# Access

# AI Controls

# Mcp

# Portals

## List MCP Portals

`client.zeroTrust.access.aiControls.mcp.portals.list(PortalListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<PortalListResponse>`

**get** `/accounts/{account_id}/access/ai-controls/mcp/portals`

Lists all MCP portals configured for the account.

### Parameters

- `params: PortalListParams`

  - `account_id: string`

    Path param

  - `page?: number`

    Query param

  - `per_page?: number`

    Query param

  - `search?: string`

    Query param: Search by id, name, hostname

### Returns

- `PortalListResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const portalListResponse of client.zeroTrust.access.aiControls.mcp.portals.list({
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
})) {
  console.log(portalListResponse.id);
}
```

#### Response

```json
{
  "result": [
    {
      "id": "my-mcp-portal",
      "hostname": "exmaple.com",
      "name": "My MCP Portal",
      "servers": [
        {
          "id": "my-mcp-server",
          "auth_type": "unauthenticated",
          "hostname": "https://example.com/mcp",
          "name": "My MCP Server",
          "prompts": [
            {
              "foo": "bar"
            }
          ],
          "tools": [
            {
              "foo": "bar"
            }
          ],
          "created_at": "2019-12-27T18:11:19.117Z",
          "created_by": "created_by",
          "default_disabled": true,
          "description": "This is one remote mcp server",
          "error": "error",
          "last_successful_sync": "2019-12-27T18:11:19.117Z",
          "last_synced": "2019-12-27T18:11:19.117Z",
          "modified_at": "2019-12-27T18:11:19.117Z",
          "modified_by": "modified_by",
          "on_behalf": true,
          "status": "status",
          "updated_prompts": [
            {
              "name": "name",
              "description": "description",
              "enabled": true,
              "portal_alias": "portal-tool-alias",
              "server_alias": "server-tool-alias"
            }
          ],
          "updated_tools": [
            {
              "name": "name",
              "description": "description",
              "enabled": true,
              "portal_alias": "portal-tool-alias",
              "server_alias": "server-tool-alias"
            }
          ]
        }
      ],
      "allow_code_mode": true,
      "created_at": "2019-12-27T18:11:19.117Z",
      "created_by": "created_by",
      "description": "This is my custom MCP Portal",
      "modified_at": "2019-12-27T18:11:19.117Z",
      "modified_by": "modified_by",
      "secure_web_gateway": false
    }
  ],
  "success": true
}
```

## Create a new MCP Portal

`client.zeroTrust.access.aiControls.mcp.portals.create(PortalCreateParamsparams, RequestOptionsoptions?): PortalCreateResponse`

**post** `/accounts/{account_id}/access/ai-controls/mcp/portals`

Creates a new MCP portal for managing AI tool access through Cloudflare Access.

### Parameters

- `params: PortalCreateParams`

  - `account_id: string`

    Path param

  - `id: string`

    Body param: portal id

  - `hostname: string`

    Body param

  - `name: string`

    Body param

  - `allow_code_mode?: boolean`

    Body param: Allow remote code execution in Dynamic Workers (beta)

  - `description?: string`

    Body param

  - `secure_web_gateway?: boolean`

    Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway

  - `servers?: Array<Server>`

    Body param

    - `server_id: string`

      server id

    - `default_disabled?: boolean`

    - `on_behalf?: boolean`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `alias?: string`

      - `description?: string`

      - `enabled?: boolean`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `alias?: string`

      - `description?: string`

      - `enabled?: boolean`

### Returns

- `PortalCreateResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const portal = await client.zeroTrust.access.aiControls.mcp.portals.create({
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
  id: 'my-mcp-portal',
  hostname: 'exmaple.com',
  name: 'My MCP Portal',
});

console.log(portal.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-portal",
    "hostname": "exmaple.com",
    "name": "My MCP Portal",
    "servers": [
      {
        "id": "my-mcp-server",
        "auth_type": "unauthenticated",
        "hostname": "https://example.com/mcp",
        "name": "My MCP Server",
        "prompts": [
          {
            "foo": "bar"
          }
        ],
        "tools": [
          {
            "foo": "bar"
          }
        ],
        "created_at": "2019-12-27T18:11:19.117Z",
        "created_by": "created_by",
        "default_disabled": true,
        "description": "This is one remote mcp server",
        "error": "error",
        "last_successful_sync": "2019-12-27T18:11:19.117Z",
        "last_synced": "2019-12-27T18:11:19.117Z",
        "modified_at": "2019-12-27T18:11:19.117Z",
        "modified_by": "modified_by",
        "on_behalf": true,
        "status": "status",
        "updated_prompts": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ],
        "updated_tools": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ]
      }
    ],
    "allow_code_mode": true,
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is my custom MCP Portal",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "secure_web_gateway": false
  },
  "success": true
}
```

## Read details of an MCP Portal

`client.zeroTrust.access.aiControls.mcp.portals.read(stringid, PortalReadParamsparams, RequestOptionsoptions?): PortalReadResponse`

**get** `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`

Read details of an MCP Portal

### Parameters

- `id: string`

  portal id

- `params: PortalReadParams`

  - `account_id: string`

### Returns

- `PortalReadResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.aiControls.mcp.portals.read('my-mcp-portal', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(response.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-portal",
    "hostname": "exmaple.com",
    "name": "My MCP Portal",
    "servers": [
      {
        "id": "my-mcp-server",
        "auth_type": "unauthenticated",
        "hostname": "https://example.com/mcp",
        "name": "My MCP Server",
        "prompts": [
          {
            "foo": "bar"
          }
        ],
        "tools": [
          {
            "foo": "bar"
          }
        ],
        "created_at": "2019-12-27T18:11:19.117Z",
        "created_by": "created_by",
        "default_disabled": true,
        "description": "This is one remote mcp server",
        "error": "error",
        "last_successful_sync": "2019-12-27T18:11:19.117Z",
        "last_synced": "2019-12-27T18:11:19.117Z",
        "modified_at": "2019-12-27T18:11:19.117Z",
        "modified_by": "modified_by",
        "on_behalf": true,
        "status": "status",
        "updated_prompts": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ],
        "updated_tools": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ]
      }
    ],
    "allow_code_mode": true,
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is my custom MCP Portal",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "secure_web_gateway": false
  },
  "success": true
}
```

## Update a MCP Portal

`client.zeroTrust.access.aiControls.mcp.portals.update(stringid, PortalUpdateParamsparams, RequestOptionsoptions?): PortalUpdateResponse`

**put** `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`

Updates an MCP portal configuration.

### Parameters

- `id: string`

  portal id

- `params: PortalUpdateParams`

  - `account_id: string`

    Path param

  - `allow_code_mode?: boolean`

    Body param: Allow remote code execution in Dynamic Workers (beta)

  - `description?: string`

    Body param

  - `hostname?: string`

    Body param

  - `name?: string`

    Body param

  - `secure_web_gateway?: boolean`

    Body param: Route outbound MCP traffic through Zero Trust Secure Web Gateway

  - `servers?: Array<Server>`

    Body param

    - `server_id: string`

      server id

    - `default_disabled?: boolean`

    - `on_behalf?: boolean`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `alias?: string`

      - `description?: string`

      - `enabled?: boolean`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `alias?: string`

      - `description?: string`

      - `enabled?: boolean`

### Returns

- `PortalUpdateResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const portal = await client.zeroTrust.access.aiControls.mcp.portals.update('my-mcp-portal', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(portal.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-portal",
    "hostname": "exmaple.com",
    "name": "My MCP Portal",
    "servers": [
      {
        "id": "my-mcp-server",
        "auth_type": "unauthenticated",
        "hostname": "https://example.com/mcp",
        "name": "My MCP Server",
        "prompts": [
          {
            "foo": "bar"
          }
        ],
        "tools": [
          {
            "foo": "bar"
          }
        ],
        "created_at": "2019-12-27T18:11:19.117Z",
        "created_by": "created_by",
        "default_disabled": true,
        "description": "This is one remote mcp server",
        "error": "error",
        "last_successful_sync": "2019-12-27T18:11:19.117Z",
        "last_synced": "2019-12-27T18:11:19.117Z",
        "modified_at": "2019-12-27T18:11:19.117Z",
        "modified_by": "modified_by",
        "on_behalf": true,
        "status": "status",
        "updated_prompts": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ],
        "updated_tools": [
          {
            "name": "name",
            "description": "description",
            "enabled": true,
            "portal_alias": "portal-tool-alias",
            "server_alias": "server-tool-alias"
          }
        ]
      }
    ],
    "allow_code_mode": true,
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is my custom MCP Portal",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "secure_web_gateway": false
  },
  "success": true
}
```

## Delete a MCP Portal

`client.zeroTrust.access.aiControls.mcp.portals.delete(stringid, PortalDeleteParamsparams, RequestOptionsoptions?): PortalDeleteResponse`

**delete** `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`

Deletes an MCP portal from the account.

### Parameters

- `id: string`

  portal id

- `params: PortalDeleteParams`

  - `account_id: string`

### Returns

- `PortalDeleteResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const portal = await client.zeroTrust.access.aiControls.mcp.portals.delete('my-mcp-portal', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(portal.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-portal",
    "hostname": "exmaple.com",
    "name": "My MCP Portal",
    "allow_code_mode": true,
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is my custom MCP Portal",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "secure_web_gateway": false
  },
  "success": true
}
```

## Domain Types

### Portal List Response

- `PortalListResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Portal Create Response

- `PortalCreateResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Portal Read Response

- `PortalReadResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Portal Update Response

- `PortalUpdateResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `servers: Array<Server>`

    - `id: string`

      server id

    - `auth_type: "oauth" | "bearer" | "unauthenticated"`

      - `"oauth"`

      - `"bearer"`

      - `"unauthenticated"`

    - `hostname: string`

    - `name: string`

    - `prompts: Array<Record<string, unknown>>`

    - `tools: Array<Record<string, unknown>>`

    - `created_at?: string`

    - `created_by?: string`

    - `default_disabled?: boolean`

    - `description?: string | null`

    - `error?: string`

    - `last_successful_sync?: string`

    - `last_synced?: string`

    - `modified_at?: string`

    - `modified_by?: string`

    - `on_behalf?: boolean`

    - `status?: string`

    - `updated_prompts?: Array<UpdatedPrompt>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

    - `updated_tools?: Array<UpdatedTool>`

      - `name: string`

      - `description?: string`

      - `enabled?: boolean`

      - `portal_alias?: string`

      - `server_alias?: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

### Portal Delete Response

- `PortalDeleteResponse`

  - `id: string`

    portal id

  - `hostname: string`

  - `name: string`

  - `allow_code_mode?: boolean`

    Allow remote code execution in Dynamic Workers (beta)

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `secure_web_gateway?: boolean`

    Route outbound MCP traffic through Zero Trust Secure Web Gateway

# Servers

## List MCP Servers

`client.zeroTrust.access.aiControls.mcp.servers.list(ServerListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<ServerListResponse>`

**get** `/accounts/{account_id}/access/ai-controls/mcp/servers`

Lists all MCP portals configured for the account.

### Parameters

- `params: ServerListParams`

  - `account_id: string`

    Path param

  - `page?: number`

    Query param

  - `per_page?: number`

    Query param

  - `search?: string`

    Query param: Search by id, name

### Returns

- `ServerListResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const serverListResponse of client.zeroTrust.access.aiControls.mcp.servers.list({
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
})) {
  console.log(serverListResponse.id);
}
```

#### Response

```json
{
  "result": [
    {
      "id": "my-mcp-server",
      "auth_type": "unauthenticated",
      "hostname": "https://example.com/mcp",
      "name": "My MCP Server",
      "prompts": [
        {
          "foo": "bar"
        }
      ],
      "tools": [
        {
          "foo": "bar"
        }
      ],
      "created_at": "2019-12-27T18:11:19.117Z",
      "created_by": "created_by",
      "description": "This is one remote mcp server",
      "error": "error",
      "last_successful_sync": "2019-12-27T18:11:19.117Z",
      "last_synced": "2019-12-27T18:11:19.117Z",
      "modified_at": "2019-12-27T18:11:19.117Z",
      "modified_by": "modified_by",
      "status": "status",
      "updated_prompts": [
        {
          "name": "name",
          "alias": "my-custom-alias",
          "description": "description",
          "enabled": true
        }
      ],
      "updated_tools": [
        {
          "name": "name",
          "alias": "my-custom-alias",
          "description": "description",
          "enabled": true
        }
      ]
    }
  ],
  "success": true
}
```

## Create a new MCP Server

`client.zeroTrust.access.aiControls.mcp.servers.create(ServerCreateParamsparams, RequestOptionsoptions?): ServerCreateResponse`

**post** `/accounts/{account_id}/access/ai-controls/mcp/servers`

Creates a new MCP portal for managing AI tool access through Cloudflare Access.

### Parameters

- `params: ServerCreateParams`

  - `account_id: string`

    Path param

  - `id: string`

    Body param: server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    Body param

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

    Body param

  - `name: string`

    Body param

  - `auth_credentials?: string`

    Body param

  - `description?: string | null`

    Body param

  - `updated_prompts?: Array<UpdatedPrompt>`

    Body param

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    Body param

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Returns

- `ServerCreateResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const server = await client.zeroTrust.access.aiControls.mcp.servers.create({
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
  id: 'my-mcp-server',
  auth_type: 'unauthenticated',
  hostname: 'https://example.com/mcp',
  name: 'My MCP Server',
});

console.log(server.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-server",
    "auth_type": "unauthenticated",
    "hostname": "https://example.com/mcp",
    "name": "My MCP Server",
    "prompts": [
      {
        "foo": "bar"
      }
    ],
    "tools": [
      {
        "foo": "bar"
      }
    ],
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is one remote mcp server",
    "error": "error",
    "last_successful_sync": "2019-12-27T18:11:19.117Z",
    "last_synced": "2019-12-27T18:11:19.117Z",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "status": "status",
    "updated_prompts": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ],
    "updated_tools": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ]
  },
  "success": true
}
```

## Read the details of a MCP Server

`client.zeroTrust.access.aiControls.mcp.servers.read(stringid, ServerReadParamsparams, RequestOptionsoptions?): ServerReadResponse`

**get** `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`

Retrieves gateway configuration for MCP portals.

### Parameters

- `id: string`

  server id

- `params: ServerReadParams`

  - `account_id: string`

### Returns

- `ServerReadResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.aiControls.mcp.servers.read('my-mcp-server', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(response.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-server",
    "auth_type": "unauthenticated",
    "hostname": "https://example.com/mcp",
    "name": "My MCP Server",
    "prompts": [
      {
        "foo": "bar"
      }
    ],
    "tools": [
      {
        "foo": "bar"
      }
    ],
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is one remote mcp server",
    "error": "error",
    "last_successful_sync": "2019-12-27T18:11:19.117Z",
    "last_synced": "2019-12-27T18:11:19.117Z",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "status": "status",
    "updated_prompts": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ],
    "updated_tools": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ]
  },
  "success": true
}
```

## Update a MCP Server

`client.zeroTrust.access.aiControls.mcp.servers.update(stringid, ServerUpdateParamsparams, RequestOptionsoptions?): ServerUpdateResponse`

**put** `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`

Updates an MCP portal configuration.

### Parameters

- `id: string`

  server id

- `params: ServerUpdateParams`

  - `account_id: string`

    Path param

  - `auth_credentials?: string`

    Body param

  - `description?: string | null`

    Body param

  - `name?: string`

    Body param

  - `updated_prompts?: Array<UpdatedPrompt>`

    Body param

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    Body param

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Returns

- `ServerUpdateResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const server = await client.zeroTrust.access.aiControls.mcp.servers.update('my-mcp-server', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(server.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-server",
    "auth_type": "unauthenticated",
    "hostname": "https://example.com/mcp",
    "name": "My MCP Server",
    "prompts": [
      {
        "foo": "bar"
      }
    ],
    "tools": [
      {
        "foo": "bar"
      }
    ],
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is one remote mcp server",
    "error": "error",
    "last_successful_sync": "2019-12-27T18:11:19.117Z",
    "last_synced": "2019-12-27T18:11:19.117Z",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "status": "status",
    "updated_prompts": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ],
    "updated_tools": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ]
  },
  "success": true
}
```

## Delete a MCP Server

`client.zeroTrust.access.aiControls.mcp.servers.delete(stringid, ServerDeleteParamsparams, RequestOptionsoptions?): ServerDeleteResponse`

**delete** `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`

Deletes an MCP portal from the account.

### Parameters

- `id: string`

  server id

- `params: ServerDeleteParams`

  - `account_id: string`

### Returns

- `ServerDeleteResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const server = await client.zeroTrust.access.aiControls.mcp.servers.delete('my-mcp-server', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(server.id);
```

#### Response

```json
{
  "result": {
    "id": "my-mcp-server",
    "auth_type": "unauthenticated",
    "hostname": "https://example.com/mcp",
    "name": "My MCP Server",
    "prompts": [
      {
        "foo": "bar"
      }
    ],
    "tools": [
      {
        "foo": "bar"
      }
    ],
    "created_at": "2019-12-27T18:11:19.117Z",
    "created_by": "created_by",
    "description": "This is one remote mcp server",
    "error": "error",
    "last_successful_sync": "2019-12-27T18:11:19.117Z",
    "last_synced": "2019-12-27T18:11:19.117Z",
    "modified_at": "2019-12-27T18:11:19.117Z",
    "modified_by": "modified_by",
    "status": "status",
    "updated_prompts": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ],
    "updated_tools": [
      {
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": true
      }
    ]
  },
  "success": true
}
```

## Sync MCP Server Capabilities

`client.zeroTrust.access.aiControls.mcp.servers.sync(stringid, ServerSyncParamsparams, RequestOptionsoptions?): ServerSyncResponse`

**post** `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync`

Syncs an MCP server's tool catalog with the portal.

### Parameters

- `id: string`

  portal id

- `params: ServerSyncParams`

  - `account_id: string`

### Returns

- `ServerSyncResponse = unknown`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.aiControls.mcp.servers.sync('my-mcp-portal', {
  account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
});

console.log(response);
```

#### Response

```json
{
  "result": {},
  "success": true
}
```

## Domain Types

### Server List Response

- `ServerListResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Server Create Response

- `ServerCreateResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Server Read Response

- `ServerReadResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Server Update Response

- `ServerUpdateResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Server Delete Response

- `ServerDeleteResponse`

  - `id: string`

    server id

  - `auth_type: "oauth" | "bearer" | "unauthenticated"`

    - `"oauth"`

    - `"bearer"`

    - `"unauthenticated"`

  - `hostname: string`

  - `name: string`

  - `prompts: Array<Record<string, unknown>>`

  - `tools: Array<Record<string, unknown>>`

  - `created_at?: string`

  - `created_by?: string`

  - `description?: string | null`

  - `error?: string`

  - `last_successful_sync?: string`

  - `last_synced?: string`

  - `modified_at?: string`

  - `modified_by?: string`

  - `status?: string`

  - `updated_prompts?: Array<UpdatedPrompt>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

  - `updated_tools?: Array<UpdatedTool>`

    - `name: string`

    - `alias?: string`

    - `description?: string`

    - `enabled?: boolean`

### Server Sync Response

- `ServerSyncResponse = unknown`

# Gateway CA

## List SSH Certificate Authorities (CA)

`client.zeroTrust.access.gatewayCA.list(GatewayCAListParamsparams, RequestOptionsoptions?): SinglePage<GatewayCAListResponse>`

**get** `/accounts/{account_id}/access/gateway_ca`

Lists SSH Certificate Authorities (CA).

### Parameters

- `params: GatewayCAListParams`

  - `account_id: string`

    Identifier.

### Returns

- `GatewayCAListResponse`

  - `id?: string`

    The key ID of this certificate.

  - `public_key?: string`

    The public key of this certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const gatewayCAListResponse of client.zeroTrust.access.gatewayCA.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(gatewayCAListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "id",
      "public_key": "public_key"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Add a new SSH Certificate Authority (CA)

`client.zeroTrust.access.gatewayCA.create(GatewayCACreateParamsparams, RequestOptionsoptions?): GatewayCACreateResponse`

**post** `/accounts/{account_id}/access/gateway_ca`

Adds a new SSH Certificate Authority (CA).

### Parameters

- `params: GatewayCACreateParams`

  - `account_id: string`

    Identifier.

### Returns

- `GatewayCACreateResponse`

  - `id?: string`

    The key ID of this certificate.

  - `public_key?: string`

    The public key of this certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const gatewayCA = await client.zeroTrust.access.gatewayCA.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(gatewayCA.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "public_key": "public_key"
  }
}
```

## Delete an SSH Certificate Authority (CA)

`client.zeroTrust.access.gatewayCA.delete(stringcertificateId, GatewayCADeleteParamsparams, RequestOptionsoptions?): GatewayCADeleteResponse`

**delete** `/accounts/{account_id}/access/gateway_ca/{certificate_id}`

Deletes an SSH Certificate Authority.

### Parameters

- `certificateId: string`

  UUID.

- `params: GatewayCADeleteParams`

  - `account_id: string`

    Identifier.

### Returns

- `GatewayCADeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const gatewayCA = await client.zeroTrust.access.gatewayCA.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(gatewayCA.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Gateway CA List Response

- `GatewayCAListResponse`

  - `id?: string`

    The key ID of this certificate.

