cloudflare 7.0.0 → 7.1.0

package/src/resources/zero-trust/access/applications/policies.ts

@@ -1,6 +1,7 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 import { APIResource } from '../../../../core/resource';
+import * as ApplicationsPoliciesAPI from './policies';
 import * as PoliciesAPI from '../policies';
 import * as ApplicationsAPI from './applications';
 import { APIPromise } from '../../../../core/api-promise';
@@ -75,6 +76,9 @@ export class BasePolicies extends APIResource {
    *     {
    *       app_id: 'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
    *       account_id: 'account_id',
+   *       mfa_config: {
+   *         allowed_authenticators: ['ssh_fido2_key'],
+   *       },
    *     },
    *   );
    * ```
@@ -1269,831 +1273,1538 @@ export namespace ServiceTokenRuleParam {
   }
 }
 
-export interface PolicyCreateResponse {
-  /**
-   * The UUID of the policy
-   */
-  id?: string;
+export type PolicyCreateResponse = PolicyCreateResponse.UnionMember0 | PolicyCreateResponse.UnionMember1;
 
-  /**
-   * Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+export namespace PolicyCreateResponse {
+  export interface UnionMember0 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
 
-  /**
-   * Requires the user to request access from an administrator at the start of each
-   * session.
-   */
-  approval_required?: boolean;
+    /**
+     * Identifier.
+     */
+    account_id?: string;
 
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  connection_rules?: PolicyCreateResponse.ConnectionRules;
+    /**
+     * Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
 
-  created_at?: string;
+    /**
+     * Requires the user to request access from an administrator at the start of each
+     * session.
+     */
+    approval_required?: boolean;
 
-  /**
-   * The action Access will take if a user matches this policy. Infrastructure
-   * application policies can only use the Allow action.
-   */
-  decision?: ApplicationsAPI.Decision;
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember0.ConnectionRules;
 
-  /**
-   * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-   * meet any of the Exclude rules.
-   */
-  exclude?: Array<AccessRule>;
+    created_at?: string;
 
-  /**
-   * Rules evaluated with an OR logical operator. A user needs to meet only one of
-   * the Include rules.
-   */
-  include?: Array<AccessRule>;
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
 
-  /**
-   * Require this application to be served in an isolated browser for users matching
-   * this policy. 'Client Web Isolation' must be on for the account in order to use
-   * this feature.
-   */
-  isolation_required?: boolean;
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyCreateResponse.MfaConfig;
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * The name of the Access policy.
-   */
-  name?: string;
+    /**
+     * Require this application to be served in an isolated browser for users matching
+     * this policy. 'Client Web Isolation' must be on for the account in order to use
+     * this feature.
+     */
+    isolation_required?: boolean;
 
-  /**
-   * The order of execution for this policy. Must be unique for each policy within an
-   * app.
-   */
-  precedence?: number;
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: UnionMember0.MfaConfig;
 
-  /**
-   * A custom message that will appear on the purpose justification screen.
-   */
-  purpose_justification_prompt?: string;
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
 
-  /**
-   * Require users to enter a justification when they log in to the application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * The order of execution for this policy. Must be unique for each policy within an
+     * app.
+     */
+    precedence?: number;
 
-  /**
-   * Rules evaluated with an AND logical operator. To match the policy, a user must
-   * meet all of the Require rules.
-   */
-  require?: Array<AccessRule>;
+    /**
+     * A custom message that will appear on the purpose justification screen.
+     */
+    purpose_justification_prompt?: string;
 
-  /**
-   * The amount of time that tokens issued for the application will be valid. Must be
-   * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-   * m, h.
-   */
-  session_duration?: string;
+    /**
+     * Require users to enter a justification when they log in to the application.
+     */
+    purpose_justification_required?: boolean;
 
-  updated_at?: string;
-}
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-export namespace PolicyCreateResponse {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The amount of time that tokens issued for the application will be valid. Must be
+     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+     * m, h.
      */
-    rdp?: ConnectionRules.RDP;
+    session_duration?: string | null;
+
+    updated_at?: string;
   }
 
