cloudflare 7.0.0 → 7.1.0

package/resources/zero-trust/access/applications/policies.d.mts

@@ -1,4 +1,5 @@
 import { APIResource } from "../../../../core/resource.mjs";
+import * as ApplicationsPoliciesAPI from "./policies.mjs";
 import * as PoliciesAPI from "../policies.mjs";
 import * as ApplicationsAPI from "./applications.mjs";
 import { APIPromise } from "../../../../core/api-promise.mjs";
@@ -34,6 +35,9 @@ export declare class BasePolicies extends APIResource {
      *     {
      *       app_id: 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
      *       account_id: 'account_id',
+     *       mfa_config: {
+     *         allowed_authenticators: ['ssh_fido2_key'],
+     *       },
      *     },
      *   );
      * ```
@@ -941,704 +945,1302 @@ export declare namespace ServiceTokenRuleParam {
         token_id: string;
     }
 }
-export interface PolicyCreateResponse {
-    /**
-     * The UUID of the policy
-     */
-    id?: string;
-    /**
-     * Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
-    /**
-     * Requires the user to request access from an administrator at the start of each
-     * session.
-     */
-    approval_required?: boolean;
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    connection_rules?: PolicyCreateResponse.ConnectionRules;
-    created_at?: string;
-    /**
-     * The action Access will take if a user matches this policy. Infrastructure
-     * application policies can only use the Allow action.
-     */
-    decision?: ApplicationsAPI.Decision;
-    /**
-     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-     * meet any of the Exclude rules.
-     */
-    exclude?: Array<AccessRule>;
-    /**
-     * Rules evaluated with an OR logical operator. A user needs to meet only one of
-     * the Include rules.
-     */
-    include?: Array<AccessRule>;
-    /**
-     * Require this application to be served in an isolated browser for users matching
-     * this policy. 'Client Web Isolation' must be on for the account in order to use
-     * this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyCreateResponse.MfaConfig;
-    /**
-     * The name of the Access policy.
-     */
-    name?: string;
-    /**
-     * The order of execution for this policy. Must be unique for each policy within an
-     * app.
-     */
-    precedence?: number;
-    /**
-     * A custom message that will appear on the purpose justification screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Require users to enter a justification when they log in to the application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Rules evaluated with an AND logical operator. To match the policy, a user must
-     * meet all of the Require rules.
-     */
-    require?: Array<AccessRule>;
-    /**
-     * The amount of time that tokens issued for the application will be valid. Must be
-     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-     * m, h.
-     */
-    session_duration?: string;
-    updated_at?: string;
-}
+export type PolicyCreateResponse = PolicyCreateResponse.UnionMember0 | PolicyCreateResponse.UnionMember1;
 export declare namespace PolicyCreateResponse {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+    interface UnionMember0 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * Identifier.
+         */
+        account_id?: string;
+        /**
+         * Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+        /**
+         * Requires the user to request access from an administrator at the start of each
+         * session.
+         */
+        approval_required?: boolean;
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember0.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Require this application to be served in an isolated browser for users matching
+         * this policy. 'Client Web Isolation' must be on for the account in order to use
+         * this feature.
+         */
+        isolation_required?: boolean;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Configures multi-factor authentication (MFA) settings.
          */
-        rdp?: ConnectionRules.RDP;
+        mfa_config?: UnionMember0.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * The order of execution for this policy. Must be unique for each policy within an
+         * app.
+         */
+        precedence?: number;
+        /**
+         * A custom message that will appear on the purpose justification screen.
+         */
+        purpose_justification_prompt?: string;
+        /**
+         * Require users to enter a justification when they log in to the application.
+         */
+        purpose_justification_required?: boolean;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * The amount of time that tokens issued for the application will be valid. Must be
+         * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+         * m, h.
+         */
+        session_duration?: string | null;
+        updated_at?: string;
     }
-    namespace ConnectionRules {
+    namespace UnionMember0 {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Configures multi-factor authentication (MFA) settings.