  - `public_key?: string`

    The public key of this certificate.

### Gateway CA Create Response

- `GatewayCACreateResponse`

  - `id?: string`

    The key ID of this certificate.

  - `public_key?: string`

    The public key of this certificate.

### Gateway CA Delete Response

- `GatewayCADeleteResponse`

  - `id?: string`

    UUID.

# Infrastructure

# Targets

## List all targets

`client.zeroTrust.access.infrastructure.targets.list(TargetListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<TargetListResponse>`

**get** `/accounts/{account_id}/infrastructure/targets`

Lists and sorts an account’s targets. Filters are optional and are ANDed
together.

### Parameters

- `params: TargetListParams`

  - `account_id: string`

    Path param: Account identifier

  - `created_after?: string | null`

    Query param: Date and time at which the target was created after (inclusive)

  - `created_before?: string | null`

    Query param: Date and time at which the target was created before (inclusive)

  - `direction?: "asc" | "desc"`

    Query param: The sorting direction.

    - `"asc"`

    - `"desc"`

  - `hostname?: string | null`

    Query param: Hostname of a target

  - `hostname_contains?: string | null`

    Query param: Partial match to the hostname of a target

  - `ip_like?: string | null`

    Query param: Filters for targets whose IP addresses look like the specified string.
    Supports `*` as a wildcard character

  - `ip_v4?: string | null`

    Query param: IPv4 address of the target

  - `ip_v6?: string | null`

    Query param: IPv6 address of the target

  - `ips?: Array<string>`

    Query param: Filters for targets that have any of the following IP addresses. Specify
    `ips` multiple times in query parameter to build list of candidates.

  - `ipv4_end?: string | null`

    Query param: Defines an IPv4 filter range's ending value (inclusive). Requires
    `ipv4_start` to be specified as well.

  - `ipv4_start?: string | null`

    Query param: Defines an IPv4 filter range's starting value (inclusive). Requires
    `ipv4_end` to be specified as well.

  - `ipv6_end?: string | null`

    Query param: Defines an IPv6 filter range's ending value (inclusive). Requires
    `ipv6_start` to be specified as well.

  - `ipv6_start?: string | null`

    Query param: Defines an IPv6 filter range's starting value (inclusive). Requires
    `ipv6_end` to be specified as well.

  - `modified_after?: string | null`

    Query param: Date and time at which the target was modified after (inclusive)

  - `modified_before?: string | null`

    Query param: Date and time at which the target was modified before (inclusive)

  - `order?: "hostname" | "created_at"`

    Query param: The field to sort by.

    - `"hostname"`

    - `"created_at"`

  - `page?: number`

    Query param: Current page in the response

  - `per_page?: number`

    Query param: Max amount of entries returned per page

  - `target_ids?: Array<string>`

    Query param: Filters for targets that have any of the following UUIDs. Specify
    `target_ids` multiple times in query parameter to build list of
    candidates.

  - `virtual_network_id?: string | null`

    Query param: Private virtual network identifier of the target

### Returns

- `TargetListResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const targetListResponse of client.zeroTrust.access.infrastructure.targets.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(targetListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
      "created_at": "2019-08-24T14:15:22Z",
      "hostname": "infra-access-target",
      "ip": {
        "ipv4": {
          "ip_addr": "187.26.29.249",
          "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
        },
        "ipv6": {
          "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
          "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
        }
      },
      "modified_at": "2019-08-24T14:15:22Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get target

`client.zeroTrust.access.infrastructure.targets.get(stringtargetId, TargetGetParamsparams, RequestOptionsoptions?): TargetGetResponse`

**get** `/accounts/{account_id}/infrastructure/targets/{target_id}`

Get target

### Parameters

- `targetId: string`

  Target identifier

- `params: TargetGetParams`

  - `account_id: string`

    Account identifier

### Returns

- `TargetGetResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const target = await client.zeroTrust.access.infrastructure.targets.get(
  '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(target.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    "created_at": "2019-08-24T14:15:22Z",
    "hostname": "infra-access-target",
    "ip": {
      "ipv4": {
        "ip_addr": "187.26.29.249",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      },
      "ipv6": {
        "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      }
    },
    "modified_at": "2019-08-24T14:15:22Z"
  }
}
```

## Create new target

`client.zeroTrust.access.infrastructure.targets.create(TargetCreateParamsparams, RequestOptionsoptions?): TargetCreateResponse`

**post** `/accounts/{account_id}/infrastructure/targets`

Create new target

### Parameters

- `params: TargetCreateParams`

  - `account_id: string`

    Path param: Account identifier

  - `hostname: string`

    Body param: A non-unique field that refers to a target. Case insensitive, maximum
    length of 255 characters, supports the use of special characters dash
    and period, does not support spaces, and must start and end with an
    alphanumeric character.

  - `ip: IP`

    Body param: The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

### Returns

- `TargetCreateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const target = await client.zeroTrust.access.infrastructure.targets.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  hostname: 'infra-access-target',
  ip: {},
});

console.log(target.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    "created_at": "2019-08-24T14:15:22Z",
    "hostname": "infra-access-target",
    "ip": {
      "ipv4": {
        "ip_addr": "187.26.29.249",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      },
      "ipv6": {
        "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      }
    },
    "modified_at": "2019-08-24T14:15:22Z"
  }
}
```

## Update target

`client.zeroTrust.access.infrastructure.targets.update(stringtargetId, TargetUpdateParamsparams, RequestOptionsoptions?): TargetUpdateResponse`

**put** `/accounts/{account_id}/infrastructure/targets/{target_id}`

Update target

### Parameters

- `targetId: string`

  Target identifier

- `params: TargetUpdateParams`

  - `account_id: string`

    Path param: Account identifier

  - `hostname: string`

    Body param: A non-unique field that refers to a target. Case insensitive, maximum
    length of 255 characters, supports the use of special characters dash
    and period, does not support spaces, and must start and end with an
    alphanumeric character.

  - `ip: IP`

    Body param: The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

### Returns

- `TargetUpdateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const target = await client.zeroTrust.access.infrastructure.targets.update(
  '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e',
  {
    account_id: '023e105f4ecef8ad9ca31a8372d0c353',
    hostname: 'infra-access-target',
    ip: {},
  },
);

console.log(target.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    "created_at": "2019-08-24T14:15:22Z",
    "hostname": "infra-access-target",
    "ip": {
      "ipv4": {
        "ip_addr": "187.26.29.249",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      },
      "ipv6": {
        "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
        "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
      }
    },
    "modified_at": "2019-08-24T14:15:22Z"
  }
}
```

## Delete target

`client.zeroTrust.access.infrastructure.targets.delete(stringtargetId, TargetDeleteParamsparams, RequestOptionsoptions?): void`

**delete** `/accounts/{account_id}/infrastructure/targets/{target_id}`

Delete target

### Parameters

- `targetId: string`

  Target identifier

- `params: TargetDeleteParams`

  - `account_id: string`

    Account identifier

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

await client.zeroTrust.access.infrastructure.targets.delete(
  '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);
```

## Create new targets

`client.zeroTrust.access.infrastructure.targets.bulkUpdate(TargetBulkUpdateParamsparams, RequestOptionsoptions?): SinglePage<TargetBulkUpdateResponse>`

**put** `/accounts/{account_id}/infrastructure/targets/batch`

Adds one or more targets.

### Parameters

- `params: TargetBulkUpdateParams`

  - `account_id: string`

    Path param: Account identifier

  - `body: Array<Body>`

    Body param

    - `hostname: string`

      A non-unique field that refers to a target. Case insensitive, maximum
      length of 255 characters, supports the use of special characters dash
      and period, does not support spaces, and must start and end with an
      alphanumeric character.

    - `ip: IP`

      The IPv4/IPv6 address that identifies where to reach a target

      - `ipv4?: IPV4`

        The target's IPv4 address

        - `ip_addr?: string`

          IP address of the target

        - `virtual_network_id?: string`

          (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

      - `ipv6?: IPV6`

        The target's IPv6 address

        - `ip_addr?: string`

          IP address of the target

        - `virtual_network_id?: string`

          (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

### Returns

- `TargetBulkUpdateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const targetBulkUpdateResponse of client.zeroTrust.access.infrastructure.targets.bulkUpdate(
  {
    account_id: '023e105f4ecef8ad9ca31a8372d0c353',
    body: [
      {
        hostname: 'infra-access-target',
        ip: {},
      },
    ],
  },
)) {
  console.log(targetBulkUpdateResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
      "created_at": "2019-08-24T14:15:22Z",
      "hostname": "infra-access-target",
      "ip": {
        "ipv4": {
          "ip_addr": "187.26.29.249",
          "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
        },
        "ipv6": {
          "ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
          "virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
        }
      },
      "modified_at": "2019-08-24T14:15:22Z"
    }
  ]
}
```

## Delete targets (Deprecated)

`client.zeroTrust.access.infrastructure.targets.bulkDelete(TargetBulkDeleteParamsparams, RequestOptionsoptions?): void`

**delete** `/accounts/{account_id}/infrastructure/targets/batch`

Removes one or more targets.

### Parameters

- `params: TargetBulkDeleteParams`

  - `account_id: string`

    Account identifier

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

await client.zeroTrust.access.infrastructure.targets.bulkDelete({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});
```

## Delete targets

`client.zeroTrust.access.infrastructure.targets.bulkDeleteV2(TargetBulkDeleteV2Paramsparams, RequestOptionsoptions?): void`

**post** `/accounts/{account_id}/infrastructure/targets/batch_delete`

Removes one or more targets.

### Parameters

- `params: TargetBulkDeleteV2Params`

  - `account_id: string`

    Path param: Account identifier

  - `target_ids: Array<string>`

    Body param: List of target IDs to bulk delete

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

await client.zeroTrust.access.infrastructure.targets.bulkDeleteV2({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  target_ids: ['182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e'],
});
```

## Domain Types

### Target List Response

- `TargetListResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Target Get Response

- `TargetGetResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Target Create Response

- `TargetCreateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Target Update Response

- `TargetUpdateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

### Target Bulk Update Response

- `TargetBulkUpdateResponse`

  - `id: string`

    Target identifier

  - `created_at: string`

    Date and time at which the target was created

  - `hostname: string`

    A non-unique field that refers to a target

  - `ip: IP`

    The IPv4/IPv6 address that identifies where to reach a target

    - `ipv4?: IPV4`

      The target's IPv4 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

    - `ipv6?: IPV6`

      The target's IPv6 address

      - `ip_addr?: string`

        IP address of the target

      - `virtual_network_id?: string`

        (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

  - `modified_at: string`

    Date and time at which the target was modified

# Applications

## List Access applications

`client.zeroTrust.access.applications.list(ApplicationListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<ApplicationListResponse>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps`

Lists all Access applications in an account or zone.

### Parameters

- `params: ApplicationListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `aud?: string`

    Query param: The aud of the app.

  - `domain?: string`

    Query param: The domain of the app.

  - `exact?: boolean`

    Query param: True for only exact string matches against passed name/domain query parameters.

  - `name?: string`

    Query param: The name of the app.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `search?: string`

    Query param: Search for apps by other listed query parameters.

  - `target_attributes?: string`

    Query param: Target Criteria attributes in key=value format.

### Returns

- `ApplicationListResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const applicationListResponse of client.zeroTrust.access.applications.list({
  account_id: 'account_id',
})) {
  console.log(applicationListResponse);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "domain": "test.example.com/admin",
      "type": "self_hosted",
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "allow_authenticate_via_warp": true,
      "allow_iframe": true,
      "allowed_idps": [
        "699d98642c564d2e855e9661899b7252"
      ],
      "app_launcher_visible": true,
      "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
      "auto_redirect_to_identity": true,
      "cors_headers": {
        "allow_all_headers": true,
        "allow_all_methods": true,
        "allow_all_origins": true,
        "allow_credentials": true,
        "allowed_headers": [
          "string"
        ],
        "allowed_methods": [
          "GET"
        ],
        "allowed_origins": [
          "https://example.com"
        ],
        "max_age": -1
      },
      "created_at": "2014-01-01T05:20:00.12345Z",
      "custom_deny_message": "custom_deny_message",
      "custom_deny_url": "custom_deny_url",
      "custom_non_identity_deny_url": "custom_non_identity_deny_url",
      "custom_pages": [
        "699d98642c564d2e855e9661899b7252"
      ],
      "destinations": [
        {
          "type": "public",
          "uri": "test.example.com/admin"
        },
        {
          "type": "public",
          "uri": "test.anotherexample.com/staff"
        },
        {
          "cidr": "10.5.0.0/24",
          "hostname": "hostname",
          "l4_protocol": "tcp",
          "port_range": "80-90",
          "type": "private",
          "vnet_id": "vnet_id"
        },
        {
          "cidr": "10.5.0.3/32",
          "hostname": "hostname",
          "l4_protocol": "tcp",
          "port_range": "80",
          "type": "private",
          "vnet_id": "vnet_id"
        },
        {
          "cidr": "cidr",
          "hostname": "private-sni.example.com",
          "l4_protocol": "tcp",
          "port_range": "port_range",
          "type": "private",
          "vnet_id": "vnet_id"
        },
        {
          "mcp_server_id": "mcp-server-1",
          "type": "via_mcp_server_portal"
        }
      ],
      "enable_binding_cookie": true,
      "http_only_cookie_attribute": true,
      "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
      "mfa_config": {
        "allowed_authenticators": [
          "totp",
          "biometrics",
          "security_key"
        ],
        "mfa_disabled": false,
        "session_duration": "24h"
      },
      "name": "Admin Site",
      "oauth_configuration": {
        "dynamic_client_registration": {
          "allow_any_on_localhost": true,
          "allow_any_on_loopback": true,
          "allowed_uris": [
            "https://example.com/callback"
          ],
          "enabled": true
        },
        "enabled": true,
        "grant": {
          "access_token_lifetime": "5m",
          "session_duration": "24h"
        }
      },
      "options_preflight_bypass": true,
      "path_cookie_attribute": true,
      "policies": [
        {
          "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
          "approval_groups": [
            {
              "approvals_needed": 1,
              "email_addresses": [
                "test1@cloudflare.com",
                "test2@cloudflare.com"
              ],
              "email_list_uuid": "email_list_uuid"
            },
            {
              "approvals_needed": 3,
              "email_addresses": [
                "test@cloudflare.com",
                "test2@cloudflare.com"
              ],
              "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
            }
          ],
          "approval_required": true,
          "connection_rules": {
            "rdp": {
              "allowed_clipboard_local_to_remote_formats": [
                "text"
              ],
              "allowed_clipboard_remote_to_local_formats": [
                "text"
              ]
            }
          },
          "created_at": "2014-01-01T05:20:00.12345Z",
          "decision": "allow",
          "exclude": [
            {
              "group": {
                "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
              }
            }
          ],
          "include": [
            {
              "group": {
                "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
              }
            }
          ],
          "isolation_required": false,
          "mfa_config": {
            "allowed_authenticators": [
              "totp",
              "biometrics",
              "security_key"
            ],
            "mfa_disabled": false,
            "session_duration": "24h"
          },
          "name": "Allow devs",
          "precedence": 0,
          "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
          "purpose_justification_required": true,
          "require": [
            {
              "group": {
                "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
              }
            }
          ],
          "session_duration": "24h",
          "updated_at": "2014-01-01T05:20:00.12345Z"
        }
      ],
      "read_service_tokens_from_header": "Authorization",
      "same_site_cookie_attribute": "strict",
      "scim_config": {
        "idp_uid": "idp_uid",
        "remote_uri": "remote_uri",
        "authentication": {
          "password": "password",
          "scheme": "httpbasic",
          "user": "user"
        },
        "deactivate_on_delete": true,
        "enabled": true,
        "mappings": [
          {
            "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
            "enabled": true,
            "filter": "title pr or userType eq \"Intern\"",
            "operations": {
              "create": true,
              "delete": true,
              "update": true
            },
            "strictness": "strict",
            "transform_jsonata": "$merge([$, {'userName': $substringBefore($.userName, '@') & '+test@' & $substringAfter($.userName, '@')}])"
          }
        ]
      },
      "self_hosted_domains": [
        "test.example.com/admin",
        "test.anotherexample.com/staff"
      ],
      "service_auth_401_redirect": true,
      "session_duration": "24h",
      "skip_interstitial": true,
      "tags": [
        "engineers"
      ],
      "updated_at": "2014-01-01T05:20:00.12345Z",
      "use_clientless_isolation_app_launcher_url": false
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get an Access application

`client.zeroTrust.access.applications.get(AppIDappId, ApplicationGetParamsparams?, RequestOptionsoptions?): ApplicationGetResponse`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}`

Fetches information about an Access application.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: ApplicationGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `ApplicationGetResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const application = await client.zeroTrust.access.applications.get(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(application);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "domain": "test.example.com/admin",
    "type": "self_hosted",
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "allow_authenticate_via_warp": true,
    "allow_iframe": true,
    "allowed_idps": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "app_launcher_visible": true,
    "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
    "auto_redirect_to_identity": true,
    "cors_headers": {
      "allow_all_headers": true,
      "allow_all_methods": true,
      "allow_all_origins": true,
      "allow_credentials": true,
      "allowed_headers": [
        "string"
      ],
      "allowed_methods": [
        "GET"
      ],
      "allowed_origins": [
        "https://example.com"
      ],
      "max_age": -1
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "custom_deny_message": "custom_deny_message",
    "custom_deny_url": "custom_deny_url",
    "custom_non_identity_deny_url": "custom_non_identity_deny_url",
    "custom_pages": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "destinations": [
      {
        "type": "public",
        "uri": "test.example.com/admin"
      },
      {
        "type": "public",
        "uri": "test.anotherexample.com/staff"
      },
      {
        "cidr": "10.5.0.0/24",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80-90",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "10.5.0.3/32",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "cidr",
        "hostname": "private-sni.example.com",
        "l4_protocol": "tcp",
        "port_range": "port_range",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "mcp_server_id": "mcp-server-1",
        "type": "via_mcp_server_portal"
      }
    ],
    "enable_binding_cookie": true,
    "http_only_cookie_attribute": true,
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Admin Site",
    "oauth_configuration": {
      "dynamic_client_registration": {
        "allow_any_on_localhost": true,
        "allow_any_on_loopback": true,
        "allowed_uris": [
          "https://example.com/callback"
        ],
        "enabled": true
      },
      "enabled": true,
      "grant": {
        "access_token_lifetime": "5m",
        "session_duration": "24h"
      }
    },
    "options_preflight_bypass": true,
    "path_cookie_attribute": true,
    "policies": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "approval_groups": [
          {
            "approvals_needed": 1,
            "email_addresses": [
              "test1@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "email_list_uuid"
          },
          {
            "approvals_needed": 3,
            "email_addresses": [
              "test@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
          }
        ],
        "approval_required": true,
        "connection_rules": {
          "rdp": {
            "allowed_clipboard_local_to_remote_formats": [
              "text"
            ],
            "allowed_clipboard_remote_to_local_formats": [
              "text"
            ]
          }
        },
        "created_at": "2014-01-01T05:20:00.12345Z",
        "decision": "allow",
        "exclude": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "include": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "isolation_required": false,
        "mfa_config": {
          "allowed_authenticators": [
            "totp",
            "biometrics",
            "security_key"
          ],
          "mfa_disabled": false,
          "session_duration": "24h"
        },
        "name": "Allow devs",
        "precedence": 0,
        "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
        "purpose_justification_required": true,
        "require": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "session_duration": "24h",
        "updated_at": "2014-01-01T05:20:00.12345Z"
      }
    ],
    "read_service_tokens_from_header": "Authorization",
    "same_site_cookie_attribute": "strict",
    "scim_config": {
      "idp_uid": "idp_uid",
      "remote_uri": "remote_uri",
      "authentication": {
        "password": "password",
        "scheme": "httpbasic",
        "user": "user"
      },
      "deactivate_on_delete": true,
      "enabled": true,
      "mappings": [
        {
          "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
          "enabled": true,
          "filter": "title pr or userType eq \"Intern\"",
          "operations": {
            "create": true,
            "delete": true,
            "update": true
          },
          "strictness": "strict",
          "transform_jsonata": "$merge([$, {'userName': $substringBefore($.userName, '@') & '+test@' & $substringAfter($.userName, '@')}])"
        }
      ]
    },
    "self_hosted_domains": [
      "test.example.com/admin",
      "test.anotherexample.com/staff"
    ],
    "service_auth_401_redirect": true,
    "session_duration": "24h",
    "skip_interstitial": true,
    "tags": [
      "engineers"
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z",
    "use_clientless_isolation_app_launcher_url": false
  }
}
```

## Add an Access application

`client.zeroTrust.access.applications.create(ApplicationCreateParamsparams, RequestOptionsoptions?): ApplicationCreateResponse`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/apps`

Adds a new application to Access.

