; existing servers
-   * default to false. Effective behavior is gated by the gateway worker's per-env
+   * the customer portal hostname. Defaults to false (off); opt in per server by
+   * setting true. Effective behavior is gated by the gateway worker's per-env
    * rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
 
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */
@@ -794,8 +825,8 @@ export interface ServerUpdateParams {
   /**
    * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
    * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
-   * the customer portal hostname. New servers default to true; existing servers
-   * default to false. Effective behavior is gated by the gateway worker's per-env
+   * the customer portal hostname. Defaults to false (off); opt in per server by
+   * setting true. Effective behavior is gated by the gateway worker's per-env
    * rollout mode KV key.
    */
   is_shared_oauth_callback_enabled?: boolean;
@@ -805,6 +836,12 @@ export interface ServerUpdateParams {
    */
   name?: string;
 
+  /**
+   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
+   * Web Gateway
+   */
+  secure_web_gateway?: boolean;
+
   /**
    * Body param
    */