-  export namespace ConnectionRules {
+  export namespace UnionMember0 {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The rules that define how users may connect to targets secured by your
+     * application.
      */
-    export interface RDP {
+    export interface ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      rdp?: ConnectionRules.RDP;
+    }
 
+    export namespace ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+       */
+      session_duration?: string;
     }
   }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
+  export interface UnionMember1 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
+
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember1.ConnectionRules;
+
+    created_at?: string;
+
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
+
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    mfa_config?: UnionMember1.MfaConfig;
 
     /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
+     * The name of the Access policy.
      */
-    mfa_disabled?: boolean;
+    name?: string;
 
     /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
      */
-    session_duration?: string;
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    updated_at?: string;
+  }
+
+  export namespace UnionMember1 {
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      ssh?: ConnectionRules.SSH;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+       */
+      session_duration?: string;
+    }
   }
 }
 
-export interface PolicyUpdateResponse {
-  /**
-   * The UUID of the policy
-   */
-  id?: string;
+export type PolicyUpdateResponse = PolicyUpdateResponse.UnionMember0 | PolicyUpdateResponse.UnionMember1;
 
-  /**
-   * Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+export namespace PolicyUpdateResponse {
+  export interface UnionMember0 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
 
-  /**
-   * Requires the user to request access from an administrator at the start of each
-   * session.
-   */
-  approval_required?: boolean;
+    /**
+     * Identifier.
+     */
+    account_id?: string;
 
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  connection_rules?: PolicyUpdateResponse.ConnectionRules;
+    /**
+     * Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
 
-  created_at?: string;
+    /**
+     * Requires the user to request access from an administrator at the start of each
+     * session.
+     */
+    approval_required?: boolean;
 
-  /**
-   * The action Access will take if a user matches this policy. Infrastructure
-   * application policies can only use the Allow action.
-   */
-  decision?: ApplicationsAPI.Decision;
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember0.ConnectionRules;
 
-  /**
-   * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-   * meet any of the Exclude rules.
-   */
-  exclude?: Array<AccessRule>;
+    created_at?: string;
 
-  /**
-   * Rules evaluated with an OR logical operator. A user needs to meet only one of
-   * the Include rules.
-   */
-  include?: Array<AccessRule>;
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
 
-  /**
-   * Require this application to be served in an isolated browser for users matching
-   * this policy. 'Client Web Isolation' must be on for the account in order to use
-   * this feature.
-   */
-  isolation_required?: boolean;
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyUpdateResponse.MfaConfig;
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * The name of the Access policy.
-   */
-  name?: string;
+    /**
+     * Require this application to be served in an isolated browser for users matching
+     * this policy. 'Client Web Isolation' must be on for the account in order to use
+     * this feature.
+     */
+    isolation_required?: boolean;
 
-  /**
-   * The order of execution for this policy. Must be unique for each policy within an
-   * app.
-   */
-  precedence?: number;
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: UnionMember0.MfaConfig;
 
-  /**
-   * A custom message that will appear on the purpose justification screen.
-   */
-  purpose_justification_prompt?: string;
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
 
-  /**
-   * Require users to enter a justification when they log in to the application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * The order of execution for this policy. Must be unique for each policy within an
+     * app.
+     */
+    precedence?: number;
 
-  /**
-   * Rules evaluated with an AND logical operator. To match the policy, a user must
-   * meet all of the Require rules.
-   */
-  require?: Array<AccessRule>;
+    /**
+     * A custom message that will appear on the purpose justification screen.
+     */
+    purpose_justification_prompt?: string;
 