          */
-        interface RDP {
+        interface MfaConfig {
             /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
+             * Lists the MFA methods that users can authenticate with.
              */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
             /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
              */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+             */
+            session_duration?: string;
         }
     }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
+    interface UnionMember1 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
         /**
-         * Lists the MFA methods that users can authenticate with.
+         * The rules that define how users may connect to the targets secured by your
+         * application.
          */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+        connection_rules?: UnionMember1.ConnectionRules;
+        created_at?: string;
         /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
          */
-        mfa_disabled?: boolean;
+        decision?: ApplicationsAPI.Decision;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
          */
-        session_duration?: string;
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        mfa_config?: UnionMember1.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        updated_at?: string;
+    }
+    namespace UnionMember1 {
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+}
+export type PolicyUpdateResponse = PolicyUpdateResponse.UnionMember0 | PolicyUpdateResponse.UnionMember1;
+export declare namespace PolicyUpdateResponse {
+    interface UnionMember0 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * Identifier.
+         */
+        account_id?: string;
+        /**
+         * Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+        /**
+         * Requires the user to request access from an administrator at the start of each
+         * session.
+         */
+        approval_required?: boolean;
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember0.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Require this application to be served in an isolated browser for users matching
+         * this policy. 'Client Web Isolation' must be on for the account in order to use
+         * this feature.
+         */
+        isolation_required?: boolean;
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        mfa_config?: UnionMember0.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * The order of execution for this policy. Must be unique for each policy within an
+         * app.
+         */
+        precedence?: number;
+        /**
+         * A custom message that will appear on the purpose justification screen.
+         */
+        purpose_justification_prompt?: string;
+        /**
+         * Require users to enter a justification when they log in to the application.
+         */
+        purpose_justification_required?: boolean;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * The amount of time that tokens issued for the application will be valid. Must be
+         * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+         * m, h.
+         */
+        session_duration?: string | null;
+        updated_at?: string;
+    }
+    namespace UnionMember0 {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with.
+             */
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+    interface UnionMember1 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember1.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        mfa_config?: UnionMember1.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        updated_at?: string;
+    }
+    namespace UnionMember1 {
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+             */
+            session_duration?: string;
+        }
     }
 }
-export interface PolicyUpdateResponse {
+export type PolicyListResponse = PolicyListResponse.UnionMember0 | PolicyListResponse.UnionMember1;
+export declare namespace PolicyListResponse {
+    interface UnionMember0 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * Identifier.
+         */
+        account_id?: string;
+        /**
+         * Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+        /**
+         * Requires the user to request access from an administrator at the start of each
+         * session.
+         */
+        approval_required?: boolean;
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember0.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Require this application to be served in an isolated browser for users matching
+         * this policy. 'Client Web Isolation' must be on for the account in order to use
+         * this feature.
+         */
+        isolation_required?: boolean;
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        mfa_config?: UnionMember0.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * The order of execution for this policy. Must be unique for each policy within an
+         * app.
+         */
+        precedence?: number;
+        /**
+         * A custom message that will appear on the purpose justification screen.
+         */
+        purpose_justification_prompt?: string;
+        /**
+         * Require users to enter a justification when they log in to the application.
+         */
+        purpose_justification_required?: boolean;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * The amount of time that tokens issued for the application will be valid. Must be
+         * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+         * m, h.
+         */
+        session_duration?: string | null;
+        updated_at?: string;
+    }
+    namespace UnionMember0 {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with.
+             */
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+    interface UnionMember1 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember1.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        mfa_config?: UnionMember1.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        updated_at?: string;
+    }
+    namespace UnionMember1 {
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+}
+export interface PolicyDeleteResponse {
     /**
-     * The UUID of the policy
+     * UUID.
      */
     id?: string;
-    /**
-     * Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
-    /**
-     * Requires the user to request access from an administrator at the start of each
-     * session.