### Parameters

- `ApplicationCreateParams = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `ApplicationCreateParamsBase`

  - `SelfHostedApplication extends ApplicationCreateParamsBase`

  - `SaaSApplication extends ApplicationCreateParamsBase`

  - `BrowserSSHApplication extends ApplicationCreateParamsBase`

  - `BrowserVNCApplication extends ApplicationCreateParamsBase`

  - `AppLauncherApplication extends ApplicationCreateParamsBase`

  - `DeviceEnrollmentPermissionsApplication extends ApplicationCreateParamsBase`

  - `BrowserIsolationPermissionsApplication extends ApplicationCreateParamsBase`

  - `GatewayIdentityProxyEndpointApplication extends ApplicationCreateParamsBase`

  - `BookmarkApplication extends ApplicationCreateParamsBase`

  - `InfrastructureApplication extends ApplicationCreateParamsBase`

  - `BrowserRDPApplication extends ApplicationCreateParamsBase`

  - `McpServerApplication extends ApplicationCreateParamsBase`

  - `McpServerPortalApplication extends ApplicationCreateParamsBase`

### Returns

- `ApplicationCreateResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const application = await client.zeroTrust.access.applications.create({
  domain: 'test.example.com/admin',
  type: 'self_hosted',
  account_id: 'account_id',
});

console.log(application);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "domain": "test.example.com/admin",
    "type": "self_hosted",
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "allow_authenticate_via_warp": true,
    "allow_iframe": true,
    "allowed_idps": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "app_launcher_visible": true,
    "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
    "auto_redirect_to_identity": true,
    "cors_headers": {
      "allow_all_headers": true,
      "allow_all_methods": true,
      "allow_all_origins": true,
      "allow_credentials": true,
      "allowed_headers": [
        "string"
      ],
      "allowed_methods": [
        "GET"
      ],
      "allowed_origins": [
        "https://example.com"
      ],
      "max_age": -1
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "custom_deny_message": "custom_deny_message",
    "custom_deny_url": "custom_deny_url",
    "custom_non_identity_deny_url": "custom_non_identity_deny_url",
    "custom_pages": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "destinations": [
      {
        "type": "public",
        "uri": "test.example.com/admin"
      },
      {
        "type": "public",
        "uri": "test.anotherexample.com/staff"
      },
      {
        "cidr": "10.5.0.0/24",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80-90",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "10.5.0.3/32",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "cidr",
        "hostname": "private-sni.example.com",
        "l4_protocol": "tcp",
        "port_range": "port_range",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "mcp_server_id": "mcp-server-1",
        "type": "via_mcp_server_portal"
      }
    ],
    "enable_binding_cookie": true,
    "http_only_cookie_attribute": true,
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Admin Site",
    "oauth_configuration": {
      "dynamic_client_registration": {
        "allow_any_on_localhost": true,
        "allow_any_on_loopback": true,
        "allowed_uris": [
          "https://example.com/callback"
        ],
        "enabled": true
      },
      "enabled": true,
      "grant": {
        "access_token_lifetime": "5m",
        "session_duration": "24h"
      }
    },
    "options_preflight_bypass": true,
    "path_cookie_attribute": true,
    "policies": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "approval_groups": [
          {
            "approvals_needed": 1,
            "email_addresses": [
              "test1@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "email_list_uuid"
          },
          {
            "approvals_needed": 3,
            "email_addresses": [
              "test@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
          }
        ],
        "approval_required": true,
        "connection_rules": {
          "rdp": {
            "allowed_clipboard_local_to_remote_formats": [
              "text"
            ],
            "allowed_clipboard_remote_to_local_formats": [
              "text"
            ]
          }
        },
        "created_at": "2014-01-01T05:20:00.12345Z",
        "decision": "allow",
        "exclude": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "include": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "isolation_required": false,
        "mfa_config": {
          "allowed_authenticators": [
            "totp",
            "biometrics",
            "security_key"
          ],
          "mfa_disabled": false,
          "session_duration": "24h"
        },
        "name": "Allow devs",
        "precedence": 0,
        "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
        "purpose_justification_required": true,
        "require": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "session_duration": "24h",
        "updated_at": "2014-01-01T05:20:00.12345Z"
      }
    ],
    "read_service_tokens_from_header": "Authorization",
    "same_site_cookie_attribute": "strict",
    "scim_config": {
      "idp_uid": "idp_uid",
      "remote_uri": "remote_uri",
      "authentication": {
        "password": "password",
        "scheme": "httpbasic",
        "user": "user"
      },
      "deactivate_on_delete": true,
      "enabled": true,
      "mappings": [
        {
          "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
          "enabled": true,
          "filter": "title pr or userType eq \"Intern\"",
          "operations": {
            "create": true,
            "delete": true,
            "update": true
          },
          "strictness": "strict",
          "transform_jsonata": "$merge([$, {'userName': $substringBefore($.userName, '@') & '+test@' & $substringAfter($.userName, '@')}])"
        }
      ]
    },
    "self_hosted_domains": [
      "test.example.com/admin",
      "test.anotherexample.com/staff"
    ],
    "service_auth_401_redirect": true,
    "session_duration": "24h",
    "skip_interstitial": true,
    "tags": [
      "engineers"
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z",
    "use_clientless_isolation_app_launcher_url": false
  }
}
```

## Update an Access application

`client.zeroTrust.access.applications.update(AppIDappId, ApplicationUpdateParamsparams, RequestOptionsoptions?): ApplicationUpdateResponse`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}`

Updates an Access application.

### Parameters

- `app_id: AppID`

  Identifier.

- `ApplicationUpdateParams = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `ApplicationUpdateParamsBase`

  - `SelfHostedApplication extends ApplicationUpdateParamsBase`

  - `SaaSApplication extends ApplicationUpdateParamsBase`

  - `BrowserSSHApplication extends ApplicationUpdateParamsBase`

  - `BrowserVNCApplication extends ApplicationUpdateParamsBase`

  - `AppLauncherApplication extends ApplicationUpdateParamsBase`

  - `DeviceEnrollmentPermissionsApplication extends ApplicationUpdateParamsBase`

  - `BrowserIsolationPermissionsApplication extends ApplicationUpdateParamsBase`

  - `GatewayIdentityProxyEndpointApplication extends ApplicationUpdateParamsBase`

  - `BookmarkApplication extends ApplicationUpdateParamsBase`

  - `InfrastructureApplication extends ApplicationUpdateParamsBase`

  - `BrowserRDPApplication extends ApplicationUpdateParamsBase`

  - `McpServerApplication extends ApplicationUpdateParamsBase`

  - `McpServerPortalApplication extends ApplicationUpdateParamsBase`

### Returns

- `ApplicationUpdateResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const application = await client.zeroTrust.access.applications.update(
  '023e105f4ecef8ad9ca31a8372d0c353',
  {
    domain: 'test.example.com/admin',
    type: 'self_hosted',
    account_id: 'account_id',
  },
);

console.log(application);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "domain": "test.example.com/admin",
    "type": "self_hosted",
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "allow_authenticate_via_warp": true,
    "allow_iframe": true,
    "allowed_idps": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "app_launcher_visible": true,
    "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
    "auto_redirect_to_identity": true,
    "cors_headers": {
      "allow_all_headers": true,
      "allow_all_methods": true,
      "allow_all_origins": true,
      "allow_credentials": true,
      "allowed_headers": [
        "string"
      ],
      "allowed_methods": [
        "GET"
      ],
      "allowed_origins": [
        "https://example.com"
      ],
      "max_age": -1
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "custom_deny_message": "custom_deny_message",
    "custom_deny_url": "custom_deny_url",
    "custom_non_identity_deny_url": "custom_non_identity_deny_url",
    "custom_pages": [
      "699d98642c564d2e855e9661899b7252"
    ],
    "destinations": [
      {
        "type": "public",
        "uri": "test.example.com/admin"
      },
      {
        "type": "public",
        "uri": "test.anotherexample.com/staff"
      },
      {
        "cidr": "10.5.0.0/24",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80-90",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "10.5.0.3/32",
        "hostname": "hostname",
        "l4_protocol": "tcp",
        "port_range": "80",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "cidr": "cidr",
        "hostname": "private-sni.example.com",
        "l4_protocol": "tcp",
        "port_range": "port_range",
        "type": "private",
        "vnet_id": "vnet_id"
      },
      {
        "mcp_server_id": "mcp-server-1",
        "type": "via_mcp_server_portal"
      }
    ],
    "enable_binding_cookie": true,
    "http_only_cookie_attribute": true,
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Admin Site",
    "oauth_configuration": {
      "dynamic_client_registration": {
        "allow_any_on_localhost": true,
        "allow_any_on_loopback": true,
        "allowed_uris": [
          "https://example.com/callback"
        ],
        "enabled": true
      },
      "enabled": true,
      "grant": {
        "access_token_lifetime": "5m",
        "session_duration": "24h"
      }
    },
    "options_preflight_bypass": true,
    "path_cookie_attribute": true,
    "policies": [
      {
        "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
        "approval_groups": [
          {
            "approvals_needed": 1,
            "email_addresses": [
              "test1@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "email_list_uuid"
          },
          {
            "approvals_needed": 3,
            "email_addresses": [
              "test@cloudflare.com",
              "test2@cloudflare.com"
            ],
            "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
          }
        ],
        "approval_required": true,
        "connection_rules": {
          "rdp": {
            "allowed_clipboard_local_to_remote_formats": [
              "text"
            ],
            "allowed_clipboard_remote_to_local_formats": [
              "text"
            ]
          }
        },
        "created_at": "2014-01-01T05:20:00.12345Z",
        "decision": "allow",
        "exclude": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "include": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "isolation_required": false,
        "mfa_config": {
          "allowed_authenticators": [
            "totp",
            "biometrics",
            "security_key"
          ],
          "mfa_disabled": false,
          "session_duration": "24h"
        },
        "name": "Allow devs",
        "precedence": 0,
        "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
        "purpose_justification_required": true,
        "require": [
          {
            "group": {
              "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
            }
          }
        ],
        "session_duration": "24h",
        "updated_at": "2014-01-01T05:20:00.12345Z"
      }
    ],
    "read_service_tokens_from_header": "Authorization",
    "same_site_cookie_attribute": "strict",
    "scim_config": {
      "idp_uid": "idp_uid",
      "remote_uri": "remote_uri",
      "authentication": {
        "password": "password",
        "scheme": "httpbasic",
        "user": "user"
      },
      "deactivate_on_delete": true,
      "enabled": true,
      "mappings": [
        {
          "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
          "enabled": true,
          "filter": "title pr or userType eq \"Intern\"",
          "operations": {
            "create": true,
            "delete": true,
            "update": true
          },
          "strictness": "strict",
          "transform_jsonata": "$merge([$, {'userName': $substringBefore($.userName, '@') & '+test@' & $substringAfter($.userName, '@')}])"
        }
      ]
    },
    "self_hosted_domains": [
      "test.example.com/admin",
      "test.anotherexample.com/staff"
    ],
    "service_auth_401_redirect": true,
    "session_duration": "24h",
    "skip_interstitial": true,
    "tags": [
      "engineers"
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z",
    "use_clientless_isolation_app_launcher_url": false
  }
}
```

## Delete an Access application

`client.zeroTrust.access.applications.delete(AppIDappId, ApplicationDeleteParamsparams?, RequestOptionsoptions?): ApplicationDeleteResponse`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}`

Deletes an application from Access.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: ApplicationDeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `ApplicationDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const application = await client.zeroTrust.access.applications.delete(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(application.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Revoke application tokens

`client.zeroTrust.access.applications.revokeTokens(AppIDappId, ApplicationRevokeTokensParamsparams?, RequestOptionsoptions?): ApplicationRevokeTokensResponse | null`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/revoke_tokens`

Revokes all tokens issued for an application.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: ApplicationRevokeTokensParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `ApplicationRevokeTokensResponse = unknown`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.applications.revokeTokens(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(response);
```

#### Response