-  /**
-   * The amount of time that tokens issued for the application will be valid. Must be
-   * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-   * m, h.
-   */
-  session_duration?: string;
+    /**
+     * Require users to enter a justification when they log in to the application.
+     */
+    purpose_justification_required?: boolean;
+
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * The amount of time that tokens issued for the application will be valid. Must be
+     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+     * m, h.
+     */
+    session_duration?: string | null;
+
+    updated_at?: string;
+  }
+
+  export namespace UnionMember0 {
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      rdp?: ConnectionRules.RDP;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+       */
+      session_duration?: string;
+    }
+  }
+
+  export interface UnionMember1 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
+
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember1.ConnectionRules;
+
+    created_at?: string;
+
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
+
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    mfa_config?: UnionMember1.MfaConfig;
+
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
+
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    updated_at?: string;
+  }
+
+  export namespace UnionMember1 {
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      ssh?: ConnectionRules.SSH;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
+    }
 
-  updated_at?: string;
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+       */
+      session_duration?: string;
+    }
+  }
 }
 
-export namespace PolicyUpdateResponse {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
+export type PolicyListResponse = PolicyListResponse.UnionMember0 | PolicyListResponse.UnionMember1;
+
+export namespace PolicyListResponse {
+  export interface UnionMember0 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
+
+    /**
+     * Identifier.
+     */
+    account_id?: string;
+
+    /**
+     * Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+
+    /**
+     * Requires the user to request access from an administrator at the start of each
+     * session.
+     */
+    approval_required?: boolean;
+
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember0.ConnectionRules;
+
+    created_at?: string;
+
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
+
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Require this application to be served in an isolated browser for users matching
+     * this policy. 'Client Web Isolation' must be on for the account in order to use
+     * this feature.
+     */
+    isolation_required?: boolean;
+
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: UnionMember0.MfaConfig;
+
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
+
+    /**
+     * The order of execution for this policy. Must be unique for each policy within an
+     * app.
+     */
+    precedence?: number;
+
+    /**
+     * A custom message that will appear on the purpose justification screen.
+     */
+    purpose_justification_prompt?: string;
+
+    /**
+     * Require users to enter a justification when they log in to the application.
+     */
+    purpose_justification_required?: boolean;
+
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The amount of time that tokens issued for the application will be valid. Must be
+     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+     * m, h.
      */
-    rdp?: ConnectionRules.RDP;
+    session_duration?: string | null;
+
+    updated_at?: string;
   }
 
-  export namespace ConnectionRules {
+  export namespace UnionMember0 {
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      rdp?: ConnectionRules.RDP;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
+    }
+
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * Configures multi-factor authentication (MFA) settings.
      */
-    export interface RDP {
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      mfa_disabled?: boolean;
 
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      session_duration?: string;
     }
   }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
+  export interface UnionMember1 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
+
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember1.ConnectionRules;
+
+    created_at?: string;
+
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
+
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    mfa_config?: UnionMember1.MfaConfig;
 
     /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
+     * The name of the Access policy.
      */
-    mfa_disabled?: boolean;
+    name?: string;
 
     /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
      */
-    session_duration?: string;
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    updated_at?: string;
+  }
+
+  export namespace UnionMember1 {
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      ssh?: ConnectionRules.SSH;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+       */
+      session_duration?: string;
+    }
   }
 }
 
-export interface PolicyListResponse {
+export interface PolicyDeleteResponse {
   /**
-   * The UUID of the policy
+   * UUID.
    */
   id?: string;
+}
 
-  /**
-   * Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+export type PolicyGetResponse = PolicyGetResponse.UnionMember0 | PolicyGetResponse.UnionMember1;
 
-  /**
-   * Requires the user to request access from an administrator at the start of each
-   * session.
-   */
-  approval_required?: boolean;
+export namespace PolicyGetResponse {
+  export interface UnionMember0 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
 
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  connection_rules?: PolicyListResponse.ConnectionRules;
+    /**
+     * Identifier.
+     */
+    account_id?: string;
 
-  created_at?: string;
+    /**
+     * Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
 