-     */
-    approval_required?: boolean;
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    connection_rules?: PolicyUpdateResponse.ConnectionRules;
-    created_at?: string;
-    /**
-     * The action Access will take if a user matches this policy. Infrastructure
-     * application policies can only use the Allow action.
-     */
-    decision?: ApplicationsAPI.Decision;
-    /**
-     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-     * meet any of the Exclude rules.
-     */
-    exclude?: Array<AccessRule>;
-    /**
-     * Rules evaluated with an OR logical operator. A user needs to meet only one of
-     * the Include rules.
-     */
-    include?: Array<AccessRule>;
-    /**
-     * Require this application to be served in an isolated browser for users matching
-     * this policy. 'Client Web Isolation' must be on for the account in order to use
-     * this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyUpdateResponse.MfaConfig;
-    /**
-     * The name of the Access policy.
-     */
-    name?: string;
-    /**
-     * The order of execution for this policy. Must be unique for each policy within an
-     * app.
-     */
-    precedence?: number;
-    /**
-     * A custom message that will appear on the purpose justification screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Require users to enter a justification when they log in to the application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Rules evaluated with an AND logical operator. To match the policy, a user must
-     * meet all of the Require rules.
-     */
-    require?: Array<AccessRule>;
-    /**
-     * The amount of time that tokens issued for the application will be valid. Must be
-     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-     * m, h.
-     */
-    session_duration?: string;
-    updated_at?: string;
 }
-export declare namespace PolicyUpdateResponse {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+export type PolicyGetResponse = PolicyGetResponse.UnionMember0 | PolicyGetResponse.UnionMember1;
+export declare namespace PolicyGetResponse {
+    interface UnionMember0 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * Identifier.
+         */
+        account_id?: string;
+        /**
+         * Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+        /**
+         * Requires the user to request access from an administrator at the start of each
+         * session.
+         */
+        approval_required?: boolean;
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember0.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Require this application to be served in an isolated browser for users matching
+         * this policy. 'Client Web Isolation' must be on for the account in order to use
+         * this feature.
+         */
+        isolation_required?: boolean;
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        mfa_config?: UnionMember0.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * The order of execution for this policy. Must be unique for each policy within an
+         * app.
+         */
+        precedence?: number;
+        /**
+         * A custom message that will appear on the purpose justification screen.
+         */
+        purpose_justification_prompt?: string;
+        /**
+         * Require users to enter a justification when they log in to the application.
+         */
+        purpose_justification_required?: boolean;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * The amount of time that tokens issued for the application will be valid. Must be
+         * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+         * m, h.
+         */
+        session_duration?: string | null;
+        updated_at?: string;
+    }
+    namespace UnionMember0 {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with.
+             */
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+    interface UnionMember1 {
+        /**
+         * The UUID of the policy
+         */
+        id?: string;
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        connection_rules?: UnionMember1.ConnectionRules;
+        created_at?: string;
+        /**
+         * The action Access will take if a user matches this policy. Infrastructure
+         * application policies can only use the Allow action.
+         */
+        decision?: ApplicationsAPI.Decision;
+        /**
+         * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+         * meet any of the Exclude rules.
+         */
+        exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Rules evaluated with an OR logical operator. A user needs to meet only one of
+         * the Include rules.
+         */
+        include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        mfa_config?: UnionMember1.MfaConfig;
+        /**
+         * The name of the Access policy.
+         */
+        name?: string;
+        /**
+         * Rules evaluated with an AND logical operator. To match the policy, a user must
+         * meet all of the Require rules.
+         */
+        require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+        updated_at?: string;
+    }
+    namespace UnionMember1 {
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
+        }
+        /**
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
+         */
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+             */
+            session_duration?: string;
+        }
+    }
+}
+export type PolicyCreateParams = PolicyCreateParams.AccessAppPolicyRequest | PolicyCreateParams.AccessInfraPolicyReq;
+export declare namespace PolicyCreateParams {
+    interface AccessAppPolicyRequest {
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+        /**
+         * Body param: Requires the user to request access from an administrator at the
+         * start of each session.