```json
{
  "result": {},
  "success": true
}
```

## Domain Types

### Allowed Headers

- `AllowedHeaders = string`

### Allowed IdPs

- `AllowedIdPs = string`

  The identity providers selected for application.

### Allowed Methods

- `AllowedMethods = "GET" | "POST" | "HEAD" | 6 more`

  - `"GET"`

  - `"POST"`

  - `"HEAD"`

  - `"PUT"`

  - `"DELETE"`

  - `"CONNECT"`

  - `"OPTIONS"`

  - `"TRACE"`

  - `"PATCH"`

### Allowed Origins

- `AllowedOrigins = string`

### App ID

- `AppID = string`

  Identifier.

### Application

- `Application = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 5 more`

  - `SelfHostedApplication`

    - `domain: string`

      The domain and path that Access will secure.

    - `type: string`

      The application type.

    - `id?: string`

      UUID.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<unknown>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<unknown>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `created_at?: string`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application.

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `AccessSchemasSCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `AccessSchemasSCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

            - `token: string`

              Token used to authenticate with the remote SCIM service.

            - `scheme: "oauthbearertoken"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"oauthbearertoken"`

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set `active` to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `updated_at?: string`

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `created_at?: string`

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `saas_app?: AccessSchemasSAMLSaaSApp | AccessSchemasOIDCSaaSApp`

      - `AccessSchemasSAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `created_at?: string`

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to attribute name.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

        - `updated_at?: string`

      - `AccessSchemasOIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `created_at?: string`

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint.

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

        - `updated_at?: string`

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `type?: string`

      The application type.

    - `updated_at?: string`

  - `BrowserSSHApplication`

    - `domain: string`

      The domain and path that Access will secure.

    - `type: string`

      The application type.

    - `id?: string`

      UUID.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<unknown>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<unknown>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `created_at?: string`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application.

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `updated_at?: string`

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The domain and path that Access will secure.

    - `type: string`

      The application type.

    - `id?: string`

      UUID.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<unknown>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<unknown>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `created_at?: string`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application.

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `updated_at?: string`

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 6 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `created_at?: string`

    - `domain?: string`

      The domain and path that Access will secure.

    - `name?: string`

      The name of the application.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `updated_at?: string`

  - `DeviceEnrollmentPermissionsApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 6 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `created_at?: string`

    - `domain?: string`

      The domain and path that Access will secure.

    - `name?: string`

      The name of the application.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `updated_at?: string`

  - `BrowserIsolationPermissionsApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 6 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `created_at?: string`

    - `domain?: string`

      The domain and path that Access will secure.

    - `name?: string`

      The name of the application.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `updated_at?: string`

  - `BookmarkApplication`

    - `domain: string`

      The URL or domain of the bookmark.

    - `type: string`

      The application type.

    - `id?: string`

      UUID.

    - `app_launcher_visible?: unknown`

    - `aud?: string`

      Audience tag.

    - `created_at?: string`

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `scim_config?: ApplicationSCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

    - `updated_at?: string`

### Application Policy

- `ApplicationPolicy`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Application SCIM Config

- `ApplicationSCIMConfig`

  Configuration for provisioning to this application via SCIM. This is currently in closed beta.

  - `idp_uid: string`

    The UID of the IdP to use as the source for SCIM resources to provision to this application.

  - `remote_uri: string`

    The base URI for the application's SCIM-compatible API.

  - `authentication?: SCIMConfigAuthenticationHTTPBasic | AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

    Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

    - `SCIMConfigAuthenticationHTTPBasic`

      Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

      - `password: string`

        Password used to authenticate with the remote SCIM service.

      - `scheme: "httpbasic"`

        The authentication scheme to use when making SCIM requests to this application.

        - `"httpbasic"`

      - `user: string`

        User name used to authenticate with the remote SCIM service.

    - `AccessSchemasSCIMConfigAuthenticationOAuthBearerToken`

      Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

      - `token: string`

        Token used to authenticate with the remote SCIM service.

      - `scheme: "oauthbearertoken"`

        The authentication scheme to use when making SCIM requests to this application.

        - `"oauthbearertoken"`

    - `SCIMConfigAuthenticationOauth2`

      Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

      - `authorization_url: string`

        URL used to generate the auth code used during token generation.

      - `client_id: string`

        Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

      - `client_secret: string`

        Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

      - `scheme: "oauth2"`

        The authentication scheme to use when making SCIM requests to this application.

        - `"oauth2"`

      - `token_url: string`

        URL used to generate the token used to authenticate with the remote SCIM service.

      - `scopes?: Array<string>`

        The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

    - `AccessSCIMConfigAuthenticationAccessServiceToken`

      Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

      - `client_id: string`

        Client ID of the Access service token used to authenticate with the remote service.

      - `client_secret: string`

        Client secret of the Access service token used to authenticate with the remote service.

      - `scheme: "access_service_token"`

        The authentication scheme to use when making SCIM requests to this application.

        - `"access_service_token"`

    - `Array<SCIMConfigAuthenticationHTTPBasic | AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

      - `SCIMConfigAuthenticationHTTPBasic`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

      - `AccessSchemasSCIMConfigAuthenticationOAuthBearerToken`

        Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `token: string`

          Token used to authenticate with the remote SCIM service.

        - `scheme: "oauthbearertoken"`

          The authentication scheme to use when making SCIM requests to this application.

          - `"oauthbearertoken"`

      - `SCIMConfigAuthenticationOauth2`

        Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

      - `AccessSCIMConfigAuthenticationAccessServiceToken`

        Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

        - `client_id: string`

          Client ID of the Access service token used to authenticate with the remote service.

        - `client_secret: string`

          Client secret of the Access service token used to authenticate with the remote service.

        - `scheme: "access_service_token"`

          The authentication scheme to use when making SCIM requests to this application.

          - `"access_service_token"`

  - `deactivate_on_delete?: boolean`

    If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set `active` to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

  - `enabled?: boolean`

    Whether SCIM provisioning is turned on for this application.

  - `mappings?: Array<SCIMConfigMapping>`

    A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

    - `schema: string`

      Which SCIM resource type this mapping applies to.

    - `enabled?: boolean`

      Whether or not this mapping is enabled.

    - `filter?: string`

      A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

    - `operations?: Operations`

      Whether or not this mapping applies to creates, updates, or deletes.

      - `create?: boolean`

        Whether or not this mapping applies to create (POST) operations.

      - `delete?: boolean`

        Whether or not this mapping applies to DELETE operations.

      - `update?: boolean`

        Whether or not this mapping applies to update (PATCH/PUT) operations.

    - `strictness?: "strict" | "passthrough"`

      The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

      - `"strict"`

      - `"passthrough"`

    - `transform_jsonata?: string`

      A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

### Application Type

- `ApplicationType = "self_hosted" | "saas" | "ssh" | 11 more`

  The application type.

  - `"self_hosted"`

  - `"saas"`

  - `"ssh"`

  - `"vnc"`

  - `"app_launcher"`

  - `"warp"`

  - `"biso"`

  - `"bookmark"`

  - `"dash_sso"`

  - `"infrastructure"`

  - `"rdp"`

  - `"mcp"`

  - `"mcp_portal"`

  - `"proxy_endpoint"`

### CORS Headers

- `CORSHeaders`

  - `allow_all_headers?: boolean`

    Allows all HTTP request headers.

  - `allow_all_methods?: boolean`

    Allows all HTTP request methods.

  - `allow_all_origins?: boolean`

    Allows all origins.

  - `allow_credentials?: boolean`

    When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

  - `allowed_headers?: Array<AllowedHeaders>`

    Allowed HTTP request headers.

  - `allowed_methods?: Array<AllowedMethods>`

    Allowed HTTP request methods.

    - `"GET"`

    - `"POST"`

    - `"HEAD"`

    - `"PUT"`

    - `"DELETE"`

    - `"CONNECT"`

    - `"OPTIONS"`

    - `"TRACE"`

    - `"PATCH"`

  - `allowed_origins?: Array<AllowedOrigins>`

    Allowed origins.

  - `max_age?: number`

    The maximum number of seconds the results of a preflight request can be cached.

### Decision

- `Decision = "allow" | "deny" | "non_identity" | "bypass"`

  The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

  - `"allow"`

  - `"deny"`

  - `"non_identity"`

  - `"bypass"`

### OIDC SaaS App

- `OIDCSaaSApp`

  - `access_token_lifetime?: string`

    The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

  - `allow_pkce_without_client_secret?: boolean`

    If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

  - `app_launcher_url?: string`

    The URL where this applications tile redirects users

  - `auth_type?: "saml" | "oidc"`

    Identifier of the authentication protocol used for the saas app. Required for OIDC.

    - `"saml"`

    - `"oidc"`

  - `client_id?: string`

    The application client id

  - `client_secret?: string`

    The application client secret, only returned on POST request.

  - `custom_claims?: Array<CustomClaim>`

    - `name?: string`

      The name of the claim.

    - `required?: boolean`

      If the claim is required when building an OIDC token.

    - `scope?: "groups" | "profile" | "email" | "openid"`

      The scope of the claim.

      - `"groups"`

      - `"profile"`

      - `"email"`

      - `"openid"`

    - `source?: Source`

      - `name?: string`

        The name of the IdP claim.

      - `name_by_idp?: Record<string, string>`

        A mapping from IdP ID to claim name.

  - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

    The OIDC flows supported by this application

    - `"authorization_code"`

    - `"authorization_code_with_pkce"`

    - `"refresh_tokens"`

    - `"hybrid"`

    - `"implicit"`

  - `group_filter_regex?: string`

    A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

  - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

    - `return_access_token_from_authorization_endpoint?: boolean`

      If an Access Token should be returned from the OIDC Authorization endpoint

    - `return_id_token_from_authorization_endpoint?: boolean`

      If an ID Token should be returned from the OIDC Authorization endpoint

  - `public_key?: string`

    The Access public certificate that will be used to verify your identity.

  - `redirect_uris?: Array<string>`

    The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

  - `refresh_token_options?: RefreshTokenOptions`

    - `lifetime?: string`

      How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

  - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

    Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

    - `"openid"`

    - `"groups"`

    - `"email"`

    - `"profile"`

### SaaS App Name ID Format

- `SaaSAppNameIDFormat = "id" | "email"`

  The format of the name identifier sent to the SaaS application.

  - `"id"`

  - `"email"`

### SAML SaaS App

- `SAMLSaaSApp`

  - `auth_type?: "saml" | "oidc"`

    Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

    - `"saml"`

    - `"oidc"`

  - `consumer_service_url?: string`

    The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

  - `custom_attributes?: Array<CustomAttribute>`

    - `friendly_name?: string`

      The SAML FriendlyName of the attribute.

    - `name?: string`

      The name of the attribute.

    - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

      A globally unique name for an identity or service provider.

      - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

      - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

      - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

    - `required?: boolean`

      If the attribute is required when building a SAML assertion.

    - `source?: Source`

      - `name?: string`

        The name of the IdP attribute.

      - `name_by_idp?: Array<NameByIdP>`

        A mapping from IdP ID to attribute name.

        - `idp_id?: string`

          The UID of the IdP.

        - `source_name?: string`

          The name of the IdP provided attribute.

  - `default_relay_state?: string`

    The URL that the user will be redirected to after a successful login for IDP initiated logins.

  - `idp_entity_id?: string`

    The unique identifier for your SaaS application.

  - `name_id_format?: SaaSAppNameIDFormat`

    The format of the name identifier sent to the SaaS application.

    - `"id"`

    - `"email"`

  - `name_id_transform_jsonata?: string`

    A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

  - `public_key?: string`

    The Access public certificate that will be used to verify your identity.

  - `saml_attribute_transform_jsonata?: string`

    A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

  - `sp_entity_id?: string`

    A globally unique name for an identity or service provider.

  - `sso_endpoint?: string`

    The endpoint where your SaaS application will send login requests.

### SCIM Config Authentication HTTP Basic

- `SCIMConfigAuthenticationHTTPBasic`

  Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

  - `password: string`

    Password used to authenticate with the remote SCIM service.

  - `scheme: "httpbasic"`

    The authentication scheme to use when making SCIM requests to this application.

    - `"httpbasic"`

  - `user: string`

    User name used to authenticate with the remote SCIM service.

### SCIM Config Authentication OAuth Bearer Token

- `SCIMConfigAuthenticationOAuthBearerToken`

  Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

  - `token: string`

    Token used to authenticate with the remote SCIM service.

  - `scheme: "oauthbearertoken"`

    The authentication scheme to use when making SCIM requests to this application.

    - `"oauthbearertoken"`

### SCIM Config Authentication Oauth2

- `SCIMConfigAuthenticationOauth2`

  Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

  - `authorization_url: string`

    URL used to generate the auth code used during token generation.

  - `client_id: string`

    Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

  - `client_secret: string`

    Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

  - `scheme: "oauth2"`

    The authentication scheme to use when making SCIM requests to this application.

    - `"oauth2"`

  - `token_url: string`

    URL used to generate the token used to authenticate with the remote SCIM service.

  - `scopes?: Array<string>`

    The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

### SCIM Config Mapping

- `SCIMConfigMapping`

  Transformations and filters applied to resources before they are provisioned in the remote SCIM service.

  - `schema: string`

    Which SCIM resource type this mapping applies to.

  - `enabled?: boolean`

    Whether or not this mapping is enabled.

  - `filter?: string`

    A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

  - `operations?: Operations`

    Whether or not this mapping applies to creates, updates, or deletes.

    - `create?: boolean`

      Whether or not this mapping applies to create (POST) operations.

    - `delete?: boolean`

      Whether or not this mapping applies to DELETE operations.

    - `update?: boolean`

      Whether or not this mapping applies to update (PATCH/PUT) operations.

  - `strictness?: "strict" | "passthrough"`

    The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

    - `"strict"`

    - `"passthrough"`

  - `transform_jsonata?: string`

    A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

### Self Hosted Domains

- `SelfHostedDomains = string`

  A domain that Access will secure.

### Application List Response

- `ApplicationListResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Application Get Response

- `ApplicationGetResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Application Create Response

- `ApplicationCreateResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Application Update Response

- `ApplicationUpdateResponse = SelfHostedApplication | SaaSApplication | BrowserSSHApplication | 10 more`

  - `SelfHostedApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: ApplicationType`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

      - `allow_all_headers?: boolean`

        Allows all HTTP request headers.

      - `allow_all_methods?: boolean`

        Allows all HTTP request methods.

      - `allow_all_origins?: boolean`

        Allows all origins.

      - `allow_credentials?: boolean`

        When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.

      - `allowed_headers?: Array<AllowedHeaders>`

        Allowed HTTP request headers.

      - `allowed_methods?: Array<AllowedMethods>`

        Allowed HTTP request methods.

        - `"GET"`

        - `"POST"`

        - `"HEAD"`

        - `"PUT"`

        - `"DELETE"`

        - `"CONNECT"`

        - `"OPTIONS"`

        - `"TRACE"`

        - `"PATCH"`

      - `allowed_origins?: Array<AllowedOrigins>`

        Allowed origins.

      - `max_age?: number`

        The maximum number of seconds the results of a preflight request can be cached.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `password: string`

            Password used to authenticate with the remote SCIM service.

          - `scheme: "httpbasic"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"httpbasic"`

          - `user: string`

            User name used to authenticate with the remote SCIM service.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `token: string`

            Token used to authenticate with the remote SCIM service.

          - `scheme: "oauthbearertoken"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauthbearertoken"`

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `authorization_url: string`

            URL used to generate the auth code used during token generation.

          - `client_id: string`

            Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

          - `client_secret: string`

            Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

          - `scheme: "oauth2"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"oauth2"`

          - `token_url: string`

            URL used to generate the token used to authenticate with the remote SCIM service.

          - `scopes?: Array<string>`

            The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

          - `create?: boolean`

            Whether or not this mapping applies to create (POST) operations.

          - `delete?: boolean`

            Whether or not this mapping applies to DELETE operations.

          - `update?: boolean`

            Whether or not this mapping applies to update (PATCH/PUT) operations.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

          - `"strict"`

          - `"passthrough"`

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `SaaSApplication`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `saas_app?: SAMLSaaSApp | OIDCSaaSApp`

      - `SAMLSaaSApp`

        - `auth_type?: "saml" | "oidc"`

          Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"

          - `"saml"`

          - `"oidc"`

        - `consumer_service_url?: string`

          The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.

        - `custom_attributes?: Array<CustomAttribute>`

          - `friendly_name?: string`

            The SAML FriendlyName of the attribute.

          - `name?: string`

            The name of the attribute.

          - `name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

            A globally unique name for an identity or service provider.

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"`

            - `"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"`

          - `required?: boolean`

            If the attribute is required when building a SAML assertion.

          - `source?: Source`

            - `name?: string`

              The name of the IdP attribute.

            - `name_by_idp?: Array<NameByIdP>`

              A mapping from IdP ID to attribute name.

              - `idp_id?: string`

                The UID of the IdP.

              - `source_name?: string`

                The name of the IdP provided attribute.

        - `default_relay_state?: string`

          The URL that the user will be redirected to after a successful login for IDP initiated logins.

        - `idp_entity_id?: string`

          The unique identifier for your SaaS application.

        - `name_id_format?: SaaSAppNameIDFormat`

          The format of the name identifier sent to the SaaS application.

          - `"id"`

          - `"email"`

        - `name_id_transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `saml_attribute_transform_jsonata?: string`

          A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

        - `sp_entity_id?: string`

          A globally unique name for an identity or service provider.

        - `sso_endpoint?: string`

          The endpoint where your SaaS application will send login requests.

      - `OIDCSaaSApp`

        - `access_token_lifetime?: string`

          The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

        - `allow_pkce_without_client_secret?: boolean`

          If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

        - `app_launcher_url?: string`

          The URL where this applications tile redirects users

        - `auth_type?: "saml" | "oidc"`

          Identifier of the authentication protocol used for the saas app. Required for OIDC.

          - `"saml"`

          - `"oidc"`

        - `client_id?: string`

          The application client id

        - `client_secret?: string`

          The application client secret, only returned on POST request.

        - `custom_claims?: Array<CustomClaim>`

          - `name?: string`

            The name of the claim.

          - `required?: boolean`

            If the claim is required when building an OIDC token.

          - `scope?: "groups" | "profile" | "email" | "openid"`

            The scope of the claim.

            - `"groups"`

            - `"profile"`

            - `"email"`

            - `"openid"`

          - `source?: Source`

            - `name?: string`

              The name of the IdP claim.

            - `name_by_idp?: Record<string, string>`

              A mapping from IdP ID to claim name.

        - `grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>`

          The OIDC flows supported by this application

          - `"authorization_code"`

          - `"authorization_code_with_pkce"`

          - `"refresh_tokens"`

          - `"hybrid"`

          - `"implicit"`

        - `group_filter_regex?: string`

          A regex to filter Cloudflare groups returned in ID token and userinfo endpoint

        - `hybrid_and_implicit_options?: HybridAndImplicitOptions`

          - `return_access_token_from_authorization_endpoint?: boolean`

            If an Access Token should be returned from the OIDC Authorization endpoint

          - `return_id_token_from_authorization_endpoint?: boolean`

            If an ID Token should be returned from the OIDC Authorization endpoint

        - `public_key?: string`

          The Access public certificate that will be used to verify your identity.

        - `redirect_uris?: Array<string>`

          The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens

        - `refresh_token_options?: RefreshTokenOptions`

          - `lifetime?: string`

            How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

        - `scopes?: Array<"openid" | "groups" | "email" | "profile">`

          Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled

          - `"openid"`

          - `"groups"`

          - `"email"`

          - `"profile"`

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `BrowserSSHApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `BrowserVNCApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `AppLauncherApplication`

    - `type: "self_hosted" | "saas" | "ssh" | 11 more`

      The application type.

      - `"self_hosted"`

      - `"saas"`

      - `"ssh"`

      - `"vnc"`

      - `"app_launcher"`

      - `"warp"`

      - `"biso"`

      - `"bookmark"`

      - `"dash_sso"`

      - `"infrastructure"`

      - `"rdp"`

      - `"mcp"`

      - `"mcp_portal"`

      - `"proxy_endpoint"`

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_logo_url?: string`

      The image URL of the logo shown in the App Launcher header.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `bg_color?: string`

      The background color of the App Launcher page.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `footer_links?: Array<FooterLink>`

      The links in the App Launcher footer.

      - `name: string`

        The hypertext in the footer link.

      - `url: string`

        the hyperlink in the footer link.

    - `header_bg_color?: string`

      The background color of the App Launcher header.

    - `landing_page_design?: LandingPageDesign`

      The design of the App Launcher landing page shown to users when they log in.

      - `button_color?: string`

        The background color of the log in button on the landing page.

      - `button_text_color?: string`

        The color of the text in the log in button on the landing page.

      - `image_url?: string`

        The URL of the image shown on the landing page.

      - `message?: string`

        The message shown on the landing page.

      - `title?: string`

        The title shown on the landing page.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_app_launcher_login_page?: boolean`

      Determines when to skip the App Launcher landing page.

  - `DeviceEnrollmentPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BrowserIsolationPermissionsApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `GatewayIdentityProxyEndpointApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `domain?: string`

      The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

  - `BookmarkApplication`

    - `id?: string`

      UUID.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `domain?: string`

      The URL or domain of the bookmark.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `type?: ApplicationType`

      The application type.

  - `InfrastructureApplication`

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "SSH"`

        The communication protocol your application secures.

        - `"SSH"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `aud?: string`

      Audience tag.

    - `name?: string`

      The name of the application.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to the targets secured by your application.

        - `ssh?: SSH`

          The SSH-specific rules that define how users may connect to the targets secured by your application.

          - `usernames: Array<string>`

            Contains the Unix usernames that may be used when connecting over SSH.

          - `allow_email_alias?: boolean`

            Enables using Identity Provider email alias as SSH username.

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `name?: string`

        The name of the Access policy.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `updated_at?: string`

  - `BrowserRDPApplication`

    - `domain: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `target_criteria: Array<TargetCriterion>`

      - `port: number`

        The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.

      - `protocol: "RDP"`

        The communication protocol your application secures.

        - `"RDP"`

      - `target_attributes: Record<string, Array<string>>`

        Contains a map of target attribute keys to target attribute values.

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allow_iframe?: boolean`

      Enables loading application content in an iFrame.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `app_launcher_visible?: boolean`

      Displays the application in the App Launcher.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `cors_headers?: CORSHeaders`

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `enable_binding_cookie?: boolean`

      Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `mfa_config?: MfaConfig`

      Configures multi-factor authentication (MFA) settings.

      - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

        Lists the MFA methods that users can authenticate with.

        - `"totp"`

        - `"biometrics"`

        - `"security_key"`

      - `mfa_disabled?: boolean`

        Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

      - `session_duration?: string`

        Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `path_cookie_attribute?: boolean`

      Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `read_service_tokens_from_header?: string`

      Allows matching Access Service Tokens passed HTTP in a single header with this name.
      This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.
      The header value will be interpreted as a json object similar to:
      {
      "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"
      }

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `self_hosted_domains?: Array<SelfHostedDomains>`

      List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.

    - `service_auth_401_redirect?: boolean`

      Returns a 401 status code when the request is blocked by a Service Auth policy.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `skip_interstitial?: boolean`

      Enables automatic authentication through cloudflared.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

    - `use_clientless_isolation_app_launcher_url?: boolean`

      Determines if users can access this application via a clientless browser isolation URL.
      This allows users to access private domains without connecting to Gateway. The option requires
      Clientless Browser Isolation to be set up with policies that allow users of this application.

  - `McpServerApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

  - `McpServerPortalApplication`

    - `type: ApplicationType`

      The application type.

    - `id?: string`

      UUID.

    - `allow_authenticate_via_warp?: boolean`

      When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.

    - `allowed_idps?: Array<AllowedIdPs>`

      The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

    - `aud?: string`

      Audience tag.

    - `auto_redirect_to_identity?: boolean`

      When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

    - `custom_deny_message?: string`

      The custom error message shown to a user when they are denied access to the application.

    - `custom_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.

    - `custom_non_identity_deny_url?: string`

      The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.

    - `custom_pages?: Array<string>`

      The custom pages that will be displayed when applicable for this application

    - `destinations?: Array<PublicDestination | PrivateDestination | ViaMcpServerPortalDestination>`

      List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.

      - `PublicDestination`

        A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.

        - `type?: "public"`

          - `"public"`

        - `uri?: string`

          The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).

      - `PrivateDestination`

        - `cidr?: string`

          The CIDR range of the destination. Single IPs will be computed as /32.

        - `hostname?: string`

          The hostname of the destination. Matches a valid SNI served by an HTTPS origin.

        - `l4_protocol?: "tcp" | "udp"`

          The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.

          - `"tcp"`

          - `"udp"`

        - `port_range?: string`

          The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.

        - `type?: "private"`

          - `"private"`

        - `vnet_id?: string`

          The VNET ID to match the destination. When omitted, all VNETs will match.

      - `ViaMcpServerPortalDestination`

        A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.

        - `mcp_server_id?: string`

          The MCP server id configured in ai-controls.

        - `type?: "via_mcp_server_portal"`

          - `"via_mcp_server_portal"`

    - `domain?: string`

      The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.

    - `http_only_cookie_attribute?: boolean`

      Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

    - `logo_url?: string`

      The image URL for the logo shown in the App Launcher dashboard.

    - `name?: string`

      The name of the application.

    - `oauth_configuration?: OAuthConfiguration`

      **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.

      - `dynamic_client_registration?: DynamicClientRegistration`

        Settings for OAuth dynamic client registration.

        - `allow_any_on_localhost?: boolean`

          Allows any client with redirect URIs on localhost.

        - `allow_any_on_loopback?: boolean`

          Allows any client with redirect URIs on 127.0.0.1.

        - `allowed_uris?: Array<string>`

          The URIs that are allowed as redirect URIs for dynamically registered clients. Must use the `https` protocol. Paths may end in `/*` to match all sub-paths.

        - `enabled?: boolean`

          Whether dynamic client registration is enabled.

      - `enabled?: boolean`

        Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.

      - `grant?: Grant`

        Settings for OAuth grant behavior.

        - `access_token_lifetime?: string`

          The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

        - `session_duration?: string`

          The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.

    - `options_preflight_bypass?: boolean`

      Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

    - `policies?: Array<Policy>`

      - `id?: string`

        The UUID of the policy

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `created_at?: string`

      - `decision?: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `include?: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `name?: string`

        The name of the Access policy.

      - `precedence?: number`

        The order of execution for this policy. Must be unique for each policy within an app.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

      - `updated_at?: string`

    - `same_site_cookie_attribute?: string`

      Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

    - `scim_config?: SCIMConfig`

      Configuration for provisioning to this application via SCIM. This is currently in closed beta.

      - `idp_uid: string`

        The UID of the IdP to use as the source for SCIM resources to provision to this application.

      - `remote_uri: string`

        The base URI for the application's SCIM-compatible API.

      - `authentication?: SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | 2 more`

        Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationHTTPBasic`

          Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOAuthBearerToken`

          Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

        - `SCIMConfigAuthenticationOauth2`

          Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

        - `AccessSCIMConfigAuthenticationAccessServiceToken`

          Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

          - `client_id: string`

            Client ID of the Access service token used to authenticate with the remote service.

          - `client_secret: string`

            Client secret of the Access service token used to authenticate with the remote service.

          - `scheme: "access_service_token"`

            The authentication scheme to use when making SCIM requests to this application.

            - `"access_service_token"`

        - `Array<SCIMConfigAuthenticationHTTPBasic | SCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | AccessSCIMConfigAuthenticationAccessServiceToken>`

          - `SCIMConfigAuthenticationHTTPBasic`

            Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOAuthBearerToken`

            Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

          - `SCIMConfigAuthenticationOauth2`

            Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

          - `AccessSCIMConfigAuthenticationAccessServiceToken`

            Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

            - `client_id: string`

              Client ID of the Access service token used to authenticate with the remote service.

            - `client_secret: string`

              Client secret of the Access service token used to authenticate with the remote service.

            - `scheme: "access_service_token"`

              The authentication scheme to use when making SCIM requests to this application.

              - `"access_service_token"`

      - `deactivate_on_delete?: boolean`

        If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.

      - `enabled?: boolean`

        Whether SCIM provisioning is turned on for this application.

      - `mappings?: Array<SCIMConfigMapping>`

        A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

        - `schema: string`

          Which SCIM resource type this mapping applies to.

        - `enabled?: boolean`

          Whether or not this mapping is enabled.

        - `filter?: string`

          A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.

        - `operations?: Operations`

          Whether or not this mapping applies to creates, updates, or deletes.

        - `strictness?: "strict" | "passthrough"`

          The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

        - `transform_jsonata?: string`

          A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.

    - `session_duration?: string`

      The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.

    - `tags?: Array<string>`

      The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.

### Application Delete Response

- `ApplicationDeleteResponse`

  - `id?: string`

    UUID.

### Application Revoke Tokens Response

- `ApplicationRevokeTokensResponse = unknown`

# CAs

## List short-lived certificate CAs

`client.zeroTrust.access.applications.cas.list(CAListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<CA>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/ca`

Lists short-lived certificate CAs and their public keys.

### Parameters

- `params: CAListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `CA`

  - `id?: string`

    The ID of the CA.

  - `aud?: string`

    The Application Audience (AUD) tag. Identifies the application associated with the CA.

  - `public_key?: string`

    The public key to add to your SSH server configuration.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const ca of client.zeroTrust.access.applications.cas.list({
  account_id: 'account_id',
})) {
  console.log(ca.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "7eddae4619b50ab1361ba8ae9bd72269a432fea041529ed9",
      "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
      "public_key": "ecdsa-sha2-nistp256 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= open-ssh-ca@cloudflareaccess.org"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get a short-lived certificate CA

`client.zeroTrust.access.applications.cas.get(stringappId, CAGetParamsparams?, RequestOptionsoptions?): CA`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca`

Fetches a short-lived certificate CA and its public key.

### Parameters

- `appId: string`

  UUID.

- `params: CAGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CA`

  - `id?: string`

    The ID of the CA.

  - `aud?: string`

    The Application Audience (AUD) tag. Identifies the application associated with the CA.

  - `public_key?: string`

    The public key to add to your SSH server configuration.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const ca = await client.zeroTrust.access.applications.cas.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(ca.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "7eddae4619b50ab1361ba8ae9bd72269a432fea041529ed9",
    "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
    "public_key": "ecdsa-sha2-nistp256 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= open-ssh-ca@cloudflareaccess.org"
  }
}
```

## Create a short-lived certificate CA

`client.zeroTrust.access.applications.cas.create(stringappId, CACreateParamsparams?, RequestOptionsoptions?): CA`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca`

Generates a new short-lived certificate CA and public key.

### Parameters

- `appId: string`

  UUID.