-  /**
-   * The action Access will take if a user matches this policy. Infrastructure
-   * application policies can only use the Allow action.
-   */
-  decision?: ApplicationsAPI.Decision;
+    /**
+     * Requires the user to request access from an administrator at the start of each
+     * session.
+     */
+    approval_required?: boolean;
 
-  /**
-   * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-   * meet any of the Exclude rules.
-   */
-  exclude?: Array<AccessRule>;
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember0.ConnectionRules;
 
-  /**
-   * Rules evaluated with an OR logical operator. A user needs to meet only one of
-   * the Include rules.
-   */
-  include?: Array<AccessRule>;
+    created_at?: string;
 
-  /**
-   * Require this application to be served in an isolated browser for users matching
-   * this policy. 'Client Web Isolation' must be on for the account in order to use
-   * this feature.
-   */
-  isolation_required?: boolean;
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyListResponse.MfaConfig;
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * The name of the Access policy.
-   */
-  name?: string;
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
 
-  /**
-   * The order of execution for this policy. Must be unique for each policy within an
-   * app.
-   */
-  precedence?: number;
+    /**
+     * Require this application to be served in an isolated browser for users matching
+     * this policy. 'Client Web Isolation' must be on for the account in order to use
+     * this feature.
+     */
+    isolation_required?: boolean;
 
-  /**
-   * A custom message that will appear on the purpose justification screen.
-   */
-  purpose_justification_prompt?: string;
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: UnionMember0.MfaConfig;
 
-  /**
-   * Require users to enter a justification when they log in to the application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
 
-  /**
-   * Rules evaluated with an AND logical operator. To match the policy, a user must
-   * meet all of the Require rules.
-   */
-  require?: Array<AccessRule>;
+    /**
+     * The order of execution for this policy. Must be unique for each policy within an
+     * app.
+     */
+    precedence?: number;
 
-  /**
-   * The amount of time that tokens issued for the application will be valid. Must be
-   * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-   * m, h.
-   */
-  session_duration?: string;
+    /**
+     * A custom message that will appear on the purpose justification screen.
+     */
+    purpose_justification_prompt?: string;
 
-  updated_at?: string;
-}
+    /**
+     * Require users to enter a justification when they log in to the application.
+     */
+    purpose_justification_required?: boolean;
 
-export namespace PolicyListResponse {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
      */
-    rdp?: ConnectionRules.RDP;
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * The amount of time that tokens issued for the application will be valid. Must be
+     * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
+     * m, h.
+     */
+    session_duration?: string | null;
+
+    updated_at?: string;
   }
 
-  export namespace ConnectionRules {
+  export namespace UnionMember0 {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The rules that define how users may connect to targets secured by your
+     * application.
      */
-    export interface RDP {
+    export interface ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      rdp?: ConnectionRules.RDP;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+       */
+      session_duration?: string;
+    }
+  }
+
+  export interface UnionMember1 {
+    /**
+     * The UUID of the policy
+     */
+    id?: string;
+
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    connection_rules?: UnionMember1.ConnectionRules;
+
+    created_at?: string;
+
+    /**
+     * The action Access will take if a user matches this policy. Infrastructure
+     * application policies can only use the Allow action.
+     */
+    decision?: ApplicationsAPI.Decision;
+
+    /**
+     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
+     * meet any of the Exclude rules.
+     */
+    exclude?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Rules evaluated with an OR logical operator. A user needs to meet only one of
+     * the Include rules.
+     */
+    include?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    mfa_config?: UnionMember1.MfaConfig;
+
+    /**
+     * The name of the Access policy.
+     */
+    name?: string;
+
+    /**
+     * Rules evaluated with an AND logical operator. To match the policy, a user must
+     * meet all of the Require rules.
+     */
+    require?: Array<ApplicationsPoliciesAPI.AccessRule>;
+
+    updated_at?: string;
+  }
+
+  export namespace UnionMember1 {
+    /**
+     * The rules that define how users may connect to the targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      ssh?: ConnectionRules.SSH;
+    }
+
+    export namespace ConnectionRules {
+      /**
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
+       */
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
+    }
+
+    /**
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
+
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      mfa_disabled?: boolean;
 