+         */
+        approval_required?: boolean;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: The rules that define how users may connect to targets secured by
+         * your application.
          */
-        rdp?: ConnectionRules.RDP;
-    }
-    namespace ConnectionRules {
+        connection_rules?: AccessAppPolicyRequest.ConnectionRules;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: Require this application to be served in an isolated browser for
+         * users matching this policy. 'Client Web Isolation' must be on for the account in
+         * order to use this feature.
          */
-        interface RDP {
-            /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
-             */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
-            /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
-             */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
-        }
-    }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
+        isolation_required?: boolean;
         /**
-         * Lists the MFA methods that users can authenticate with.
+         * Body param: Configures multi-factor authentication (MFA) settings.
          */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+        mfa_config?: AccessAppPolicyRequest.MfaConfig;
         /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
+         * Body param: The order of execution for this policy. Must be unique for each
+         * policy within an app.
          */
-        mfa_disabled?: boolean;
+        precedence?: number;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Body param: A custom message that will appear on the purpose justification
+         * screen.
          */
-        session_duration?: string;
-    }
-}
-export interface PolicyListResponse {
-    /**
-     * The UUID of the policy
-     */
-    id?: string;
-    /**
-     * Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
-    /**
-     * Requires the user to request access from an administrator at the start of each
-     * session.
-     */
-    approval_required?: boolean;
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    connection_rules?: PolicyListResponse.ConnectionRules;
-    created_at?: string;
-    /**
-     * The action Access will take if a user matches this policy. Infrastructure
-     * application policies can only use the Allow action.
-     */
-    decision?: ApplicationsAPI.Decision;
-    /**
-     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-     * meet any of the Exclude rules.
-     */
-    exclude?: Array<AccessRule>;
-    /**
-     * Rules evaluated with an OR logical operator. A user needs to meet only one of
-     * the Include rules.
-     */
-    include?: Array<AccessRule>;
-    /**
-     * Require this application to be served in an isolated browser for users matching
-     * this policy. 'Client Web Isolation' must be on for the account in order to use
-     * this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyListResponse.MfaConfig;
-    /**
-     * The name of the Access policy.
-     */
-    name?: string;
-    /**
-     * The order of execution for this policy. Must be unique for each policy within an
-     * app.
-     */
-    precedence?: number;
-    /**
-     * A custom message that will appear on the purpose justification screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Require users to enter a justification when they log in to the application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Rules evaluated with an AND logical operator. To match the policy, a user must
-     * meet all of the Require rules.
-     */
-    require?: Array<AccessRule>;
-    /**
-     * The amount of time that tokens issued for the application will be valid. Must be
-     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-     * m, h.
-     */
-    session_duration?: string;
-    updated_at?: string;
-}
-export declare namespace PolicyListResponse {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+        purpose_justification_prompt?: string;
+        /**
+         * Body param: Require users to enter a justification when they log in to the
+         * application.
+         */
+        purpose_justification_required?: boolean;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: The amount of time that tokens issued for the application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
          */
-        rdp?: ConnectionRules.RDP;
+        session_duration?: string | null;
     }
-    namespace ConnectionRules {
+    namespace AccessAppPolicyRequest {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Configures multi-factor authentication (MFA) settings.
          */
-        interface RDP {
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with.
+             */
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
             /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
              */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+            mfa_disabled?: boolean;
             /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
              */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+            session_duration?: string;
         }
     }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
+    interface AccessInfraPolicyReq {
         /**
-         * Lists the MFA methods that users can authenticate with.
+         * Body param: The action Access will take if a user matches this policy.
+         * Infrastructure application policies can only use the Allow action.
          */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+        decision: ApplicationsAPI.DecisionParam;
         /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
+         * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+         * only one of the Include rules.
          */
-        mfa_disabled?: boolean;
+        include: Array<AccessRuleParam>;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Body param: The name of the Access policy.
          */
-        session_duration?: string;
-    }
-}
-export interface PolicyDeleteResponse {
-    /**
-     * UUID.
