cloudflare 7.0.0 → 7.1.0

package/src/resources/zero-trust/access/ai-controls/mcp/portals.ts

@@ -24,7 +24,7 @@ export class BasePortals extends APIResource {
    *     {
    *       account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
    *       id: 'my-mcp-portal',
-   *       hostname: 'exmaple.com',
+   *       hostname: 'example.com',
    *       name: 'My MCP Portal',
    *     },
    *   );
@@ -110,7 +110,7 @@ export class BasePortals extends APIResource {
   }
 
   /**
-   * Read details of an MCP Portal
+   * Read the details of a single MCP Portal, including its configured servers.
    *
    * @example
    * ```ts
@@ -137,25 +137,47 @@ export type PortalListResponsesV4PagePaginationArray = V4PagePaginationArray<Por
 
 export interface PortalCreateResponse {
   /**
-   * portal id
+   * Unique identifier for the MCP portal.
    */
   id: string;
 
+  /**
+   * Hostname where the MCP portal is available.
+   */
   hostname: string;
 
+  /**
+   * Display name for the MCP portal.
+   */
   name: string;
 
   servers: Array<PortalCreateResponse.Server>;
 
   /**
-   * Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Deprecated: use `code_mode` for new integrations. `true` maps to any
+   * non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are
+   * sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
+  /**
+   * Code Mode policy for this portal. `off`: Code Mode is unavailable; query
+   * parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it
+   * on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
   created_at?: string;
 
   created_by?: string;
 
+  /**
+   * Optional description of the MCP portal.
+   */
   description?: string;
 
   modified_at?: string;
@@ -163,7 +185,7 @@ export interface PortalCreateResponse {
   modified_by?: string;
 
   /**
-   * Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 }
@@ -171,31 +193,57 @@ export interface PortalCreateResponse {
 export namespace PortalCreateResponse {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
 
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
 
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
 
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
 
     prompts: Array<{ [key: string]: unknown }>;
 
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
     tools: Array<{ [key: string]: unknown }>;
 
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: Server.AuthConfigSummary;
+
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
+
     created_at?: string;
 
     created_by?: string;
 
     default_disabled?: boolean;
 
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
 
     error?: string;
@@ -206,8 +254,7 @@ export namespace PortalCreateResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -222,11 +269,14 @@ export namespace PortalCreateResponse {
     on_behalf?: boolean;
 
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
 
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
@@ -234,6 +284,47 @@ export namespace PortalCreateResponse {
   }
 
   export namespace Server {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    export interface AuthConfigSummary {
+      auth_mode?: 'dcr' | 'manual';
+
+      client_secret_version?: number;
+
+      config?: AuthConfigSummary.Config;
+
+      has_client_secret?: boolean;
+
+      registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+
+    export namespace AuthConfigSummary {
+      export interface Config {
+        authorization_endpoint?: string;
+
+        issuer?: string;
+
+        resource?: string;
+
+        revocation_endpoint?: string;
+
+        token_endpoint?: string;
+      }
+
+      export interface RegistrationInfo {
+        client_id?: string;
+
+        redirect_uris?: Array<string>;
+
+        scope?: string;
+
+        token_endpoint_auth_method?: string;
+      }
+    }
+
     export interface ErrorDetails {
       /**
        * Underlying error message
@@ -293,25 +384,47 @@ export namespace PortalCreateResponse {
 
 export interface PortalUpdateResponse {
   /**
-   * portal id
+   * Unique identifier for the MCP portal.
    */
   id: string;
 
+  /**
+   * Hostname where the MCP portal is available.
+   */
   hostname: string;
 
+  /**
+   * Display name for the MCP portal.
+   */
   name: string;
 
   servers: Array<PortalUpdateResponse.Server>;
 
   /**
-   * Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Deprecated: use `code_mode` for new integrations. `true` maps to any
+   * non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are
+   * sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
+  /**
+   * Code Mode policy for this portal. `off`: Code Mode is unavailable; query
+   * parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it
+   * on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
   created_at?: string;
 
   created_by?: string;
 
+  /**
+   * Optional description of the MCP portal.
+   */
   description?: string;
 
   modified_at?: string;
@@ -319,7 +432,7 @@ export interface PortalUpdateResponse {
   modified_by?: string;
 
   /**
-   * Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 }
@@ -327,31 +440,57 @@ export interface PortalUpdateResponse {
 export namespace PortalUpdateResponse {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
 