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      session_duration?: string;
     }
   }
+}
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
+export type PolicyCreateParams =
+  | PolicyCreateParams.AccessAppPolicyRequest
+  | PolicyCreateParams.AccessInfraPolicyReq;
+
+export declare namespace PolicyCreateParams {
+  export interface AccessAppPolicyRequest {
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    account_id?: string;
 
     /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
      */
-    mfa_disabled?: boolean;
+    zone_id?: string;
 
     /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+     * Body param: Administrators who can approve a temporary authentication request.
      */
-    session_duration?: string;
-  }
-}
+    approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
 
-export interface PolicyDeleteResponse {
-  /**
-   * UUID.
-   */
-  id?: string;
-}
+    /**
+     * Body param: Requires the user to request access from an administrator at the
+     * start of each session.
+     */
+    approval_required?: boolean;
 
-export interface PolicyGetResponse {
-  /**
-   * The UUID of the policy
-   */
-  id?: string;
+    /**
+     * Body param: The rules that define how users may connect to targets secured by
+     * your application.
+     */
+    connection_rules?: AccessAppPolicyRequest.ConnectionRules;
 
-  /**
-   * Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroup>;
+    /**
+     * Body param: Require this application to be served in an isolated browser for
+     * users matching this policy. 'Client Web Isolation' must be on for the account in
+     * order to use this feature.
+     */
+    isolation_required?: boolean;
 
-  /**
-   * Requires the user to request access from an administrator at the start of each
-   * session.
-   */
-  approval_required?: boolean;
+    /**
+     * Body param: Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: AccessAppPolicyRequest.MfaConfig;
 
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  connection_rules?: PolicyGetResponse.ConnectionRules;
+    /**
+     * Body param: The order of execution for this policy. Must be unique for each
+     * policy within an app.
+     */
+    precedence?: number;
 
-  created_at?: string;
+    /**
+     * Body param: A custom message that will appear on the purpose justification
+     * screen.
+     */
+    purpose_justification_prompt?: string;
 
-  /**
-   * The action Access will take if a user matches this policy. Infrastructure
-   * application policies can only use the Allow action.
-   */
-  decision?: ApplicationsAPI.Decision;
+    /**
+     * Body param: Require users to enter a justification when they log in to the
+     * application.
+     */
+    purpose_justification_required?: boolean;
 
-  /**
-   * Rules evaluated with a NOT logical operator. To match the policy, a user cannot
-   * meet any of the Exclude rules.
-   */
-  exclude?: Array<AccessRule>;
+    /**
+     * Body param: The amount of time that tokens issued for the application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string | null;
+  }
 
-  /**
-   * Rules evaluated with an OR logical operator. A user needs to meet only one of
-   * the Include rules.
-   */
-  include?: Array<AccessRule>;
+  export namespace AccessAppPolicyRequest {
+    /**
+     * The rules that define how users may connect to targets secured by your
+     * application.
+     */
+    export interface ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      rdp?: ConnectionRules.RDP;
+    }
 
-  /**
-   * Require this application to be served in an isolated browser for users matching
-   * this policy. 'Client Web Isolation' must be on for the account in order to use
-   * this feature.
-   */
-  isolation_required?: boolean;
+    export namespace ConnectionRules {
+      /**
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
+       */
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
+    }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyGetResponse.MfaConfig;
+    /**
+     * Configures multi-factor authentication (MFA) settings.
+     */
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
 
-  /**
-   * The name of the Access policy.
-   */
-  name?: string;
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
 
-  /**
-   * The order of execution for this policy. Must be unique for each policy within an
-   * app.
-   */
-  precedence?: number;
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+       */
+      session_duration?: string;
+    }
+  }
 