-     */
-    id?: string;
-}
-export interface PolicyGetResponse {
-    /**
-     * The UUID of the policy
-     */
-    id?: string;
-    /**
-     * Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
-    /**
-     * Requires the user to request access from an administrator at the start of each
-     * session.
-     */
-    approval_required?: boolean;
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    connection_rules?: PolicyGetResponse.ConnectionRules;
-    created_at?: string;
-    /**
-     * The action Access will take if a user matches this policy. Infrastructure
-     * application policies can only use the Allow action.
-     */
-    decision?: ApplicationsAPI.Decision;
-    /**
-     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-     * meet any of the Exclude rules.
-     */
-    exclude?: Array<AccessRule>;
-    /**
-     * Rules evaluated with an OR logical operator. A user needs to meet only one of
-     * the Include rules.
-     */
-    include?: Array<AccessRule>;
-    /**
-     * Require this application to be served in an isolated browser for users matching
-     * this policy. 'Client Web Isolation' must be on for the account in order to use
-     * this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyGetResponse.MfaConfig;
-    /**
-     * The name of the Access policy.
-     */
-    name?: string;
-    /**
-     * The order of execution for this policy. Must be unique for each policy within an
-     * app.
-     */
-    precedence?: number;
-    /**
-     * A custom message that will appear on the purpose justification screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Require users to enter a justification when they log in to the application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Rules evaluated with an AND logical operator. To match the policy, a user must
-     * meet all of the Require rules.
-     */
-    require?: Array<AccessRule>;
-    /**
-     * The amount of time that tokens issued for the application will be valid. Must be
-     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-     * m, h.
-     */
-    session_duration?: string;
-    updated_at?: string;
-}
-export declare namespace PolicyGetResponse {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+        name: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The rules that define how users may connect to the targets secured
+         * by your application.
+         */
+        connection_rules?: AccessInfraPolicyReq.ConnectionRules;
+        /**
+         * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+         * user cannot meet any of the Exclude rules.
+         */
+        exclude?: Array<AccessRuleParam>;
+        /**
+         * Body param: Configures multi-factor authentication (MFA) settings for
+         * infrastructure applications.
+         */
+        mfa_config?: AccessInfraPolicyReq.MfaConfig;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+         * user must meet all of the Require rules.
          */
-        rdp?: ConnectionRules.RDP;
+        require?: Array<AccessRuleParam>;
     }
-    namespace ConnectionRules {
+    namespace AccessInfraPolicyReq {
+        /**
+         * The rules that define how users may connect to the targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
+            /**
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
+             */
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
+        }
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
          */
-        interface RDP {
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
             /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
              */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+            mfa_disabled?: boolean;
             /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
              */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+            session_duration?: string;
         }
     }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
+}
+export type PolicyUpdateParams = PolicyUpdateParams.AccessAppPolicyRequest | PolicyUpdateParams.AccessInfraPolicyReq;
+export declare namespace PolicyUpdateParams {
+    interface AccessAppPolicyRequest {
         /**
-         * Lists the MFA methods that users can authenticate with.
+         * Path param: UUID.
          */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+        app_id: string;
         /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
          */
-        mfa_disabled?: boolean;
+        account_id?: string;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
          */
-        session_duration?: string;
-    }
-}
-export interface PolicyCreateParams {
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
-    /**
-     * Body param: Requires the user to request access from an administrator at the
-     * start of each session.
-     */
-    approval_required?: boolean;
-    /**
-     * Body param: The rules that define how users may connect to targets secured by
-     * your application.
-     */
-    connection_rules?: PolicyCreateParams.ConnectionRules;
-    /**
-     * Body param: Require this application to be served in an isolated browser for
-     * users matching this policy. 'Client Web Isolation' must be on for the account in
-     * order to use this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Body param: Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyCreateParams.MfaConfig;
-    /**
-     * Body param: The order of execution for this policy. Must be unique for each
-     * policy within an app.