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
 
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
 
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
 
     prompts: Array<{ [key: string]: unknown }>;
 
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
     tools: Array<{ [key: string]: unknown }>;
 
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: Server.AuthConfigSummary;
+
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
+
     created_at?: string;
 
     created_by?: string;
 
     default_disabled?: boolean;
 
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
 
     error?: string;
@@ -362,8 +501,7 @@ export namespace PortalUpdateResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -378,11 +516,14 @@ export namespace PortalUpdateResponse {
     on_behalf?: boolean;
 
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
 
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
@@ -390,6 +531,47 @@ export namespace PortalUpdateResponse {
   }
 
   export namespace Server {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    export interface AuthConfigSummary {
+      auth_mode?: 'dcr' | 'manual';
+
+      client_secret_version?: number;
+
+      config?: AuthConfigSummary.Config;
+
+      has_client_secret?: boolean;
+
+      registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+
+    export namespace AuthConfigSummary {
+      export interface Config {
+        authorization_endpoint?: string;
+
+        issuer?: string;
+
+        resource?: string;
+
+        revocation_endpoint?: string;
+
+        token_endpoint?: string;
+      }
+
+      export interface RegistrationInfo {
+        client_id?: string;
+
+        redirect_uris?: Array<string>;
+
+        scope?: string;
+
+        token_endpoint_auth_method?: string;
+      }
+    }
+
     export interface ErrorDetails {
       /**
        * Underlying error message
@@ -449,25 +631,47 @@ export namespace PortalUpdateResponse {
 
 export interface PortalListResponse {
   /**
-   * portal id
+   * Unique identifier for the MCP portal.
    */
   id: string;
 
+  /**
+   * Hostname where the MCP portal is available.
+   */
   hostname: string;
 
+  /**
+   * Display name for the MCP portal.
+   */
   name: string;
 
   servers: Array<PortalListResponse.Server>;
 
   /**
-   * Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Deprecated: use `code_mode` for new integrations. `true` maps to any
+   * non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are
+   * sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
+  /**
+   * Code Mode policy for this portal. `off`: Code Mode is unavailable; query
+   * parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it
+   * on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
   created_at?: string;
 
   created_by?: string;
 
+  /**
+   * Optional description of the MCP portal.
+   */
   description?: string;
 
   modified_at?: string;
@@ -475,7 +679,7 @@ export interface PortalListResponse {
   modified_by?: string;
 
   /**
-   * Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 }
@@ -483,31 +687,57 @@ export interface PortalListResponse {
 export namespace PortalListResponse {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
 
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
 
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
 
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
 
     prompts: Array<{ [key: string]: unknown }>;
 
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
     tools: Array<{ [key: string]: unknown }>;
 
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: Server.AuthConfigSummary;
+
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
+
     created_at?: string;
 
     created_by?: string;
 
     default_disabled?: boolean;
 
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
 
     error?: string;
@@ -518,8 +748,7 @@ export namespace PortalListResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -534,11 +763,14 @@ export namespace PortalListResponse {
     on_behalf?: boolean;
 
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
 
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
@@ -546,6 +778,47 @@ export namespace PortalListResponse {
   }
 
   export namespace Server {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    export interface AuthConfigSummary {
+      auth_mode?: 'dcr' | 'manual';
+
+      client_secret_version?: number;
+
+      config?: AuthConfigSummary.Config;
+
+      has_client_secret?: boolean;
+
+      registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+
+    export namespace AuthConfigSummary {
+      export interface Config {
+        authorization_endpoint?: string;
+
+        issuer?: string;
+
+        resource?: string;
+
+        revocation_endpoint?: string;
+
+        token_endpoint?: string;
+      }
+
+      export interface RegistrationInfo {
+        client_id?: string;
+
+        redirect_uris?: Array<string>;
+
+        scope?: string;
+
+        token_endpoint_auth_method?: string;
+      }
+    }
+
     export interface ErrorDetails {
       /**
        * Underlying error message
@@ -605,23 +878,45 @@ export namespace PortalListResponse {
 
 export interface PortalDeleteResponse {
   /**
-   * portal id
+   * Unique identifier for the MCP portal.
    */
   id: string;
 
+  /**
+   * Hostname where the MCP portal is available.
+   */
   hostname: string;
 