-  /**
-   * A custom message that will appear on the purpose justification screen.
-   */
-  purpose_justification_prompt?: string;
+  export interface AccessInfraPolicyReq {
+    /**
+     * Body param: The action Access will take if a user matches this policy.
+     * Infrastructure application policies can only use the Allow action.
+     */
+    decision: ApplicationsAPI.DecisionParam;
 
-  /**
-   * Require users to enter a justification when they log in to the application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<AccessRuleParam>;
 
-  /**
-   * Rules evaluated with an AND logical operator. To match the policy, a user must
-   * meet all of the Require rules.
-   */
-  require?: Array<AccessRule>;
+    /**
+     * Body param: The name of the Access policy.
+     */
+    name: string;
 
-  /**
-   * The amount of time that tokens issued for the application will be valid. Must be
-   * in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
-   * m, h.
-   */
-  session_duration?: string;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
 
-  updated_at?: string;
-}
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
+
+    /**
+     * Body param: The rules that define how users may connect to the targets secured
+     * by your application.
+     */
+    connection_rules?: AccessInfraPolicyReq.ConnectionRules;
 
-export namespace PolicyGetResponse {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+     * user cannot meet any of the Exclude rules.
      */
-    rdp?: ConnectionRules.RDP;
+    exclude?: Array<AccessRuleParam>;
+
+    /**
+     * Body param: Configures multi-factor authentication (MFA) settings for
+     * infrastructure applications.
+     */
+    mfa_config?: AccessInfraPolicyReq.MfaConfig;
+
+    /**
+     * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+     * user must meet all of the Require rules.
+     */
+    require?: Array<AccessRuleParam>;
   }
 
-  export namespace ConnectionRules {
+  export namespace AccessInfraPolicyReq {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The rules that define how users may connect to the targets secured by your
+     * application.
      */
-    export interface RDP {
+    export interface ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      ssh?: ConnectionRules.SSH;
+    }
 
+    export namespace ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
     }
-  }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
 
-    /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
-     */
-    mfa_disabled?: boolean;
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
 
-    /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
-     */
-    session_duration?: string;
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+       */
+      session_duration?: string;
+    }
   }
 }
 
-export interface PolicyCreateParams {
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
+export type PolicyUpdateParams =
+  | PolicyUpdateParams.AccessAppPolicyRequest
+  | PolicyUpdateParams.AccessInfraPolicyReq;
 
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
+export declare namespace PolicyUpdateParams {
+  export interface AccessAppPolicyRequest {
+    /**
+     * Path param: UUID.
+     */
+    app_id: string;
 
-  /**
-   * Body param: Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
 
-  /**
-   * Body param: Requires the user to request access from an administrator at the
-   * start of each session.
-   */
-  approval_required?: boolean;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
 
-  /**
-   * Body param: The rules that define how users may connect to targets secured by
-   * your application.
-   */
-  connection_rules?: PolicyCreateParams.ConnectionRules;
+    /**
+     * Body param: Administrators who can approve a temporary authentication request.
+     */
+    approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
 
-  /**
-   * Body param: Require this application to be served in an isolated browser for
-   * users matching this policy. 'Client Web Isolation' must be on for the account in
-   * order to use this feature.
-   */
-  isolation_required?: boolean;
+    /**
+     * Body param: Requires the user to request access from an administrator at the
+     * start of each session.
+     */
+    approval_required?: boolean;
 
-  /**
-   * Body param: Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyCreateParams.MfaConfig;
+    /**
+     * Body param: The rules that define how users may connect to targets secured by
+     * your application.
+     */
+    connection_rules?: AccessAppPolicyRequest.ConnectionRules;
 
-  /**
-   * Body param: The order of execution for this policy. Must be unique for each
-   * policy within an app.
-   */
-  precedence?: number;
+    /**
+     * Body param: Require this application to be served in an isolated browser for
+     * users matching this policy. 'Client Web Isolation' must be on for the account in
+     * order to use this feature.
+     */
+    isolation_required?: boolean;
 