- `params: CACreateParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CA`

  - `id?: string`

    The ID of the CA.

  - `aud?: string`

    The Application Audience (AUD) tag. Identifies the application associated with the CA.

  - `public_key?: string`

    The public key to add to your SSH server configuration.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const ca = await client.zeroTrust.access.applications.cas.create(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(ca.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "7eddae4619b50ab1361ba8ae9bd72269a432fea041529ed9",
    "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
    "public_key": "ecdsa-sha2-nistp256 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= open-ssh-ca@cloudflareaccess.org"
  }
}
```

## Delete a short-lived certificate CA

`client.zeroTrust.access.applications.cas.delete(stringappId, CADeleteParamsparams?, RequestOptionsoptions?): CADeleteResponse`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/ca`

Deletes a short-lived certificate CA.

### Parameters

- `appId: string`

  UUID.

- `params: CADeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CADeleteResponse`

  - `id?: string`

    The ID of the CA.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const ca = await client.zeroTrust.access.applications.cas.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(ca.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "7eddae4619b50ab1361ba8ae9bd72269a432fea041529ed9"
  }
}
```

## Domain Types

### CA

- `CA`

  - `id?: string`

    The ID of the CA.

  - `aud?: string`

    The Application Audience (AUD) tag. Identifies the application associated with the CA.

  - `public_key?: string`

    The public key to add to your SSH server configuration.

### CA Delete Response

- `CADeleteResponse`

  - `id?: string`

    The ID of the CA.

# User Policy Checks

## Test Access policies

`client.zeroTrust.access.applications.userPolicyChecks.list(AppIDappId, UserPolicyCheckListParamsparams?, RequestOptionsoptions?): UserPolicyCheckListResponse`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/user_policy_checks`

Tests if a specific user has permission to access an application.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: UserPolicyCheckListParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `UserPolicyCheckListResponse`

  - `app_state?: AppState`

    - `app_uid?: string`

      UUID.

    - `aud?: string`

    - `hostname?: string`

    - `name?: string`

    - `policies?: Array<unknown>`

    - `status?: string`

  - `user_identity?: UserIdentity`

    - `id?: string`

    - `account_id?: string`

    - `device_sessions?: unknown`

    - `email?: string`

    - `geo?: UserPolicyCheckGeo`

      - `country?: string`

    - `iat?: number`

    - `is_gateway?: boolean`

    - `is_warp?: boolean`

    - `name?: string`

    - `user_uuid?: string`

      UUID.

    - `version?: number`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const userPolicyChecks = await client.zeroTrust.access.applications.userPolicyChecks.list(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(userPolicyChecks.user_identity);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "app_state": {
      "app_uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "aud": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe389",
      "hostname": "test.com",
      "name": "Test App",
      "policies": [
        {
          "decision": "allow",
          "exclude": [],
          "include": [
            {
              "_type": "email",
              "email": "testuser@gmail.com"
            }
          ],
          "precedence": 1,
          "require": [],
          "status": "Success"
        }
      ],
      "status": "Success"
    },
    "user_identity": {
      "id": "1164449231815010287495",
      "account_id": "41ecfbb341f033e52b46742756aabb8b",
      "device_sessions": {},
      "email": "testuser@gmail.com",
      "geo": {
        "country": "US"
      },
      "iat": 0,
      "is_gateway": false,
      "is_warp": false,
      "name": "Test User",
      "user_uuid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "version": 0
    }
  }
}
```

## Domain Types

### User Policy Check Geo

- `UserPolicyCheckGeo`

  - `country?: string`

### User Policy Check List Response

- `UserPolicyCheckListResponse`

  - `app_state?: AppState`

    - `app_uid?: string`

      UUID.

    - `aud?: string`

    - `hostname?: string`

    - `name?: string`

    - `policies?: Array<unknown>`

    - `status?: string`

  - `user_identity?: UserIdentity`

    - `id?: string`

    - `account_id?: string`

    - `device_sessions?: unknown`

    - `email?: string`

    - `geo?: UserPolicyCheckGeo`

      - `country?: string`

    - `iat?: number`

    - `is_gateway?: boolean`

    - `is_warp?: boolean`

    - `name?: string`

    - `user_uuid?: string`

      UUID.

    - `version?: number`

# Policies

## List Access application policies

`client.zeroTrust.access.applications.policies.list(stringappId, PolicyListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<PolicyListResponse>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies`

Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.

### Parameters

- `appId: string`

  UUID.

- `params: PolicyListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `PolicyListResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const policyListResponse of client.zeroTrust.access.applications.policies.list(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
)) {
  console.log(policyListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "approval_groups": [
        {
          "approvals_needed": 1,
          "email_addresses": [
            "test1@cloudflare.com",
            "test2@cloudflare.com"
          ],
          "email_list_uuid": "email_list_uuid"
        },
        {
          "approvals_needed": 3,
          "email_addresses": [
            "test@cloudflare.com",
            "test2@cloudflare.com"
          ],
          "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
        }
      ],
      "approval_required": true,
      "connection_rules": {
        "rdp": {
          "allowed_clipboard_local_to_remote_formats": [
            "text"
          ],
          "allowed_clipboard_remote_to_local_formats": [
            "text"
          ]
        }
      },
      "created_at": "2014-01-01T05:20:00.12345Z",
      "decision": "allow",
      "exclude": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "include": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "isolation_required": false,
      "mfa_config": {
        "allowed_authenticators": [
          "totp",
          "biometrics",
          "security_key"
        ],
        "mfa_disabled": false,
        "session_duration": "24h"
      },
      "name": "Allow devs",
      "precedence": 0,
      "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
      "purpose_justification_required": true,
      "require": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "session_duration": "24h",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get an Access application policy

`client.zeroTrust.access.applications.policies.get(stringappId, stringpolicyId, PolicyGetParamsparams?, RequestOptionsoptions?): PolicyGetResponse`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}`

Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.

### Parameters

- `appId: string`

  UUID.

- `policyId: string`

  UUID.

- `params: PolicyGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `PolicyGetResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiEmail: process.env['CLOUDFLARE_EMAIL'], // This is the default and can be omitted
  apiKey: process.env['CLOUDFLARE_API_KEY'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.applications.policies.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "precedence": 0,
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create an Access application policy

`client.zeroTrust.access.applications.policies.create(stringappId, PolicyCreateParamsparams, RequestOptionsoptions?): PolicyCreateResponse`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies`

Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.

### Parameters

- `appId: string`

  UUID.

- `params: PolicyCreateParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `approval_groups?: Array<ApprovalGroup>`

    Body param: Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Body param: Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    Body param: The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `isolation_required?: boolean`

    Body param: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Body param: Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `precedence?: number`

    Body param: The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    Body param: A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Body param: Require users to enter a justification when they log in to the application.

  - `session_duration?: string`

    Body param: The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

### Returns

- `PolicyCreateResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.applications.policies.create(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "precedence": 0,
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update an Access application policy

`client.zeroTrust.access.applications.policies.update(stringappId, stringpolicyId, PolicyUpdateParamsparams, RequestOptionsoptions?): PolicyUpdateResponse`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}`

Updates an Access policy specific to an application. To update a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.

### Parameters

- `appId: string`

  UUID.

- `policyId: string`

  UUID.

- `params: PolicyUpdateParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `approval_groups?: Array<ApprovalGroup>`

    Body param: Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Body param: Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    Body param: The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `isolation_required?: boolean`

    Body param: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Body param: Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `precedence?: number`

    Body param: The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    Body param: A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Body param: Require users to enter a justification when they log in to the application.

  - `session_duration?: string`

    Body param: The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

### Returns

- `PolicyUpdateResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.applications.policies.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "precedence": 0,
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete an Access application policy

`client.zeroTrust.access.applications.policies.delete(stringappId, stringpolicyId, PolicyDeleteParamsparams?, RequestOptionsoptions?): PolicyDeleteResponse`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/policies/{policy_id}`

Deletes an Access policy specific to an application. To delete a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.

### Parameters

- `appId: string`

  UUID.

- `policyId: string`

  UUID.

- `params: PolicyDeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `PolicyDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.applications.policies.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Access Device Posture Rule

- `AccessDevicePostureRule`

  Enforces a device posture rule has run successfully

  - `device_posture: DevicePosture`

    - `integration_uid: string`

      The ID of a device posture integration.

### Access Rule

- `AccessRule = GroupRule | AnyValidServiceTokenRule | AccessAuthContextRule | 22 more`

  Matches an Access group.

  - `GroupRule`

    Matches an Access group.

    - `group: Group`

      - `id: string`

        The ID of a previously created Access group.

  - `AnyValidServiceTokenRule`

    Matches any valid Access Service Token

    - `any_valid_service_token: AnyValidServiceToken`

      An empty object which matches on all service tokens.

  - `AccessAuthContextRule`

    Matches an Azure Authentication Context.
    Requires an Azure identity provider.

    - `auth_context: AuthContext`

      - `id: string`

        The ID of an Authentication context.

      - `ac_id: string`

        The ACID of an Authentication context.

      - `identity_provider_id: string`

        The ID of your Azure identity provider.

  - `AuthenticationMethodRule`

    Enforce different MFA options

    - `auth_method: AuthMethod`

      - `auth_method: string`

        The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

  - `AzureGroupRule`

    Matches an Azure group.
    Requires an Azure identity provider.

    - `azureAD: AzureAD`

      - `id: string`

        The ID of an Azure group.

      - `identity_provider_id: string`

        The ID of your Azure identity provider.

  - `CertificateRule`

    Matches any valid client certificate.

    - `certificate: Certificate`

  - `AccessCommonNameRule`

    Matches a specific common name.

    - `common_name: CommonName`

      - `common_name: string`

        The common name to match.

  - `CountryRule`

    Matches a specific country

    - `geo: Geo`

      - `country_code: string`

        The country code that should be matched.

  - `AccessDevicePostureRule`

    Enforces a device posture rule has run successfully

    - `device_posture: DevicePosture`

      - `integration_uid: string`

        The ID of a device posture integration.

  - `DomainRule`

    Match an entire email domain.

    - `email_domain: EmailDomain`

      - `domain: string`

        The email domain to match.

  - `EmailListRule`

    Matches an email address from a list.

    - `email_list: EmailList`

      - `id: string`

        The ID of a previously created email list.

  - `EmailRule`

    Matches a specific email.

    - `email: Email`

      - `email: string`

        The email of the user.

  - `EveryoneRule`

    Matches everyone.

    - `everyone: Everyone`

      An empty object which matches on all users.

  - `ExternalEvaluationRule`

    Create Allow or Block policies which evaluate the user based on custom criteria.

    - `external_evaluation: ExternalEvaluation`

      - `evaluate_url: string`

        The API endpoint containing your business logic.

      - `keys_url: string`

        The API endpoint containing the key that Access uses to verify that the response came from your API.

  - `GitHubOrganizationRule`

    Matches a Github organization.
    Requires a Github identity provider.

    - `"github-organization": GitHubOrganization`

      - `identity_provider_id: string`

        The ID of your Github identity provider.

      - `name: string`

        The name of the organization.

      - `team?: string`

        The name of the team

  - `GSuiteGroupRule`

    Matches a group in Google Workspace.
    Requires a Google Workspace identity provider.

    - `gsuite: GSuite`

      - `email: string`

        The email of the Google Workspace group.

      - `identity_provider_id: string`

        The ID of your Google Workspace identity provider.

  - `AccessLoginMethodRule`

    Matches a specific identity provider id.

    - `login_method: LoginMethod`

      - `id: string`

        The ID of an identity provider.

  - `IPListRule`

    Matches an IP address from a list.

    - `ip_list: IPList`

      - `id: string`

        The ID of a previously created IP list.

  - `IPRule`

    Matches an IP address block.

    - `ip: IP`

      - `ip: string`

        An IPv4 or IPv6 CIDR block.

  - `OktaGroupRule`

    Matches an Okta group.
    Requires an Okta identity provider.

    - `okta: Okta`

      - `identity_provider_id: string`

        The ID of your Okta identity provider.

      - `name: string`

        The name of the Okta group.

  - `SAMLGroupRule`

    Matches a SAML group.
    Requires a SAML identity provider.

    - `saml: SAML`

      - `attribute_name: string`

        The name of the SAML attribute.

      - `attribute_value: string`

        The SAML attribute value to look for.

      - `identity_provider_id: string`

        The ID of your SAML identity provider.

  - `AccessOIDCClaimRule`

    Matches an OIDC claim.
    Requires an OIDC identity provider.

    - `oidc: OIDC`

      - `claim_name: string`

        The name of the OIDC claim.

      - `claim_value: string`

        The OIDC claim value to look for.

      - `identity_provider_id: string`

        The ID of your OIDC identity provider.

  - `ServiceTokenRule`

    Matches a specific Access Service Token

    - `service_token: ServiceToken`

      - `token_id: string`

        The ID of a Service Token.

  - `AccessLinkedAppTokenRule`

    Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `linked_app_token: LinkedAppToken`

      - `app_uid: string`

        The ID of an Access OIDC SaaS application

  - `AccessUserRiskScoreRule`

    Matches a user's risk score.

    - `user_risk_score: UserRiskScore`

      - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

        A list of risk score levels to match. Values can be low, medium, high, or unscored.

        - `"low"`

        - `"medium"`

        - `"high"`

        - `"unscored"`

### Any Valid Service Token Rule

- `AnyValidServiceTokenRule`

  Matches any valid Access Service Token

  - `any_valid_service_token: AnyValidServiceToken`

    An empty object which matches on all service tokens.

### Authentication Method Rule

- `AuthenticationMethodRule`

  Enforce different MFA options

  - `auth_method: AuthMethod`

    - `auth_method: string`

      The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

### Azure Group Rule

- `AzureGroupRule`

  Matches an Azure group.
  Requires an Azure identity provider.

  - `azureAD: AzureAD`

    - `id: string`

      The ID of an Azure group.

    - `identity_provider_id: string`

      The ID of your Azure identity provider.

### Certificate Rule

- `CertificateRule`

  Matches any valid client certificate.

  - `certificate: Certificate`

### Country Rule

- `CountryRule`

  Matches a specific country

  - `geo: Geo`

    - `country_code: string`

      The country code that should be matched.

### Domain Rule

- `DomainRule`

  Match an entire email domain.

  - `email_domain: EmailDomain`

    - `domain: string`

      The email domain to match.

### Email List Rule

- `EmailListRule`

  Matches an email address from a list.

  - `email_list: EmailList`

    - `id: string`

      The ID of a previously created email list.

### Email Rule

- `EmailRule`

  Matches a specific email.

  - `email: Email`

    - `email: string`

      The email of the user.

### Everyone Rule

- `EveryoneRule`

  Matches everyone.

  - `everyone: Everyone`

    An empty object which matches on all users.

### External Evaluation Rule

- `ExternalEvaluationRule`

  Create Allow or Block policies which evaluate the user based on custom criteria.

  - `external_evaluation: ExternalEvaluation`

    - `evaluate_url: string`

      The API endpoint containing your business logic.

    - `keys_url: string`

      The API endpoint containing the key that Access uses to verify that the response came from your API.

### GitHub Organization Rule

- `GitHubOrganizationRule`

  Matches a Github organization.
  Requires a Github identity provider.

  - `"github-organization": GitHubOrganization`

    - `identity_provider_id: string`

      The ID of your Github identity provider.

    - `name: string`

      The name of the organization.

    - `team?: string`

      The name of the team

### Group Rule

- `GroupRule`

  Matches an Access group.

  - `group: Group`

    - `id: string`

      The ID of a previously created Access group.

### GSuite Group Rule

- `GSuiteGroupRule`

  Matches a group in Google Workspace.
  Requires a Google Workspace identity provider.

  - `gsuite: GSuite`

    - `email: string`

      The email of the Google Workspace group.

    - `identity_provider_id: string`

      The ID of your Google Workspace identity provider.

### IP List Rule

- `IPListRule`

  Matches an IP address from a list.

  - `ip_list: IPList`

    - `id: string`

      The ID of a previously created IP list.

### IP Rule

- `IPRule`

  Matches an IP address block.

  - `ip: IP`

    - `ip: string`

      An IPv4 or IPv6 CIDR block.

### Okta Group Rule

- `OktaGroupRule`

  Matches an Okta group.
  Requires an Okta identity provider.

  - `okta: Okta`

    - `identity_provider_id: string`

      The ID of your Okta identity provider.

    - `name: string`

      The name of the Okta group.

### SAML Group Rule

- `SAMLGroupRule`

  Matches a SAML group.
  Requires a SAML identity provider.

  - `saml: SAML`

    - `attribute_name: string`

      The name of the SAML attribute.

    - `attribute_value: string`

      The SAML attribute value to look for.

    - `identity_provider_id: string`

      The ID of your SAML identity provider.

### Service Token Rule

- `ServiceTokenRule`

  Matches a specific Access Service Token

  - `service_token: ServiceToken`

    - `token_id: string`

      The ID of a Service Token.

### Policy List Response

- `PolicyListResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Get Response

- `PolicyGetResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Create Response

- `PolicyCreateResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Update Response

- `PolicyUpdateResponse`

  - `id?: string`

    The UUID of the policy

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy within an app.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Delete Response

- `PolicyDeleteResponse`

  - `id?: string`

    UUID.

# Policy Tests

## Get the current status of a given Access policy test

`client.zeroTrust.access.applications.policyTests.get(stringpolicyTestId, PolicyTestGetParamsparams, RequestOptionsoptions?): PolicyTestGetResponse`

**get** `/accounts/{account_id}/access/policy-tests/{policy_test_id}`

Fetches the current status of a given Access policy test.

### Parameters

- `policyTestId: string`

  The UUID of the policy test.

- `params: PolicyTestGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `PolicyTestGetResponse`

  - `id?: string`

    The UUID of the policy test.

  - `percent_approved?: number`

    The percentage of (processed) users approved based on policy evaluation results.

  - `percent_blocked?: number`

    The percentage of (processed) users blocked based on policy evaluation results.

  - `percent_errored?: number`

    The percentage of (processed) users errored based on policy evaluation results.

  - `percent_users_processed?: number`

    The percentage of users processed so far (of the entire user base).

  - `status?: "blocked" | "processing" | "exceeded time" | "complete"`

    The status of the policy test.

    - `"blocked"`

    - `"processing"`

    - `"exceeded time"`

    - `"complete"`

  - `total_users?: number`

    The total number of users in the user base.

  - `users_approved?: number`

    The number of (processed) users approved based on policy evaluation results.

  - `users_blocked?: number`

    The number of (processed) users blocked based on policy evaluation results.

  - `users_errored?: number`

    The number of (processed) users errored based on policy evaluation results.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policyTest = await client.zeroTrust.access.applications.policyTests.get(
  'f1a8b3c9d4e5f6789a0b1c2d3e4f5678a9b0c1d2e3f4a5b67890c1d2e3f4b5a6',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(policyTest.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f1a8b3c9d4e5f6789a0b1c2d3e4f5678a9b0c1d2e3f4a5b67890c1d2e3f4b5a6",
    "percent_approved": 25,
    "percent_blocked": 25,
    "percent_errored": 25,
    "percent_users_processed": 50,
    "status": "complete",
    "total_users": 20,
    "users_approved": 5,
    "users_blocked": 5,
    "users_errored": 5
  }
}
```

## Start Access policy test

`client.zeroTrust.access.applications.policyTests.create(PolicyTestCreateParamsparams, RequestOptionsoptions?): PolicyTestCreateResponse`

**post** `/accounts/{account_id}/access/policy-tests`

Starts an Access policy test.

### Parameters

- `params: PolicyTestCreateParams`

  - `account_id: string`

    Path param: Identifier.

  - `policies?: Array<UnionMember0 | string>`

    Body param

    - `UnionMember0`

      - `decision: Decision`

        The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

        - `"allow"`

        - `"deny"`

        - `"non_identity"`

        - `"bypass"`

      - `include: Array<AccessRule>`

        Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

        - `GroupRule`

          Matches an Access group.

          - `group: Group`

            - `id: string`

              The ID of a previously created Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

          - `any_valid_service_token: AnyValidServiceToken`

            An empty object which matches on all service tokens.

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

          - `auth_context: AuthContext`

            - `id: string`

              The ID of an Authentication context.

            - `ac_id: string`

              The ACID of an Authentication context.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

          - `auth_method: AuthMethod`

            - `auth_method: string`

              The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

          - `azureAD: AzureAD`

            - `id: string`

              The ID of an Azure group.

            - `identity_provider_id: string`

              The ID of your Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

          - `certificate: Certificate`

        - `AccessCommonNameRule`

          Matches a specific common name.

          - `common_name: CommonName`

            - `common_name: string`

              The common name to match.

        - `CountryRule`

          Matches a specific country

          - `geo: Geo`

            - `country_code: string`

              The country code that should be matched.

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

          - `device_posture: DevicePosture`

            - `integration_uid: string`

              The ID of a device posture integration.

        - `DomainRule`

          Match an entire email domain.

          - `email_domain: EmailDomain`

            - `domain: string`

              The email domain to match.

        - `EmailListRule`

          Matches an email address from a list.

          - `email_list: EmailList`

            - `id: string`

              The ID of a previously created email list.

        - `EmailRule`

          Matches a specific email.

          - `email: Email`

            - `email: string`

              The email of the user.