-     */
-    precedence?: number;
-    /**
-     * Body param: A custom message that will appear on the purpose justification
-     * screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Body param: Require users to enter a justification when they log in to the
-     * application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Body param: The amount of time that tokens issued for the application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
-     */
-    session_duration?: string;
-}
-export declare namespace PolicyCreateParams {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+        zone_id?: string;
+        /**
+         * Body param: Administrators who can approve a temporary authentication request.
+         */
+        approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+        /**
+         * Body param: Requires the user to request access from an administrator at the
+         * start of each session.
+         */
+        approval_required?: boolean;
+        /**
+         * Body param: The rules that define how users may connect to targets secured by
+         * your application.
+         */
+        connection_rules?: AccessAppPolicyRequest.ConnectionRules;
+        /**
+         * Body param: Require this application to be served in an isolated browser for
+         * users matching this policy. 'Client Web Isolation' must be on for the account in
+         * order to use this feature.
+         */
+        isolation_required?: boolean;
+        /**
+         * Body param: Configures multi-factor authentication (MFA) settings.
+         */
+        mfa_config?: AccessAppPolicyRequest.MfaConfig;
+        /**
+         * Body param: The order of execution for this policy. Must be unique for each
+         * policy within an app.
+         */
+        precedence?: number;
+        /**
+         * Body param: A custom message that will appear on the purpose justification
+         * screen.
+         */
+        purpose_justification_prompt?: string;
+        /**
+         * Body param: Require users to enter a justification when they log in to the
+         * application.
+         */
+        purpose_justification_required?: boolean;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: The amount of time that tokens issued for the application will be
+         * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+         * (or µs), ms, s, m, h.
          */
-        rdp?: ConnectionRules.RDP;
+        session_duration?: string | null;
     }
-    namespace ConnectionRules {
+    namespace AccessAppPolicyRequest {
+        /**
+         * The rules that define how users may connect to targets secured by your
+         * application.
+         */
+        interface ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            rdp?: ConnectionRules.RDP;
+        }
+        namespace ConnectionRules {
+            /**
+             * The RDP-specific rules that define clipboard behavior for RDP connections.
+             */
+            interface RDP {
+                /**
+                 * Clipboard formats allowed when copying from local machine to remote RDP session.
+                 */
+                allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+                /**
+                 * Clipboard formats allowed when copying from remote RDP session to local machine.
+                 */
+                allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+            }
+        }
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Configures multi-factor authentication (MFA) settings.
          */
-        interface RDP {
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with.
+             */
+            allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
             /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
              */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+            mfa_disabled?: boolean;
             /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
              */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+            session_duration?: string;
         }
     }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
+    interface AccessInfraPolicyReq {
         /**
-         * Lists the MFA methods that users can authenticate with.
+         * Path param: UUID.
          */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+        app_id: string;
         /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
+         * Body param: The action Access will take if a user matches this policy.
+         * Infrastructure application policies can only use the Allow action.
          */
-        mfa_disabled?: boolean;
+        decision: ApplicationsAPI.DecisionParam;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+         * only one of the Include rules.
          */
-        session_duration?: string;
-    }
-}
-export interface PolicyUpdateParams {
-    /**
-     * Path param: UUID.
-     */
-    app_id: string;
-    /**
-     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-     * Zone ID.
-     */
-    account_id?: string;
-    /**
-     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-     * Account ID.
-     */
-    zone_id?: string;
-    /**
-     * Body param: Administrators who can approve a temporary authentication request.
-     */
-    approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
-    /**
-     * Body param: Requires the user to request access from an administrator at the
-     * start of each session.
-     */
-    approval_required?: boolean;
-    /**
-     * Body param: The rules that define how users may connect to targets secured by
-     * your application.
-     */
-    connection_rules?: PolicyUpdateParams.ConnectionRules;
-    /**
-     * Body param: Require this application to be served in an isolated browser for
-     * users matching this policy. 'Client Web Isolation' must be on for the account in
-     * order to use this feature.