-  /**
-   * Body param: A custom message that will appear on the purpose justification
-   * screen.
-   */
-  purpose_justification_prompt?: string;
+    /**
+     * Body param: Configures multi-factor authentication (MFA) settings.
+     */
+    mfa_config?: AccessAppPolicyRequest.MfaConfig;
 
-  /**
-   * Body param: Require users to enter a justification when they log in to the
-   * application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * Body param: The order of execution for this policy. Must be unique for each
+     * policy within an app.
+     */
+    precedence?: number;
 
-  /**
-   * Body param: The amount of time that tokens issued for the application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
-   */
-  session_duration?: string;
-}
+    /**
+     * Body param: A custom message that will appear on the purpose justification
+     * screen.
+     */
+    purpose_justification_prompt?: string;
 
-export namespace PolicyCreateParams {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * Body param: Require users to enter a justification when they log in to the
+     * application.
      */
-    rdp?: ConnectionRules.RDP;
+    purpose_justification_required?: boolean;
+
+    /**
+     * Body param: The amount of time that tokens issued for the application will be
+     * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
+     * (or µs), ms, s, m, h.
+     */
+    session_duration?: string | null;
   }
 
-  export namespace ConnectionRules {
+  export namespace AccessAppPolicyRequest {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The rules that define how users may connect to targets secured by your
+     * application.
      */
-    export interface RDP {
+    export interface ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      rdp?: ConnectionRules.RDP;
+    }
 
+    export namespace ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * The RDP-specific rules that define clipboard behavior for RDP connections.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      export interface RDP {
+        /**
+         * Clipboard formats allowed when copying from local machine to remote RDP session.
+         */
+        allowed_clipboard_local_to_remote_formats?: Array<'text' | 'file'>;
+
+        /**
+         * Clipboard formats allowed when copying from remote RDP session to local machine.
+         */
+        allowed_clipboard_remote_to_local_formats?: Array<'text' | 'file'>;
+      }
     }
-  }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Configures multi-factor authentication (MFA) settings.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with.
+       */
+      allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
+
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+       */
+      session_duration?: string;
+    }
+  }
 
+  export interface AccessInfraPolicyReq {
     /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
+     * Path param: UUID.
      */
-    mfa_disabled?: boolean;
+    app_id: string;
 
     /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
+     * Body param: The action Access will take if a user matches this policy.
+     * Infrastructure application policies can only use the Allow action.
      */
-    session_duration?: string;
-  }
-}
-
-export interface PolicyUpdateParams {
-  /**
-   * Path param: UUID.
-   */
-  app_id: string;
-
-  /**
-   * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
-   * Zone ID.
-   */
-  account_id?: string;
-
-  /**
-   * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
-   * Account ID.
-   */
-  zone_id?: string;
-
-  /**
-   * Body param: Administrators who can approve a temporary authentication request.
-   */
-  approval_groups?: Array<PoliciesAPI.ApprovalGroupParam>;
-
-  /**
-   * Body param: Requires the user to request access from an administrator at the
-   * start of each session.
-   */
-  approval_required?: boolean;
+    decision: ApplicationsAPI.DecisionParam;
 
-  /**
-   * Body param: The rules that define how users may connect to targets secured by
-   * your application.
-   */
-  connection_rules?: PolicyUpdateParams.ConnectionRules;
+    /**
+     * Body param: Rules evaluated with an OR logical operator. A user needs to meet
+     * only one of the Include rules.
+     */
+    include: Array<AccessRuleParam>;
 
-  /**
-   * Body param: Require this application to be served in an isolated browser for
-   * users matching this policy. 'Client Web Isolation' must be on for the account in
-   * order to use this feature.
-   */
-  isolation_required?: boolean;
+    /**
+     * Body param: The name of the Access policy.
+     */
+    name: string;
 
-  /**
-   * Body param: Configures multi-factor authentication (MFA) settings.
-   */
-  mfa_config?: PolicyUpdateParams.MfaConfig;
+    /**
+     * Path param: The Account ID to use for this endpoint. Mutually exclusive with the
+     * Zone ID.
+     */
+    account_id?: string;
 