        - `EveryoneRule`

          Matches everyone.

          - `everyone: Everyone`

            An empty object which matches on all users.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

          - `external_evaluation: ExternalEvaluation`

            - `evaluate_url: string`

              The API endpoint containing your business logic.

            - `keys_url: string`

              The API endpoint containing the key that Access uses to verify that the response came from your API.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

          - `"github-organization": GitHubOrganization`

            - `identity_provider_id: string`

              The ID of your Github identity provider.

            - `name: string`

              The name of the organization.

            - `team?: string`

              The name of the team

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

          - `gsuite: GSuite`

            - `email: string`

              The email of the Google Workspace group.

            - `identity_provider_id: string`

              The ID of your Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

          - `login_method: LoginMethod`

            - `id: string`

              The ID of an identity provider.

        - `IPListRule`

          Matches an IP address from a list.

          - `ip_list: IPList`

            - `id: string`

              The ID of a previously created IP list.

        - `IPRule`

          Matches an IP address block.

          - `ip: IP`

            - `ip: string`

              An IPv4 or IPv6 CIDR block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

          - `okta: Okta`

            - `identity_provider_id: string`

              The ID of your Okta identity provider.

            - `name: string`

              The name of the Okta group.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

          - `saml: SAML`

            - `attribute_name: string`

              The name of the SAML attribute.

            - `attribute_value: string`

              The SAML attribute value to look for.

            - `identity_provider_id: string`

              The ID of your SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

          - `oidc: OIDC`

            - `claim_name: string`

              The name of the OIDC claim.

            - `claim_value: string`

              The OIDC claim value to look for.

            - `identity_provider_id: string`

              The ID of your OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

          - `service_token: ServiceToken`

            - `token_id: string`

              The ID of a Service Token.

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

          - `linked_app_token: LinkedAppToken`

            - `app_uid: string`

              The ID of an Access OIDC SaaS application

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

          - `user_risk_score: UserRiskScore`

            - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

              A list of risk score levels to match. Values can be low, medium, high, or unscored.

              - `"low"`

              - `"medium"`

              - `"high"`

              - `"unscored"`

      - `name: string`

        The name of the Access policy.

      - `approval_groups?: Array<ApprovalGroup>`

        Administrators who can approve a temporary authentication request.

        - `approvals_needed: number`

          The number of approvals needed to obtain access.

        - `email_addresses?: Array<string>`

          A list of emails that can approve the access request.

        - `email_list_uuid?: string`

          The UUID of an re-usable email list.

      - `approval_required?: boolean`

        Requires the user to request access from an administrator at the start of each session.

      - `connection_rules?: ConnectionRules`

        The rules that define how users may connect to targets secured by your application.

        - `rdp?: RDP`

          The RDP-specific rules that define clipboard behavior for RDP connections.

          - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

            Clipboard formats allowed when copying from local machine to remote RDP session.

            - `"text"`

          - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

            Clipboard formats allowed when copying from remote RDP session to local machine.

            - `"text"`

      - `exclude?: Array<AccessRule>`

        Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `isolation_required?: boolean`

        Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

      - `mfa_config?: MfaConfig`

        Configures multi-factor authentication (MFA) settings.

        - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

          Lists the MFA methods that users can authenticate with.

          - `"totp"`

          - `"biometrics"`

          - `"security_key"`

        - `mfa_disabled?: boolean`

          Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

        - `session_duration?: string`

          Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

      - `purpose_justification_prompt?: string`

        A custom message that will appear on the purpose justification screen.

      - `purpose_justification_required?: boolean`

        Require users to enter a justification when they log in to the application.

      - `require?: Array<AccessRule>`

        Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

        - `GroupRule`

          Matches an Access group.

        - `AnyValidServiceTokenRule`

          Matches any valid Access Service Token

        - `AccessAuthContextRule`

          Matches an Azure Authentication Context.
          Requires an Azure identity provider.

        - `AuthenticationMethodRule`

          Enforce different MFA options

        - `AzureGroupRule`

          Matches an Azure group.
          Requires an Azure identity provider.

        - `CertificateRule`

          Matches any valid client certificate.

        - `AccessCommonNameRule`

          Matches a specific common name.

        - `CountryRule`

          Matches a specific country

        - `AccessDevicePostureRule`

          Enforces a device posture rule has run successfully

        - `DomainRule`

          Match an entire email domain.

        - `EmailListRule`

          Matches an email address from a list.

        - `EmailRule`

          Matches a specific email.

        - `EveryoneRule`

          Matches everyone.

        - `ExternalEvaluationRule`

          Create Allow or Block policies which evaluate the user based on custom criteria.

        - `GitHubOrganizationRule`

          Matches a Github organization.
          Requires a Github identity provider.

        - `GSuiteGroupRule`

          Matches a group in Google Workspace.
          Requires a Google Workspace identity provider.

        - `AccessLoginMethodRule`

          Matches a specific identity provider id.

        - `IPListRule`

          Matches an IP address from a list.

        - `IPRule`

          Matches an IP address block.

        - `OktaGroupRule`

          Matches an Okta group.
          Requires an Okta identity provider.

        - `SAMLGroupRule`

          Matches a SAML group.
          Requires a SAML identity provider.

        - `AccessOIDCClaimRule`

          Matches an OIDC claim.
          Requires an OIDC identity provider.

        - `ServiceTokenRule`

          Matches a specific Access Service Token

        - `AccessLinkedAppTokenRule`

          Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

        - `AccessUserRiskScoreRule`

          Matches a user's risk score.

      - `session_duration?: string`

        The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

    - `string`

### Returns

- `PolicyTestCreateResponse`

  - `id?: string`

    The UUID of the policy test.

  - `status?: "success"`

    The status of the policy test request.

    - `"success"`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policyTest = await client.zeroTrust.access.applications.policyTests.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(policyTest.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f1a8b3c9d4e5f6789a0b1c2d3e4f5678a9b0c1d2e3f4a5b67890c1d2e3f4b5a6",
    "status": "success"
  }
}
```

## Domain Types

### Policy Test Get Response

- `PolicyTestGetResponse`

  - `id?: string`

    The UUID of the policy test.

  - `percent_approved?: number`

    The percentage of (processed) users approved based on policy evaluation results.

  - `percent_blocked?: number`

    The percentage of (processed) users blocked based on policy evaluation results.

  - `percent_errored?: number`

    The percentage of (processed) users errored based on policy evaluation results.

  - `percent_users_processed?: number`

    The percentage of users processed so far (of the entire user base).

  - `status?: "blocked" | "processing" | "exceeded time" | "complete"`

    The status of the policy test.

    - `"blocked"`

    - `"processing"`

    - `"exceeded time"`

    - `"complete"`

  - `total_users?: number`

    The total number of users in the user base.

  - `users_approved?: number`

    The number of (processed) users approved based on policy evaluation results.

  - `users_blocked?: number`

    The number of (processed) users blocked based on policy evaluation results.

  - `users_errored?: number`

    The number of (processed) users errored based on policy evaluation results.

### Policy Test Create Response

- `PolicyTestCreateResponse`

  - `id?: string`

    The UUID of the policy test.

  - `status?: "success"`

    The status of the policy test request.

    - `"success"`

# Users

## Get an Access policy test users page

`client.zeroTrust.access.applications.policyTests.users.list(stringpolicyTestId, UserListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<UserListResponse>`

**get** `/accounts/{account_id}/access/policy-tests/{policy_test_id}/users`

Fetches a single page of user results from an Access policy test.

### Parameters

- `policyTestId: string`

  The UUID of the policy test.

- `params: UserListParams`

  - `account_id: string`

    Path param: Identifier.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param

  - `status?: "success" | "fail" | "error"`

    Query param: Filter users by their policy evaluation status.

    - `"success"`

    - `"fail"`

    - `"error"`

### Returns

- `UserListResponse`

  - `id?: string`

    UUID.

  - `email?: string`

    The email of the user.

  - `name?: string`

    The name of the user.

  - `status?: "approved" | "blocked" | "error"`

    Policy evaluation result for an individual user.

    - `"approved"`

    - `"blocked"`

    - `"error"`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const userListResponse of client.zeroTrust.access.applications.policyTests.users.list(
  'f1a8b3c9d4e5f6789a0b1c2d3e4f5678a9b0c1d2e3f4a5b67890c1d2e3f4b5a6',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
)) {
  console.log(userListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "email": "jdoe@example.com",
      "name": "Jane Doe",
      "status": "approved"
    }
  ]
}
```

## Domain Types

### User List Response

- `UserListResponse`

  - `id?: string`

    UUID.

  - `email?: string`

    The email of the user.

  - `name?: string`

    The name of the user.

  - `status?: "approved" | "blocked" | "error"`

    Policy evaluation result for an individual user.

    - `"approved"`

    - `"blocked"`

    - `"error"`

# Settings

## Update Access application settings

`client.zeroTrust.access.applications.settings.update(AppIDappId, SettingUpdateParamsparams, RequestOptionsoptions?): SettingUpdateResponse`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/settings`

Updates Access application settings.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: SettingUpdateParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `allow_iframe?: boolean`

    Body param: Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Body param: Enables automatic authentication through cloudflared.

### Returns

- `SettingUpdateResponse`

  - `allow_iframe?: boolean`

    Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Enables automatic authentication through cloudflared.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const setting = await client.zeroTrust.access.applications.settings.update(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(setting.allow_iframe);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "allow_iframe": true,
    "skip_interstitial": true
  }
}
```

## Update Access application settings

`client.zeroTrust.access.applications.settings.edit(AppIDappId, SettingEditParamsparams, RequestOptionsoptions?): SettingEditResponse`

**patch** `/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/settings`

Updates Access application settings.

### Parameters

- `app_id: AppID`

  Identifier.

- `params: SettingEditParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `allow_iframe?: boolean`

    Body param: Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Body param: Enables automatic authentication through cloudflared.

### Returns

- `SettingEditResponse`

  - `allow_iframe?: boolean`

    Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Enables automatic authentication through cloudflared.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.applications.settings.edit(
  '023e105f4ecef8ad9ca31a8372d0c353',
  { account_id: 'account_id' },
);

console.log(response.allow_iframe);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "allow_iframe": true,
    "skip_interstitial": true
  }
}
```

## Domain Types

### Setting Update Response

- `SettingUpdateResponse`

  - `allow_iframe?: boolean`

    Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Enables automatic authentication through cloudflared.

### Setting Edit Response

- `SettingEditResponse`

  - `allow_iframe?: boolean`

    Enables loading application content in an iFrame.

  - `skip_interstitial?: boolean`

    Enables automatic authentication through cloudflared.

# Certificates

## List mTLS certificates

`client.zeroTrust.access.certificates.list(CertificateListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<Certificate>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates`

Lists all mTLS root certificates.

### Parameters

- `params: CertificateListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `Certificate`

  - `id?: string`

    The ID of the application that will use this certificate.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    The hostnames of the applications that will use this certificate.

  - `expires_on?: string`

  - `fingerprint?: string`

    The MD5 fingerprint of the certificate.

  - `name?: string`

    The name of the certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const certificate of client.zeroTrust.access.certificates.list({
  account_id: 'account_id',
})) {
  console.log(certificate.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "id",
      "associated_hostnames": [
        "admin.example.com"
      ],
      "created_at": "2014-01-01T05:20:00.12345Z",
      "expires_on": "2014-01-01T05:20:00.12345Z",
      "fingerprint": "MD5 Fingerprint=1E:80:0F:7A:FD:31:55:96:DE:D5:CB:E2:F0:91:F6:91",
      "name": "Allow devs",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get an mTLS certificate

`client.zeroTrust.access.certificates.get(stringcertificateId, CertificateGetParamsparams?, RequestOptionsoptions?): Certificate`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}`

Fetches a single mTLS certificate.

### Parameters

- `certificateId: string`

  UUID.

- `params: CertificateGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `Certificate`

  - `id?: string`

    The ID of the application that will use this certificate.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    The hostnames of the applications that will use this certificate.

  - `expires_on?: string`

  - `fingerprint?: string`

    The MD5 fingerprint of the certificate.

  - `name?: string`

    The name of the certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const certificate = await client.zeroTrust.access.certificates.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(certificate.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "associated_hostnames": [
      "admin.example.com"
    ],
    "created_at": "2014-01-01T05:20:00.12345Z",
    "expires_on": "2014-01-01T05:20:00.12345Z",
    "fingerprint": "MD5 Fingerprint=1E:80:0F:7A:FD:31:55:96:DE:D5:CB:E2:F0:91:F6:91",
    "name": "Allow devs",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Add an mTLS certificate

`client.zeroTrust.access.certificates.create(CertificateCreateParamsparams, RequestOptionsoptions?): Certificate`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates`

Adds a new mTLS root certificate to Access.

### Parameters

- `params: CertificateCreateParams`

  - `certificate: string`

    Body param: The certificate content.

  - `name: string`

    Body param: The name of the certificate.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    Body param: The hostnames of the applications that will use this certificate.

### Returns

- `Certificate`

  - `id?: string`

    The ID of the application that will use this certificate.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    The hostnames of the applications that will use this certificate.

  - `expires_on?: string`

  - `fingerprint?: string`

    The MD5 fingerprint of the certificate.

  - `name?: string`

    The name of the certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const certificate = await client.zeroTrust.access.certificates.create({
  certificate:
    '-----BEGIN CERTIFICATE-----\nMIIGAjCCA+qgAwIBAgIJAI7kymlF7CWT...N4RI7KKB7nikiuUf8vhULKy5IX10\nDrUtmu/B\n-----END CERTIFICATE-----',
  name: 'Allow devs',
  account_id: 'account_id',
});

console.log(certificate.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "associated_hostnames": [
      "admin.example.com"
    ],
    "created_at": "2014-01-01T05:20:00.12345Z",
    "expires_on": "2014-01-01T05:20:00.12345Z",
    "fingerprint": "MD5 Fingerprint=1E:80:0F:7A:FD:31:55:96:DE:D5:CB:E2:F0:91:F6:91",
    "name": "Allow devs",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update an mTLS certificate

`client.zeroTrust.access.certificates.update(stringcertificateId, CertificateUpdateParamsparams, RequestOptionsoptions?): Certificate`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}`

Updates a configured mTLS certificate.

### Parameters

- `certificateId: string`

  UUID.

- `params: CertificateUpdateParams`

  - `associated_hostnames: Array<AssociatedHostnames>`

    Body param: The hostnames of the applications that will use this certificate.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `name?: string`

    Body param: The name of the certificate.

### Returns

- `Certificate`

  - `id?: string`

    The ID of the application that will use this certificate.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    The hostnames of the applications that will use this certificate.

  - `expires_on?: string`

  - `fingerprint?: string`

    The MD5 fingerprint of the certificate.

  - `name?: string`

    The name of the certificate.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const certificate = await client.zeroTrust.access.certificates.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { associated_hostnames: ['admin.example.com'], account_id: 'account_id' },
);

console.log(certificate.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "associated_hostnames": [
      "admin.example.com"
    ],
    "created_at": "2014-01-01T05:20:00.12345Z",
    "expires_on": "2014-01-01T05:20:00.12345Z",
    "fingerprint": "MD5 Fingerprint=1E:80:0F:7A:FD:31:55:96:DE:D5:CB:E2:F0:91:F6:91",
    "name": "Allow devs",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete an mTLS certificate

`client.zeroTrust.access.certificates.delete(stringcertificateId, CertificateDeleteParamsparams?, RequestOptionsoptions?): CertificateDeleteResponse`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates/{certificate_id}`

Deletes an mTLS certificate.

### Parameters

- `certificateId: string`

  UUID.

- `params: CertificateDeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CertificateDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const certificate = await client.zeroTrust.access.certificates.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(certificate.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Associated Hostnames

- `AssociatedHostnames = string`

  A fully-qualified domain name (FQDN).

### Certificate

- `Certificate`

  - `id?: string`

    The ID of the application that will use this certificate.

  - `associated_hostnames?: Array<AssociatedHostnames>`

    The hostnames of the applications that will use this certificate.

  - `expires_on?: string`

  - `fingerprint?: string`

    The MD5 fingerprint of the certificate.

  - `name?: string`

    The name of the certificate.

### Certificate Delete Response

- `CertificateDeleteResponse`

  - `id?: string`

    UUID.

# Settings

## List all mTLS hostname settings

`client.zeroTrust.access.certificates.settings.get(SettingGetParamsparams?, RequestOptionsoptions?): SinglePage<CertificateSettings>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates/settings`

List all mTLS hostname settings for this account or zone.

### Parameters

- `params: SettingGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CertificateSettings`

  - `china_network: boolean`

    Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.

  - `client_certificate_forwarding: boolean`

    Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.

  - `hostname: string`

    The hostname that these settings apply to.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const certificateSettings of client.zeroTrust.access.certificates.settings.get({
  account_id: 'account_id',
})) {
  console.log(certificateSettings.china_network);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "china_network": false,
      "client_certificate_forwarding": true,
      "hostname": "admin.example.com"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Update an mTLS certificate's hostname settings

`client.zeroTrust.access.certificates.settings.update(SettingUpdateParamsparams, RequestOptionsoptions?): SinglePage<CertificateSettings>`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/certificates/settings`

Updates an mTLS certificate's hostname settings.

### Parameters

- `params: SettingUpdateParams`

  - `settings: Array<CertificateSettings>`

    Body param

    - `china_network: boolean`

      Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.

    - `client_certificate_forwarding: boolean`

      Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.

    - `hostname: string`

      The hostname that these settings apply to.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `CertificateSettings`

  - `china_network: boolean`

    Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.

  - `client_certificate_forwarding: boolean`

    Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.

  - `hostname: string`

    The hostname that these settings apply to.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const certificateSettings of client.zeroTrust.access.certificates.settings.update({
  settings: [
    {
      china_network: false,
      client_certificate_forwarding: true,
      hostname: 'admin.example.com',
    },
  ],
  account_id: 'account_id',
})) {
  console.log(certificateSettings.china_network);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "china_network": false,
      "client_certificate_forwarding": true,
      "hostname": "admin.example.com"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Domain Types

### Certificate Settings

- `CertificateSettings`

  - `china_network: boolean`

    Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.

  - `client_certificate_forwarding: boolean`

    Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.

  - `hostname: string`

    The hostname that these settings apply to.

# Groups

## List Access groups

`client.zeroTrust.access.groups.list(GroupListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<GroupListResponse>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/groups`

Lists all Access groups.

### Parameters

- `params: GroupListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `name?: string`

    Query param: The name of the group.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `search?: string`

    Query param: Search for groups by other listed query parameters.

### Returns

- `GroupListResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const groupListResponse of client.zeroTrust.access.groups.list({
  account_id: 'account_id',
})) {
  console.log(groupListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "exclude": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "include": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "is_default": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "name": "Allow devs",
      "require": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get an Access group

`client.zeroTrust.access.groups.get(stringgroupId, GroupGetParamsparams?, RequestOptionsoptions?): GroupGetResponse`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}`

Fetches a single Access group.

### Parameters

- `groupId: string`

  UUID.

- `params: GroupGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `GroupGetResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const group = await client.zeroTrust.access.groups.get('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: 'account_id',
});

console.log(group.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "is_default": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "name": "Allow devs",
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create an Access group

`client.zeroTrust.access.groups.create(GroupCreateParamsparams, RequestOptionsoptions?): GroupCreateResponse`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/groups`

Creates a new Access group.

### Parameters

- `params: GroupCreateParams`

  - `include: Array<AccessRule>`

    Body param: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `name: string`

    Body param: The name of the Access group.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `exclude?: Array<AccessRule>`

    Body param: Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: boolean`

    Body param: Whether this is the default group

  - `require?: Array<AccessRule>`

    Body param: Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Returns

- `GroupCreateResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const group = await client.zeroTrust.access.groups.create({
  include: [{ group: { id: 'aa0a4aab-672b-4bdb-bc33-a59f1130a11f' } }],
  name: 'Allow devs',
  account_id: 'account_id',
});

console.log(group.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "is_default": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "name": "Allow devs",
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update an Access group

`client.zeroTrust.access.groups.update(stringgroupId, GroupUpdateParamsparams, RequestOptionsoptions?): GroupUpdateResponse`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}`

Updates a configured Access group.

### Parameters

- `groupId: string`

  UUID.

- `params: GroupUpdateParams`

  - `include: Array<AccessRule>`

    Body param: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `name: string`

    Body param: The name of the Access group.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `exclude?: Array<AccessRule>`

    Body param: Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: boolean`

    Body param: Whether this is the default group

  - `require?: Array<AccessRule>`

    Body param: Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Returns

- `GroupUpdateResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const group = await client.zeroTrust.access.groups.update('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  include: [{ group: { id: 'aa0a4aab-672b-4bdb-bc33-a59f1130a11f' } }],
  name: 'Allow devs',
  account_id: 'account_id',
});

console.log(group.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "is_default": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "name": "Allow devs",
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete an Access group

`client.zeroTrust.access.groups.delete(stringgroupId, GroupDeleteParamsparams?, RequestOptionsoptions?): GroupDeleteResponse`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/groups/{group_id}`

Deletes an Access group.

### Parameters

- `groupId: string`

  UUID.