+  /**
+   * Display name for the MCP portal.
+   */
   name: string;
 
   /**
-   * Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Deprecated: use `code_mode` for new integrations. `true` maps to any
+   * non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are
+   * sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
+  /**
+   * Code Mode policy for this portal. `off`: Code Mode is unavailable; query
+   * parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it
+   * on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
   created_at?: string;
 
   created_by?: string;
 
+  /**
+   * Optional description of the MCP portal.
+   */
   description?: string;
 
   modified_at?: string;
@@ -629,32 +924,54 @@ export interface PortalDeleteResponse {
   modified_by?: string;
 
   /**
-   * Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 }
 
 export interface PortalReadResponse {
   /**
-   * portal id
+   * Unique identifier for the MCP portal.
    */
   id: string;
 
+  /**
+   * Hostname where the MCP portal is available.
+   */
   hostname: string;
 
+  /**
+   * Display name for the MCP portal.
+   */
   name: string;
 
   servers: Array<PortalReadResponse.Server>;
 
   /**
-   * Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Deprecated: use `code_mode` for new integrations. `true` maps to any
+   * non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are
+   * sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
+  /**
+   * Code Mode policy for this portal. `off`: Code Mode is unavailable; query
+   * parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it
+   * on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
   created_at?: string;
 
   created_by?: string;
 
+  /**
+   * Optional description of the MCP portal.
+   */
   description?: string;
 
   modified_at?: string;
@@ -662,7 +979,7 @@ export interface PortalReadResponse {
   modified_by?: string;
 
   /**
-   * Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 }
@@ -670,31 +987,57 @@ export interface PortalReadResponse {
 export namespace PortalReadResponse {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
 
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
 
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
 
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
 
     prompts: Array<{ [key: string]: unknown }>;
 
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
     tools: Array<{ [key: string]: unknown }>;
 
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: Server.AuthConfigSummary;
+
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
+
     created_at?: string;
 
     created_by?: string;
 
     default_disabled?: boolean;
 
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
 
     error?: string;
@@ -705,8 +1048,7 @@ export namespace PortalReadResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
 
@@ -721,11 +1063,14 @@ export namespace PortalReadResponse {
     on_behalf?: boolean;
 
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
 
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
 
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
@@ -733,6 +1078,47 @@ export namespace PortalReadResponse {
   }
 
   export namespace Server {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    export interface AuthConfigSummary {
+      auth_mode?: 'dcr' | 'manual';
+
+      client_secret_version?: number;
+
+      config?: AuthConfigSummary.Config;
+
+      has_client_secret?: boolean;
+
+      registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+
+    export namespace AuthConfigSummary {
+      export interface Config {
+        authorization_endpoint?: string;
+
+        issuer?: string;
+
+        resource?: string;
+
+        revocation_endpoint?: string;
+
+        token_endpoint?: string;
+      }
+
+      export interface RegistrationInfo {
+        client_id?: string;
+
+        redirect_uris?: Array<string>;
+
+        scope?: string;
+
+        token_endpoint_auth_method?: string;
+      }
+    }
+
     export interface ErrorDetails {
       /**
        * Underlying error message
@@ -797,37 +1183,51 @@ export interface PortalCreateParams {
   account_id: string;
 
   /**
-   * Body param: portal id
+   * Body param: Unique identifier for the MCP portal.
    */
   id: string;
 
   /**
-   * Body param
+   * Body param: Hostname where the MCP portal is available.
    */
   hostname: string;
 
   /**
-   * Body param
+   * Body param: Display name for the MCP portal.
    */
   name: string;
 
   /**
-   * Body param: Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Body param: Deprecated: use `code_mode` for new integrations. `true`
+   * maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both
+   * fields are sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
   /**
-   * Body param
+   * Body param: Code Mode policy for this portal. `off`: Code Mode is unavailable;
+   * query parameters are ignored. `opt_in`: Code Mode is off by default; clients
+   * turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
+  /**
+   * Body param: Optional description of the MCP portal.
    */
   description?: string;
 
   /**
-   * Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 
   /**
-   * Body param
+   * Body param: MCP servers attached to the portal and their portal-specific
+   * settings.
    */
   servers?: Array<PortalCreateParams.Server>;
 }
@@ -835,37 +1235,73 @@ export interface PortalCreateParams {
 export namespace PortalCreateParams {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
+    /**
+     * Disable this server by default for clients connecting through the portal.
+     */
     default_disabled?: boolean;
 