-  /**
-   * Body param: The order of execution for this policy. Must be unique for each
-   * policy within an app.
-   */
-  precedence?: number;
+    /**
+     * Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
+     * Account ID.
+     */
+    zone_id?: string;
 
-  /**
-   * Body param: A custom message that will appear on the purpose justification
-   * screen.
-   */
-  purpose_justification_prompt?: string;
+    /**
+     * Body param: The rules that define how users may connect to the targets secured
+     * by your application.
+     */
+    connection_rules?: AccessInfraPolicyReq.ConnectionRules;
 
-  /**
-   * Body param: Require users to enter a justification when they log in to the
-   * application.
-   */
-  purpose_justification_required?: boolean;
+    /**
+     * Body param: Rules evaluated with a NOT logical operator. To match the policy, a
+     * user cannot meet any of the Exclude rules.
+     */
+    exclude?: Array<AccessRuleParam>;
 
-  /**
-   * Body param: The amount of time that tokens issued for the application will be
-   * valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
-   * (or µs), ms, s, m, h.
-   */
-  session_duration?: string;
-}
+    /**
+     * Body param: Configures multi-factor authentication (MFA) settings for
+     * infrastructure applications.
+     */
+    mfa_config?: AccessInfraPolicyReq.MfaConfig;
 
-export namespace PolicyUpdateParams {
-  /**
-   * The rules that define how users may connect to targets secured by your
-   * application.
-   */
-  export interface ConnectionRules {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * Body param: Rules evaluated with an AND logical operator. To match the policy, a
+     * user must meet all of the Require rules.
      */
-    rdp?: ConnectionRules.RDP;
+    require?: Array<AccessRuleParam>;
   }
 
-  export namespace ConnectionRules {
+  export namespace AccessInfraPolicyReq {
     /**
-     * The RDP-specific rules that define clipboard behavior for RDP connections.
+     * The rules that define how users may connect to the targets secured by your
+     * application.
      */
-    export interface RDP {
+    export interface ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from local machine to remote RDP session.
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
        */
-      allowed_clipboard_local_to_remote_formats?: Array<'text'>;
+      ssh?: ConnectionRules.SSH;
+    }
 
+    export namespace ConnectionRules {
       /**
-       * Clipboard formats allowed when copying from remote RDP session to local machine.
+       * The SSH-specific rules that define how users may connect to the targets secured
+       * by your application.
        */
-      allowed_clipboard_remote_to_local_formats?: Array<'text'>;
+      export interface SSH {
+        /**
+         * Contains the Unix usernames that may be used when connecting over SSH.
+         */
+        usernames: Array<string>;
+
+        /**
+         * Enables using Identity Provider email alias as SSH username.
+         */
+        allow_email_alias?: boolean;
+      }
     }
-  }
 
-  /**
-   * Configures multi-factor authentication (MFA) settings.
-   */
-  export interface MfaConfig {
     /**
-     * Lists the MFA methods that users can authenticate with.
+     * Configures multi-factor authentication (MFA) settings for infrastructure
+     * applications.
      */
-    allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key'>;
+    export interface MfaConfig {
+      /**
+       * Lists the MFA methods that users can authenticate with. For infrastructure
+       * applications, supported values are `piv_key` and `ssh_fido2_key`.
+       */
+      allowed_authenticators?: Array<'piv_key' | 'ssh_fido2_key'>;
 
-    /**
-     * Indicates whether to disable MFA for this resource. This option is available at
-     * the application and policy level.
-     */
-    mfa_disabled?: boolean;
+      /**
+       * Indicates whether to disable MFA for this resource. This option is available at
+       * the application and policy level.
+       */
+      mfa_disabled?: boolean;
 
-    /**
-     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
-     * Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
-     */
-    session_duration?: string;
+      /**
+       * Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
+       * Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.
+       */
+      session_duration?: string;
+    }
   }
 }