- `params: GroupDeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `GroupDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const group = await client.zeroTrust.access.groups.delete('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: 'account_id',
});

console.log(group.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Zero Trust Group

- `ZeroTrustGroup`

  - `id?: string`

    The unique Cloudflare-generated Id of the SCIM resource.

  - `displayName?: string`

    The display name of the SCIM Group resource.

  - `externalId?: string`

    The IdP-generated Id of the SCIM resource.

  - `meta?: Meta`

    The metadata of the SCIM resource.

    - `created?: string`

      The timestamp of when the SCIM resource was created.

    - `lastModified?: string`

      The timestamp of when the SCIM resource was last modified.

  - `schemas?: Array<string>`

    The list of URIs which indicate the attributes contained within a SCIM resource.

### Group List Response

- `GroupListResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Group Get Response

- `GroupGetResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Group Create Response

- `GroupCreateResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Group Update Response

- `GroupUpdateResponse`

  - `id?: string`

    UUID.

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `is_default?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `name?: string`

    The name of the Access group.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

### Group Delete Response

- `GroupDeleteResponse`

  - `id?: string`

    UUID.

# Service Tokens

## List service tokens

`client.zeroTrust.access.serviceTokens.list(ServiceTokenListParamsparams?, RequestOptionsoptions?): V4PagePaginationArray<ServiceToken>`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens`

Lists all service tokens.

### Parameters

- `params: ServiceTokenListParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `name?: string`

    Query param: The name of the service token.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `search?: string`

    Query param: Search for service tokens by other listed query parameters.

### Returns

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const serviceToken of client.zeroTrust.access.serviceTokens.list({
  account_id: 'account_id',
})) {
  console.log(serviceToken.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "duration": "60m",
      "expires_at": "2014-01-01T05:20:00.12345Z",
      "last_seen_at": "2014-01-01T05:20:00.12345Z",
      "name": "CI/CD token",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get a service token

`client.zeroTrust.access.serviceTokens.get(stringserviceTokenId, ServiceTokenGetParamsparams?, RequestOptionsoptions?): ServiceToken`

**get** `/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}`

Fetches a single service token.

### Parameters

- `serviceTokenId: string`

  UUID.

- `params: ServiceTokenGetParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const serviceToken = await client.zeroTrust.access.serviceTokens.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(serviceToken.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "expires_at": "2014-01-01T05:20:00.12345Z",
    "last_seen_at": "2014-01-01T05:20:00.12345Z",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create a service token

`client.zeroTrust.access.serviceTokens.create(ServiceTokenCreateParamsparams, RequestOptionsoptions?): ServiceTokenCreateResponse`

**post** `/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens`

Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.

### Parameters

- `params: ServiceTokenCreateParams`

  - `name: string`

    Body param: The name of the service token.

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `client_secret_version?: number`

    Body param: A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.

  - `duration?: string`

    Body param: The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `previous_client_secret_expires_at?: string`

    Body param: The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise.

### Returns

- `ServiceTokenCreateResponse`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `client_secret?: string`

    The Client Secret for the service token. Access will check for this value in the `CF-Access-Client-Secret` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const serviceToken = await client.zeroTrust.access.serviceTokens.create({
  name: 'CI/CD token',
  account_id: 'account_id',
});

console.log(serviceToken.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "client_secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update a service token

`client.zeroTrust.access.serviceTokens.update(stringserviceTokenId, ServiceTokenUpdateParamsparams, RequestOptionsoptions?): ServiceToken`

**put** `/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}`

Updates a configured service token.

### Parameters

- `serviceTokenId: string`

  UUID.

- `params: ServiceTokenUpdateParams`

  - `account_id?: string`

    Path param: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    Path param: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

  - `client_secret_version?: number`

    Body param: A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.

  - `duration?: string`

    Body param: The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `name?: string`

    Body param: The name of the service token.

  - `previous_client_secret_expires_at?: string`

    Body param: The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise.

### Returns

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const serviceToken = await client.zeroTrust.access.serviceTokens.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(serviceToken.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "expires_at": "2014-01-01T05:20:00.12345Z",
    "last_seen_at": "2014-01-01T05:20:00.12345Z",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete a service token

`client.zeroTrust.access.serviceTokens.delete(stringserviceTokenId, ServiceTokenDeleteParamsparams?, RequestOptionsoptions?): ServiceToken`

**delete** `/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}`

Deletes a service token.

### Parameters

- `serviceTokenId: string`

  UUID.

- `params: ServiceTokenDeleteParams`

  - `account_id?: string`

    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

  - `zone_id?: string`

    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

### Returns

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const serviceToken = await client.zeroTrust.access.serviceTokens.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: 'account_id' },
);

console.log(serviceToken.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "expires_at": "2014-01-01T05:20:00.12345Z",
    "last_seen_at": "2014-01-01T05:20:00.12345Z",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Refresh a service token

`client.zeroTrust.access.serviceTokens.refresh(stringserviceTokenId, ServiceTokenRefreshParamsparams, RequestOptionsoptions?): ServiceToken`

**post** `/accounts/{account_id}/access/service_tokens/{service_token_id}/refresh`

Refreshes the expiration of a service token.

### Parameters

- `serviceTokenId: string`

  UUID.

- `params: ServiceTokenRefreshParams`

  - `account_id: string`

    Identifier.

### Returns

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const serviceToken = await client.zeroTrust.access.serviceTokens.refresh(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(serviceToken.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "expires_at": "2014-01-01T05:20:00.12345Z",
    "last_seen_at": "2014-01-01T05:20:00.12345Z",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Rotate a service token

`client.zeroTrust.access.serviceTokens.rotate(stringserviceTokenId, ServiceTokenRotateParamsparams, RequestOptionsoptions?): ServiceTokenRotateResponse`

**post** `/accounts/{account_id}/access/service_tokens/{service_token_id}/rotate`

Generates a new Client Secret for a service token and revokes the old one.

### Parameters

- `serviceTokenId: string`

  UUID.

- `params: ServiceTokenRotateParams`

  - `account_id: string`

    Path param: Identifier.

  - `previous_client_secret_expires_at?: string`

    Body param: The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret.

### Returns

- `ServiceTokenRotateResponse`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `client_secret?: string`

    The Client Secret for the service token. Access will check for this value in the `CF-Access-Client-Secret` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `name?: string`

    The name of the service token.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.serviceTokens.rotate(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(response.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "client_id": "88bf3b6d86161464f6509f7219099e57.access.example.com",
    "client_secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5",
    "created_at": "2014-01-01T05:20:00.12345Z",
    "duration": "60m",
    "name": "CI/CD token",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Domain Types

### Service Token

- `ServiceToken`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `expires_at?: string`

  - `name?: string`

    The name of the service token.

### Service Token Create Response

- `ServiceTokenCreateResponse`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `client_secret?: string`

    The Client Secret for the service token. Access will check for this value in the `CF-Access-Client-Secret` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `name?: string`

    The name of the service token.

### Service Token Rotate Response

- `ServiceTokenRotateResponse`

  - `id?: string`

    The ID of the service token.

  - `client_id?: string`

    The Client ID for the service token. Access will check for this value in the `CF-Access-Client-ID` request header.

  - `client_secret?: string`

    The Client Secret for the service token. Access will check for this value in the `CF-Access-Client-Secret` request header.

  - `duration?: string`

    The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

  - `name?: string`

    The name of the service token.

# Bookmarks

## List Bookmark applications

`client.zeroTrust.access.bookmarks.list(BookmarkListParamsparams, RequestOptionsoptions?): SinglePage<Bookmark>`

**get** `/accounts/{account_id}/access/bookmarks`

Lists Bookmark applications.

### Parameters

- `params: BookmarkListParams`

  - `account_id: string`

### Returns

- `Bookmark`

  - `id?: string`

    The unique identifier for the Bookmark application.

  - `app_launcher_visible?: boolean`

    Displays the application in the App Launcher.

  - `domain?: string`

    The domain of the Bookmark application.

  - `logo_url?: string`

    The image URL for the logo shown in the App Launcher dashboard.

  - `name?: string`

    The name of the Bookmark application.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const bookmark of client.zeroTrust.access.bookmarks.list({
  account_id: '699d98642c564d2e855e9661899b7252',
})) {
  console.log(bookmark.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "id",
      "app_launcher_visible": true,
      "created_at": "2014-01-01T05:20:00.12345Z",
      "domain": "example.com",
      "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
      "name": "My Website",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get a Bookmark application

`client.zeroTrust.access.bookmarks.get(stringbookmarkId, BookmarkGetParamsparams, RequestOptionsoptions?): Bookmark`

**get** `/accounts/{account_id}/access/bookmarks/{bookmark_id}`

Fetches a single Bookmark application.

### Parameters

- `bookmarkId: string`

  UUID.

- `params: BookmarkGetParams`

  - `account_id: string`

### Returns

- `Bookmark`

  - `id?: string`

    The unique identifier for the Bookmark application.

  - `app_launcher_visible?: boolean`

    Displays the application in the App Launcher.

  - `domain?: string`

    The domain of the Bookmark application.

  - `logo_url?: string`

    The image URL for the logo shown in the App Launcher dashboard.

  - `name?: string`

    The name of the Bookmark application.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const bookmark = await client.zeroTrust.access.bookmarks.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '699d98642c564d2e855e9661899b7252' },
);

console.log(bookmark.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "app_launcher_visible": true,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "domain": "example.com",
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "name": "My Website",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create a Bookmark application

`client.zeroTrust.access.bookmarks.create(stringbookmarkId, BookmarkCreateParamsparams, RequestOptionsoptions?): Bookmark`

**post** `/accounts/{account_id}/access/bookmarks/{bookmark_id}`

Create a new Bookmark application.

### Parameters

- `bookmarkId: string`

  UUID.

- `params: BookmarkCreateParams`

  - `account_id: string`

    Path param

  - `body: unknown`

    Body param

### Returns

- `Bookmark`

  - `id?: string`

    The unique identifier for the Bookmark application.

  - `app_launcher_visible?: boolean`

    Displays the application in the App Launcher.

  - `domain?: string`

    The domain of the Bookmark application.

  - `logo_url?: string`

    The image URL for the logo shown in the App Launcher dashboard.

  - `name?: string`

    The name of the Bookmark application.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const bookmark = await client.zeroTrust.access.bookmarks.create(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  {
    account_id: '699d98642c564d2e855e9661899b7252',
    body: {},
  },
);

console.log(bookmark.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "app_launcher_visible": true,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "domain": "example.com",
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "name": "My Website",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update a Bookmark application

`client.zeroTrust.access.bookmarks.update(stringbookmarkId, BookmarkUpdateParamsparams, RequestOptionsoptions?): Bookmark`

**put** `/accounts/{account_id}/access/bookmarks/{bookmark_id}`

Updates a configured Bookmark application.

### Parameters

- `bookmarkId: string`

  UUID.

- `params: BookmarkUpdateParams`

  - `account_id: string`

    Path param

  - `body: unknown`

    Body param

### Returns

- `Bookmark`

  - `id?: string`

    The unique identifier for the Bookmark application.

  - `app_launcher_visible?: boolean`

    Displays the application in the App Launcher.

  - `domain?: string`

    The domain of the Bookmark application.

  - `logo_url?: string`

    The image URL for the logo shown in the App Launcher dashboard.

  - `name?: string`

    The name of the Bookmark application.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const bookmark = await client.zeroTrust.access.bookmarks.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  {
    account_id: '699d98642c564d2e855e9661899b7252',
    body: {},
  },
);

console.log(bookmark.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "id",
    "app_launcher_visible": true,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "domain": "example.com",
    "logo_url": "https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg",
    "name": "My Website",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete a Bookmark application

`client.zeroTrust.access.bookmarks.delete(stringbookmarkId, BookmarkDeleteParamsparams, RequestOptionsoptions?): BookmarkDeleteResponse`

**delete** `/accounts/{account_id}/access/bookmarks/{bookmark_id}`

Deletes a Bookmark application.

### Parameters

- `bookmarkId: string`

  UUID.

- `params: BookmarkDeleteParams`

  - `account_id: string`

### Returns

- `BookmarkDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const bookmark = await client.zeroTrust.access.bookmarks.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '699d98642c564d2e855e9661899b7252' },
);

console.log(bookmark.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Bookmark

- `Bookmark`

  - `id?: string`

    The unique identifier for the Bookmark application.

  - `app_launcher_visible?: boolean`

    Displays the application in the App Launcher.

  - `domain?: string`

    The domain of the Bookmark application.

  - `logo_url?: string`

    The image URL for the logo shown in the App Launcher dashboard.

  - `name?: string`

    The name of the Bookmark application.

### Bookmark Delete Response

- `BookmarkDeleteResponse`

  - `id?: string`

    UUID.

# Keys

## Get the Access key configuration

`client.zeroTrust.access.keys.get(KeyGetParamsparams, RequestOptionsoptions?): KeyGetResponse`

**get** `/accounts/{account_id}/access/keys`

Gets the Access key rotation settings for an account.

### Parameters

- `params: KeyGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `KeyGetResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const key = await client.zeroTrust.access.keys.get({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(key.days_until_next_rotation);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "days_until_next_rotation": 1,
    "key_rotation_interval_days": 30,
    "last_key_rotation_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update the Access key configuration

`client.zeroTrust.access.keys.update(KeyUpdateParamsparams, RequestOptionsoptions?): KeyUpdateResponse`

**put** `/accounts/{account_id}/access/keys`

Updates the Access key rotation settings for an account.

### Parameters

- `params: KeyUpdateParams`

  - `account_id: string`

    Path param: Identifier.

  - `key_rotation_interval_days: number`

    Body param: The number of days between key rotations.

### Returns

- `KeyUpdateResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const key = await client.zeroTrust.access.keys.update({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  key_rotation_interval_days: 30,
});

console.log(key.days_until_next_rotation);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "days_until_next_rotation": 1,
    "key_rotation_interval_days": 30,
    "last_key_rotation_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Rotate Access keys

`client.zeroTrust.access.keys.rotate(KeyRotateParamsparams, RequestOptionsoptions?): KeyRotateResponse`

**post** `/accounts/{account_id}/access/keys/rotate`

Perfoms a key rotation for an account.

### Parameters

- `params: KeyRotateParams`

  - `account_id: string`

    Identifier.

### Returns

- `KeyRotateResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.zeroTrust.access.keys.rotate({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(response.days_until_next_rotation);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "days_until_next_rotation": 1,
    "key_rotation_interval_days": 30,
    "last_key_rotation_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Domain Types

### Key Get Response

- `KeyGetResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

### Key Update Response

- `KeyUpdateResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

### Key Rotate Response

- `KeyRotateResponse`

  - `days_until_next_rotation?: number`

    The number of days until the next key rotation.

  - `key_rotation_interval_days?: number`

    The number of days between key rotations.

  - `last_key_rotation_at?: string`

    The timestamp of the previous key rotation.

# Logs

# Access Requests

## Get Access authentication logs

`client.zeroTrust.access.logs.accessRequests.list(AccessRequestListParamsparams, RequestOptionsoptions?): AccessRequestListResponse`

**get** `/accounts/{account_id}/access/logs/access_requests`

Gets a list of Access authentication audit logs for an account.

### Parameters

- `params: AccessRequestListParams`

  - `account_id: string`

    Path param: Identifier.

  - `allowedOp?: "eq" | "neq"`

    Query param: Operator for the `allowed` filter.

    - `"eq"`

    - `"neq"`

  - `app_typeOp?: "eq" | "neq"`

    Query param: Operator for the `app_type` filter.

    - `"eq"`

    - `"neq"`

  - `app_uidOp?: "eq" | "neq"`

    Query param: Operator for the `app_uid` filter.

    - `"eq"`

    - `"neq"`

  - `country_codeOp?: "eq" | "neq"`

    Query param: Operator for the `country_code` filter.

    - `"eq"`

    - `"neq"`

  - `direction?: "desc" | "asc"`

    Query param: The chronological sorting order for the logs.

    - `"desc"`

    - `"asc"`

  - `email?: string`

    Query param: Filter by user email. Defaults to substring matching. To force exact matching, set `email_exact=true`.
    Example (default): `email=@example.com` returns all events with that domain.
    Example (exact): `email=user@example.com&email_exact=true` returns only that user.

  - `email_exact?: boolean`

    Query param: When true, `email` is matched exactly instead of substring matching.

  - `emailOp?: "eq" | "neq"`

    Query param: Operator for the `email` filter.

    - `"eq"`

    - `"neq"`

  - `fields?: string`

    Query param: Comma-separated list of fields to include in the response.
    When omitted, all fields are returned.

  - `idpOp?: "eq" | "neq"`

    Query param: Operator for the `idp` filter.

    - `"eq"`

    - `"neq"`

  - `limit?: number`

    Query param: The maximum number of log entries to retrieve.

  - `non_identityOp?: "eq" | "neq"`

    Query param: Operator for the `non_identity` filter.

    - `"eq"`

    - `"neq"`

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `ray_idOp?: "eq" | "neq"`

    Query param: Operator for the `ray_id` filter.

    - `"eq"`

    - `"neq"`

  - `since?: string`

    Query param: The earliest event timestamp to query.

  - `until?: string`

    Query param: The latest event timestamp to query.

  - `user_id?: string`

    Query param: Filter by user UUID.

  - `user_idOp?: "eq" | "neq"`

    Query param: Operator for the `user_id` filter.

    - `"eq"`

    - `"neq"`

### Returns

- `AccessRequestListResponse = Array<AccessRequest>`

  - `action?: string`

    The event that occurred, such as a login attempt.

  - `allowed?: boolean`

    The result of the authentication event.

  - `app_domain?: string`

    The URL of the Access application.

  - `app_uid?: string`

    The unique identifier for the Access application.

  - `connection?: string`

    The IdP used to authenticate.

  - `created_at?: string`

  - `ip_address?: string`

    The IP address of the authenticating user.

  - `ray_id?: string`

    The unique identifier for the request to Cloudflare.

  - `user_email?: string`

    The email address of the authenticating user.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiEmail: process.env['CLOUDFLARE_EMAIL'], // This is the default and can be omitted
  apiKey: process.env['CLOUDFLARE_API_KEY'], // This is the default and can be omitted
});