-     */
-    isolation_required?: boolean;
-    /**
-     * Body param: Configures multi-factor authentication (MFA) settings.
-     */
-    mfa_config?: PolicyUpdateParams.MfaConfig;
-    /**
-     * Body param: The order of execution for this policy. Must be unique for each
-     * policy within an app.
-     */
-    precedence?: number;
-    /**
-     * Body param: A custom message that will appear on the purpose justification
-     * screen.
-     */
-    purpose_justification_prompt?: string;
-    /**
-     * Body param: Require users to enter a justification when they log in to the
-     * application.
-     */
-    purpose_justification_required?: boolean;
-    /**
-     * Body param: The amount of time that tokens issued for the application will be
-     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-     * (or µs), ms, s, m, h.
-     */
-    session_duration?: string;
-}
-export declare namespace PolicyUpdateParams {
-    /**
-     * The rules that define how users may connect to targets secured by your
-     * application.
-     */
-    interface ConnectionRules {
+        include: Array<AccessRuleParam>;
+        /**
+         * Body param: The name of the Access policy.
+         */
+        name: string;
+        /**
+         * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+         * Zone ID.
+         */
+        account_id?: string;
+        /**
+         * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+         * Account ID.
+         */
+        zone_id?: string;
+        /**
+         * Body param: The rules that define how users may connect to the targets secured
+         * by your application.
+         */
+        connection_rules?: AccessInfraPolicyReq.ConnectionRules;
+        /**
+         * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+         * user cannot meet any of the Exclude rules.
+         */
+        exclude?: Array<AccessRuleParam>;
+        /**
+         * Body param: Configures multi-factor authentication (MFA) settings for
+         * infrastructure applications.
+         */
+        mfa_config?: AccessInfraPolicyReq.MfaConfig;
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+         * user must meet all of the Require rules.
          */
-        rdp?: ConnectionRules.RDP;
+        require?: Array<AccessRuleParam>;
     }
-    namespace ConnectionRules {
+    namespace AccessInfraPolicyReq {
         /**
-         * The RDP-specific rules that define clipboard behavior for RDP connections.
+         * The rules that define how users may connect to the targets secured by your
+         * application.
          */
-        interface RDP {
+        interface ConnectionRules {
             /**
-             * Clipboard formats allowed when copying from local machine to remote RDP session.
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
              */
-            allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+            ssh?: ConnectionRules.SSH;
+        }
+        namespace ConnectionRules {
             /**
-             * Clipboard formats allowed when copying from remote RDP session to local machine.
+             * The SSH-specific rules that define how users may connect to the targets secured
+             * by your application.
              */
-            allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+            interface SSH {
+                /**
+                 * Contains the Unix usernames that may be used when connecting over SSH.
+                 */
+                usernames: Array<string>;
+                /**
+                 * Enables using Identity Provider email alias as SSH username.
+                 */
+                allow_email_alias?: boolean;
+            }
         }
-    }
-    /**
-     * Configures multi-factor authentication (MFA) settings.
-     */
-    interface MfaConfig {
-        /**
-         * Lists the MFA methods that users can authenticate with.
-         */
-        allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
-        /**
-         * Indicates whether to disable MFA for this resource. This option is available at
-         * the application and policy level.
-         */
-        mfa_disabled?: boolean;
         /**
-         * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-         * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+         * Configures multi-factor authentication (MFA) settings for infrastructure
+         * applications.
          */
-        session_duration?: string;
+        interface MfaConfig {
+            /**
+             * Lists the MFA methods that users can authenticate with. For infrastructure
+             * applications, supported values are `piv_key` and `ssh_fido2_key`.
+             */
+            allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+            /**
+             * Indicates whether to disable MFA for this resource. This option is available at
+             * the application and policy level.
+             */
+            mfa_disabled?: boolean;
+            /**
+             * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+             * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+             */
+            session_duration?: string;
+        }
     }
 }
 export interface PolicyListParams extends V4PagePaginationArrayParams {