+    /**
+     * Use end-user OAuth credentials when connecting this server to the portal.
+     */
     on_behalf?: boolean;
 
+    /**
+     * Portal-specific prompt overrides.
+     */
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
+    /**
+     * Portal-specific tool overrides.
+     */
     updated_tools?: Array<Server.UpdatedTool>;
   }
 
   export namespace Server {
     export interface UpdatedPrompt {
+      /**
+       * Name of the tool or prompt capability to override.
+       */
       name: string;
 
+      /**
+       * Custom name exposed for the capability.
+       */
       alias?: string;
 
+      /**
+       * Custom description exposed for the capability.
+       */
       description?: string;
 
+      /**
+       * Whether the capability is available through the MCP server.
+       */
       enabled?: boolean;
     }
 
     export interface UpdatedTool {
+      /**
+       * Name of the tool or prompt capability to override.
+       */
       name: string;
 
+      /**
+       * Custom name exposed for the capability.
+       */
       alias?: string;
 
+      /**
+       * Custom description exposed for the capability.
+       */
       description?: string;
 
+      /**
+       * Whether the capability is available through the MCP server.
+       */
       enabled?: boolean;
     }
   }
@@ -878,32 +1314,46 @@ export interface PortalUpdateParams {
   account_id: string;
 
   /**
-   * Body param: Allow remote code execution in Dynamic Workers (beta)
+   * @deprecated Body param: Deprecated: use `code_mode` for new integrations. `true`
+   * maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both
+   * fields are sent, they must be consistent or the request returns a 400.
    */
   allow_code_mode?: boolean;
 
   /**
-   * Body param
+   * Body param: Code Mode policy for this portal. `off`: Code Mode is unavailable;
+   * query parameters are ignored. `opt_in`: Code Mode is off by default; clients
+   * turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by
+   * default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is
+   * always on; query parameters are ignored. Defaults to `opt_in` when omitted on
+   * create. If both `code_mode` and `allow_code_mode` are sent, they must be
+   * consistent or the request returns a 400.
+   */
+  code_mode?: 'off' | 'opt_in' | 'default_on' | 'enforced';
+
+  /**
+   * Body param: Optional description of the MCP portal.
    */
   description?: string;
 
   /**
-   * Body param
+   * Body param: Hostname where the MCP portal is available.
    */
   hostname?: string;
 
   /**
-   * Body param
+   * Body param: Display name for the MCP portal.
    */
   name?: string;
 
   /**
-   * Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway
+   * Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway.
    */
   secure_web_gateway?: boolean;
 
   /**
-   * Body param
+   * Body param: MCP servers attached to the portal and their portal-specific
+   * settings.
    */
   servers?: Array<PortalUpdateParams.Server>;
 }
@@ -911,37 +1361,73 @@ export interface PortalUpdateParams {
 export namespace PortalUpdateParams {
   export interface Server {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     server_id: string;
 
+    /**
+     * Disable this server by default for clients connecting through the portal.
+     */
     default_disabled?: boolean;
 
+    /**
+     * Use end-user OAuth credentials when connecting this server to the portal.
+     */
     on_behalf?: boolean;
 
+    /**
+     * Portal-specific prompt overrides.
+     */
     updated_prompts?: Array<Server.UpdatedPrompt>;
 
+    /**
+     * Portal-specific tool overrides.
+     */
     updated_tools?: Array<Server.UpdatedTool>;
   }
 
   export namespace Server {
     export interface UpdatedPrompt {
+      /**
+       * Name of the tool or prompt capability to override.
+       */
       name: string;
 
+      /**
+       * Custom name exposed for the capability.
+       */
       alias?: string;
 
+      /**
+       * Custom description exposed for the capability.
+       */
       description?: string;
 
+      /**
+       * Whether the capability is available through the MCP server.
+       */
       enabled?: boolean;
     }
 
     export interface UpdatedTool {
+      /**
+       * Name of the tool or prompt capability to override.
+       */
       name: string;
 
+      /**
+       * Custom name exposed for the capability.
+       */
       alias?: string;
 
+      /**
+       * Custom description exposed for the capability.
+       */
       description?: string;
 
+      /**
+       * Whether the capability is available through the MCP server.
+       */
       enabled?: boolean;
     }
   }