const accessRequests = await client.zeroTrust.access.logs.accessRequests.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(accessRequests);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "action": "login",
      "allowed": true,
      "app_domain": "test.example.com/admin",
      "app_uid": "df7e2w5f-02b7-4d9d-af26-8d1988fca630",
      "connection": "saml",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "ip_address": "198.41.129.166",
      "ray_id": "187d944c61940c77",
      "user_email": "user@example.com"
    }
  ]
}
```

## Domain Types

### Access Request List Response

- `AccessRequestListResponse = Array<AccessRequest>`

  - `action?: string`

    The event that occurred, such as a login attempt.

  - `allowed?: boolean`

    The result of the authentication event.

  - `app_domain?: string`

    The URL of the Access application.

  - `app_uid?: string`

    The unique identifier for the Access application.

  - `connection?: string`

    The IdP used to authenticate.

  - `created_at?: string`

  - `ip_address?: string`

    The IP address of the authenticating user.

  - `ray_id?: string`

    The unique identifier for the request to Cloudflare.

  - `user_email?: string`

    The email address of the authenticating user.

# SCIM

## Domain Types

### Access Request

- `AccessRequest`

  - `action?: string`

    The event that occurred, such as a login attempt.

  - `allowed?: boolean`

    The result of the authentication event.

  - `app_domain?: string`

    The URL of the Access application.

  - `app_uid?: string`

    The unique identifier for the Access application.

  - `connection?: string`

    The IdP used to authenticate.

  - `created_at?: string`

  - `ip_address?: string`

    The IP address of the authenticating user.

  - `ray_id?: string`

    The unique identifier for the request to Cloudflare.

  - `user_email?: string`

    The email address of the authenticating user.

# Updates

## List Access SCIM update logs

`client.zeroTrust.access.logs.scim.updates.list(UpdateListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<UpdateListResponse>`

**get** `/accounts/{account_id}/access/logs/scim/updates`

Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

### Parameters

- `params: UpdateListParams`

  - `account_id: string`

    Path param: Identifier.

  - `idp_id: Array<string>`

    Query param: The unique Id of the IdP that has SCIM enabled.

  - `cf_resource_id?: string`

    Query param: The unique Cloudflare-generated Id of the SCIM resource.

  - `direction?: "desc" | "asc"`

    Query param: The chronological order used to sort the logs.

    - `"desc"`

    - `"asc"`

  - `idp_resource_id?: string`

    Query param: The IdP-generated Id of the SCIM resource.

  - `limit?: number`

    Query param: The maximum number of update logs to retrieve.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `request_method?: Array<"DELETE" | "PATCH" | "POST" | "PUT">`

    Query param: The request method of the SCIM request.

    - `"DELETE"`

    - `"PATCH"`

    - `"POST"`

    - `"PUT"`

  - `resource_group_name?: string`

    Query param: The display name of the SCIM Group resource.

  - `resource_type?: Array<"USER" | "GROUP">`

    Query param: The resource type of the SCIM request.

    - `"USER"`

    - `"GROUP"`

  - `resource_user_email?: string`

    Query param: The email address of the SCIM User resource.

  - `since?: string`

    Query param: the timestamp of the earliest update log.

  - `status?: Array<"FAILURE" | "SUCCESS">`

    Query param: The status of the SCIM request.

    - `"FAILURE"`

    - `"SUCCESS"`

  - `until?: string`

    Query param: the timestamp of the most-recent update log.

### Returns

- `UpdateListResponse`

  - `cf_resource_id?: string`

    The unique Cloudflare-generated Id of the SCIM resource.

  - `error_description?: string`

    The error message which is generated when the status of the SCIM request is 'FAILURE'.

  - `idp_id?: string`

    The unique Id of the IdP that has SCIM enabled.

  - `idp_resource_id?: string`

    The IdP-generated Id of the SCIM resource.

  - `logged_at?: string`

  - `request_body?: string`

    The JSON-encoded string body of the SCIM request.

  - `request_method?: string`

    The request method of the SCIM request.

  - `resource_group_name?: string`

    The display name of the SCIM Group resource if it exists.

  - `resource_type?: string`

    The resource type of the SCIM request.

  - `resource_user_email?: string`

    The email address of the SCIM User resource if it exists.

  - `status?: string`

    The status of the SCIM request.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiEmail: process.env['CLOUDFLARE_EMAIL'], // This is the default and can be omitted
  apiKey: process.env['CLOUDFLARE_API_KEY'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const updateListResponse of client.zeroTrust.access.logs.scim.updates.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  idp_id: ['df7e2w5f-02b7-4d9d-af26-8d1988fca630', '0194ae2c-efcf-7cfb-8884-055f1a161fa5'],
})) {
  console.log(updateListResponse.cf_resource_id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "cf_resource_id": "bd97ef8d-7986-43e3-9ee0-c25dda33e4b0",
      "error_description": "Invalid JSON body",
      "idp_id": "df7e2w5f-02b7-4d9d-af26-8d1988fca630",
      "idp_resource_id": "all_employees",
      "logged_at": "2014-01-01T05:20:00.12345Z",
      "request_body": "{}}",
      "request_method": "DELETE",
      "resource_group_name": "ALL_EMPLOYEES",
      "resource_type": "GROUP",
      "resource_user_email": "john.smith@example.com",
      "status": "FAILURE"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Domain Types

### Update List Response

- `UpdateListResponse`

  - `cf_resource_id?: string`

    The unique Cloudflare-generated Id of the SCIM resource.

  - `error_description?: string`

    The error message which is generated when the status of the SCIM request is 'FAILURE'.

  - `idp_id?: string`

    The unique Id of the IdP that has SCIM enabled.

  - `idp_resource_id?: string`

    The IdP-generated Id of the SCIM resource.

  - `logged_at?: string`

  - `request_body?: string`

    The JSON-encoded string body of the SCIM request.

  - `request_method?: string`

    The request method of the SCIM request.

  - `resource_group_name?: string`

    The display name of the SCIM Group resource if it exists.

  - `resource_type?: string`

    The resource type of the SCIM request.

  - `resource_user_email?: string`

    The email address of the SCIM User resource if it exists.

  - `status?: string`

    The status of the SCIM request.

# Users

## Get users

`client.zeroTrust.access.users.list(UserListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<UserListResponse>`

**get** `/accounts/{account_id}/access/users`

Gets a list of users for an account.

### Parameters

- `params: UserListParams`

  - `account_id: string`

    Path param: Identifier.

  - `email?: string`

    Query param: The email of the user.

  - `name?: string`

    Query param: The name of the user.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

  - `search?: string`

    Query param: Search for users by other listed query parameters.

### Returns

- `UserListResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const userListResponse of client.zeroTrust.access.users.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(userListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "access_seat": false,
      "active_device_count": 2,
      "created_at": "2014-01-01T05:20:00.12345Z",
      "email": "jdoe@example.com",
      "gateway_seat": false,
      "last_successful_login": "2020-07-01T05:20:00Z",
      "name": "Jane Doe",
      "seat_uid": "seat_uid",
      "uid": "uid",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 100,
    "total_count": 1,
    "total_pages": 100
  }
}
```

## Get a user

`client.zeroTrust.access.users.get(stringuserId, UserGetParamsparams, RequestOptionsoptions?): UserGetResponse`

**get** `/accounts/{account_id}/access/users/{user_id}`

Gets a specific user for an account.

### Parameters

- `userId: string`

  UUID.

- `params: UserGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `UserGetResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const user = await client.zeroTrust.access.users.get('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(user.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "access_seat": false,
    "active_device_count": 2,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "email": "jdoe@example.com",
    "gateway_seat": false,
    "last_successful_login": "2020-07-01T05:20:00Z",
    "name": "Jane Doe",
    "seat_uid": "seat_uid",
    "uid": "uid",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create a user

`client.zeroTrust.access.users.create(UserCreateParamsparams, RequestOptionsoptions?): UserCreateResponse`

**post** `/accounts/{account_id}/access/users`

Creates a new user.

### Parameters

- `params: UserCreateParams`

  - `account_id: string`

    Path param: Identifier.

  - `email: string`

    Body param: The email of the user.

  - `name?: string`

    Body param: The name of the user.

### Returns

- `UserCreateResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const user = await client.zeroTrust.access.users.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  email: 'jdoe@example.com',
});

console.log(user.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "access_seat": false,
    "active_device_count": 2,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "email": "jdoe@example.com",
    "gateway_seat": false,
    "last_successful_login": "2020-07-01T05:20:00Z",
    "name": "Jane Doe",
    "seat_uid": "seat_uid",
    "uid": "uid",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update a user

`client.zeroTrust.access.users.update(stringuserId, UserUpdateParamsparams, RequestOptionsoptions?): UserUpdateResponse`

**put** `/accounts/{account_id}/access/users/{user_id}`

Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).

### Parameters

- `userId: string`

  UUID.

- `params: UserUpdateParams`

  - `account_id: string`

    Path param: Identifier.

  - `email: string`

    Body param: The email of the user.

  - `name: string`

    Body param: The name of the user.

### Returns

- `UserUpdateResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const user = await client.zeroTrust.access.users.update('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  email: 'jdoe@example.com',
  name: 'Jane Doe',
});

console.log(user.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "access_seat": false,
    "active_device_count": 2,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "email": "jdoe@example.com",
    "gateway_seat": false,
    "last_successful_login": "2020-07-01T05:20:00Z",
    "name": "Jane Doe",
    "seat_uid": "seat_uid",
    "uid": "uid",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete a user

`client.zeroTrust.access.users.delete(stringuserId, UserDeleteParamsparams, RequestOptionsoptions?): UserDeleteResponse | null`

**delete** `/accounts/{account_id}/access/users/{user_id}`

Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.

### Parameters

- `userId: string`

  UUID.

- `params: UserDeleteParams`

  - `account_id: string`

    Identifier.

### Returns

- `UserDeleteResponse = unknown`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const user = await client.zeroTrust.access.users.delete('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(user);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {}
}
```

## Domain Types

### Access User

- `AccessUser`

  - `id?: string`

    The unique Cloudflare-generated Id of the SCIM resource.

  - `active?: boolean`

    Determines the status of the SCIM User resource.

  - `displayName?: string`

    The name of the SCIM User resource.

  - `emails?: Array<Email>`

    - `primary?: boolean`

      Indicates if the email address is the primary email belonging to the SCIM User resource.

    - `type?: string`

      Indicates the type of the email address.

    - `value?: string`

      The email address of the SCIM User resource.

  - `externalId?: string`

    The IdP-generated Id of the SCIM resource.

  - `meta?: Meta`

    The metadata of the SCIM resource.

    - `created?: string`

      The timestamp of when the SCIM resource was created.

    - `lastModified?: string`

      The timestamp of when the SCIM resource was last modified.

  - `schemas?: Array<string>`

    The list of URIs which indicate the attributes contained within a SCIM resource.

### User List Response

- `UserListResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### User Get Response

- `UserGetResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### User Create Response

- `UserCreateResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### User Update Response

- `UserUpdateResponse`

  - `id?: string`

    UUID.

  - `access_seat?: boolean`

    True if the user has authenticated with Cloudflare Access.

  - `active_device_count?: number`

    The number of active devices registered to the user.

  - `created_at?: string`

  - `email?: string`

    The email of the user.

  - `gateway_seat?: boolean`

    True if the user has logged into the WARP client.

  - `last_successful_login?: string`

    The time at which the user last successfully logged in.

  - `name?: string`

    The name of the user.

  - `seat_uid?: string`

    The unique API identifier for the Zero Trust seat.

  - `uid?: string`

    The unique API identifier for the user.

  - `updated_at?: string`

### User Delete Response

- `UserDeleteResponse = unknown`

# Active Sessions

## Get active sessions

`client.zeroTrust.access.users.activeSessions.list(stringuserId, ActiveSessionListParamsparams, RequestOptionsoptions?): SinglePage<ActiveSessionListResponse>`

**get** `/accounts/{account_id}/access/users/{user_id}/active_sessions`

Get active sessions for a single user.

### Parameters

- `userId: string`

  UUID.

- `params: ActiveSessionListParams`

  - `account_id: string`

    Identifier.

### Returns

- `ActiveSessionListResponse`

  - `expiration?: number`

  - `metadata?: Metadata`

    - `apps?: Record<string, Apps>`

      - `hostname?: string`

      - `name?: string`

      - `type?: string`

      - `uid?: string`

    - `expires?: number`

    - `iat?: number`

    - `nonce?: string`

    - `ttl?: number`

  - `name?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const activeSessionListResponse of client.zeroTrust.access.users.activeSessions.list(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
)) {
  console.log(activeSessionListResponse.expiration);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "expiration": 1694813506,
      "metadata": {
        "apps": {
          "foo": {
            "hostname": "test.example.com",
            "name": "app name",
            "type": "self_hosted",
            "uid": "cc2a8145-0128-4429-87f3-872c4d380c4e"
          }
        },
        "expires": 1694813506,
        "iat": 1694791905,
        "nonce": "X1aXj1lFVcqqyoXF",
        "ttl": 21600
      },
      "name": "name"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get single active session

`client.zeroTrust.access.users.activeSessions.get(stringuserId, stringnonce, ActiveSessionGetParamsparams, RequestOptionsoptions?): ActiveSessionGetResponse`

**get** `/accounts/{account_id}/access/users/{user_id}/active_sessions/{nonce}`

Get an active session for a single user.

### Parameters

- `userId: string`

  UUID.

- `nonce: string`

- `params: ActiveSessionGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `ActiveSessionGetResponse`

  - `account_id?: string`

  - `auth_status?: string`

  - `common_name?: string`

  - `device_id?: string`

  - `device_sessions?: Record<string, DeviceSessions>`

    - `last_authenticated?: number`

  - `devicePosture?: Record<string, DevicePosture>`

    - `id?: string`

    - `check?: Check`

      - `exists?: boolean`

      - `path?: string`

    - `data?: unknown`

    - `description?: string`

    - `error?: string`

    - `rule_name?: string`

    - `success?: boolean`

    - `timestamp?: string`

    - `type?: string`

  - `email?: string`

  - `geo?: UserPolicyCheckGeo`

    - `country?: string`

  - `iat?: number`

  - `idp?: IdP`

    - `id?: string`

    - `type?: string`

  - `ip?: string`

  - `is_gateway?: boolean`

  - `is_warp?: boolean`

  - `isActive?: boolean`

  - `mtls_auth?: MTLSAuth`

    - `auth_status?: string`

    - `cert_issuer_dn?: string`

    - `cert_issuer_ski?: string`

    - `cert_presented?: boolean`

    - `cert_serial?: string`

  - `service_token_id?: string`

  - `service_token_status?: boolean`

  - `user_uuid?: string`

  - `version?: number`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const activeSession = await client.zeroTrust.access.users.activeSessions.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  'X1aXj1lFVcqqyoXF',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(activeSession.account_id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "account_id": "1234567890",
    "auth_status": "NONE",
    "common_name": "",
    "device_id": "",
    "device_sessions": {
      "foo": {
        "last_authenticated": 1638832687
      }
    },
    "devicePosture": {
      "foo": {
        "id": "id",
        "check": {
          "exists": true,
          "path": "path"
        },
        "data": {},
        "description": "description",
        "error": "error",
        "rule_name": "rule_name",
        "success": true,
        "timestamp": "timestamp",
        "type": "type"
      }
    },
    "email": "test@cloudflare.com",
    "geo": {
      "country": "US"
    },
    "iat": 1694791905,
    "idp": {
      "id": "id",
      "type": "type"
    },
    "ip": "127.0.0.0",
    "is_gateway": false,
    "is_warp": false,
    "isActive": true,
    "mtls_auth": {
      "auth_status": "auth_status",
      "cert_issuer_dn": "cert_issuer_dn",
      "cert_issuer_ski": "cert_issuer_ski",
      "cert_presented": true,
      "cert_serial": "cert_serial"
    },
    "service_token_id": "",
    "service_token_status": false,
    "user_uuid": "57cf8cf2-f55a-4588-9ac9-f5e41e9f09b4",
    "version": 2
  }
}
```

## Domain Types

### Active Session List Response

- `ActiveSessionListResponse`

  - `expiration?: number`

  - `metadata?: Metadata`

    - `apps?: Record<string, Apps>`

      - `hostname?: string`

      - `name?: string`

      - `type?: string`

      - `uid?: string`

    - `expires?: number`

    - `iat?: number`

    - `nonce?: string`

    - `ttl?: number`

  - `name?: string`

### Active Session Get Response

- `ActiveSessionGetResponse`

  - `account_id?: string`

  - `auth_status?: string`

  - `common_name?: string`

  - `device_id?: string`

  - `device_sessions?: Record<string, DeviceSessions>`

    - `last_authenticated?: number`

  - `devicePosture?: Record<string, DevicePosture>`

    - `id?: string`

    - `check?: Check`

      - `exists?: boolean`

      - `path?: string`

    - `data?: unknown`

    - `description?: string`

    - `error?: string`

    - `rule_name?: string`

    - `success?: boolean`

    - `timestamp?: string`

    - `type?: string`

  - `email?: string`

  - `geo?: UserPolicyCheckGeo`

    - `country?: string`

  - `iat?: number`

  - `idp?: IdP`

    - `id?: string`

    - `type?: string`

  - `ip?: string`

  - `is_gateway?: boolean`

  - `is_warp?: boolean`

  - `isActive?: boolean`

  - `mtls_auth?: MTLSAuth`

    - `auth_status?: string`

    - `cert_issuer_dn?: string`

    - `cert_issuer_ski?: string`

    - `cert_presented?: boolean`

    - `cert_serial?: string`

  - `service_token_id?: string`

  - `service_token_status?: boolean`

  - `user_uuid?: string`

  - `version?: number`

# Last Seen Identity

## Get last seen identity

`client.zeroTrust.access.users.lastSeenIdentity.get(stringuserId, LastSeenIdentityGetParamsparams, RequestOptionsoptions?): Identity`

**get** `/accounts/{account_id}/access/users/{user_id}/last_seen_identity`

Get last seen identity for a single user.

### Parameters

- `userId: string`

  UUID.

- `params: LastSeenIdentityGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `Identity`

  - `account_id?: string`

  - `auth_status?: string`

  - `common_name?: string`

  - `device_id?: string`

  - `device_sessions?: Record<string, DeviceSessions>`

    - `last_authenticated?: number`

  - `devicePosture?: Record<string, DevicePosture>`

    - `id?: string`

    - `check?: Check`

      - `exists?: boolean`

      - `path?: string`

    - `data?: unknown`

    - `description?: string`

    - `error?: string`

    - `rule_name?: string`

    - `success?: boolean`

    - `timestamp?: string`

    - `type?: string`

  - `email?: string`

  - `geo?: UserPolicyCheckGeo`

    - `country?: string`

  - `iat?: number`

  - `idp?: IdP`

    - `id?: string`

    - `type?: string`

  - `ip?: string`

  - `is_gateway?: boolean`

  - `is_warp?: boolean`

  - `mtls_auth?: MTLSAuth`

    - `auth_status?: string`

    - `cert_issuer_dn?: string`

    - `cert_issuer_ski?: string`

    - `cert_presented?: boolean`

    - `cert_serial?: string`

  - `service_token_id?: string`

  - `service_token_status?: boolean`

  - `user_uuid?: string`

  - `version?: number`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const identity = await client.zeroTrust.access.users.lastSeenIdentity.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(identity.account_id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "account_id": "1234567890",
    "auth_status": "NONE",
    "common_name": "",
    "device_id": "",
    "device_sessions": {
      "foo": {
        "last_authenticated": 1638832687
      }
    },
    "devicePosture": {
      "foo": {
        "id": "id",
        "check": {
          "exists": true,
          "path": "path"
        },
        "data": {},
        "description": "description",
        "error": "error",
        "rule_name": "rule_name",
        "success": true,
        "timestamp": "timestamp",
        "type": "type"
      }
    },
    "email": "test@cloudflare.com",
    "geo": {
      "country": "US"
    },
    "iat": 1694791905,
    "idp": {
      "id": "id",
      "type": "type"
    },
    "ip": "127.0.0.0",
    "is_gateway": false,
    "is_warp": false,
    "mtls_auth": {
      "auth_status": "auth_status",
      "cert_issuer_dn": "cert_issuer_dn",
      "cert_issuer_ski": "cert_issuer_ski",
      "cert_presented": true,
      "cert_serial": "cert_serial"
    },
    "service_token_id": "",
    "service_token_status": false,
    "user_uuid": "57cf8cf2-f55a-4588-9ac9-f5e41e9f09b4",
    "version": 2
  }
}
```

## Domain Types

### Identity

- `Identity`

  - `account_id?: string`

  - `auth_status?: string`

  - `common_name?: string`

  - `device_id?: string`

  - `device_sessions?: Record<string, DeviceSessions>`

    - `last_authenticated?: number`

  - `devicePosture?: Record<string, DevicePosture>`

    - `id?: string`

    - `check?: Check`

      - `exists?: boolean`

      - `path?: string`

    - `data?: unknown`

    - `description?: string`

    - `error?: string`

    - `rule_name?: string`

    - `success?: boolean`

    - `timestamp?: string`

    - `type?: string`

  - `email?: string`

  - `geo?: UserPolicyCheckGeo`

    - `country?: string`

  - `iat?: number`

  - `idp?: IdP`

    - `id?: string`

    - `type?: string`

  - `ip?: string`

  - `is_gateway?: boolean`

  - `is_warp?: boolean`

  - `mtls_auth?: MTLSAuth`

    - `auth_status?: string`

    - `cert_issuer_dn?: string`

    - `cert_issuer_ski?: string`

    - `cert_presented?: boolean`

    - `cert_serial?: string`

  - `service_token_id?: string`

  - `service_token_status?: boolean`

  - `user_uuid?: string`

  - `version?: number`

# Failed Logins

## Get failed logins

`client.zeroTrust.access.users.failedLogins.list(stringuserId, FailedLoginListParamsparams, RequestOptionsoptions?): SinglePage<FailedLoginListResponse>`

**get** `/accounts/{account_id}/access/users/{user_id}/failed_logins`

Get all failed login attempts for a single user.

### Parameters

- `userId: string`

  UUID.

- `params: FailedLoginListParams`

  - `account_id: string`

    Identifier.

### Returns

- `FailedLoginListResponse`

  - `expiration?: number`

  - `metadata?: unknown`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const failedLoginListResponse of client.zeroTrust.access.users.failedLogins.list(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
)) {
  console.log(failedLoginListResponse.expiration);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "expiration": 0,
      "metadata": {
        "app_name": "Test App",
        "aud": "39691c1480a2352a18ece567debc2b32552686cbd38eec0887aa18d5d3f00c04",
        "datetime": "2022-02-02T21:54:34.914Z",
        "ray_id": "6d76a8a42ead4133",
        "user_email": "test@cloudflare.com",
        "user_uuid": "57171132-e453-4ee8-b2a5-8cbaad333207"
      }
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Domain Types

### Failed Login List Response

- `FailedLoginListResponse`

  - `expiration?: number`

  - `metadata?: unknown`

# Custom Pages

## List custom pages

`client.zeroTrust.access.customPages.list(CustomPageListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<CustomPageWithoutHTML>`

**get** `/accounts/{account_id}/access/custom_pages`

List custom pages

### Parameters

- `params: CustomPageListParams`

  - `account_id: string`

    Path param: Identifier.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `CustomPageWithoutHTML`

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const customPageWithoutHTML of client.zeroTrust.access.customPages.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(customPageWithoutHTML.uid);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "name": "name",
      "type": "identity_denied",
      "app_count": 0,
      "created_at": "2014-01-01T05:20:00.12345Z",
      "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get a custom page

`client.zeroTrust.access.customPages.get(stringcustomPageId, CustomPageGetParamsparams, RequestOptionsoptions?): CustomPage`

**get** `/accounts/{account_id}/access/custom_pages/{custom_page_id}`

Fetches a custom page and also returns its HTML.

### Parameters

- `customPageId: string`

  UUID.

- `params: CustomPageGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `CustomPage`

  - `custom_html: string`

    Custom page HTML.

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const customPage = await client.zeroTrust.access.customPages.get(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(customPage.uid);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "custom_html": "<html><body><h1>Access Denied</h1></body></html>",
    "name": "name",
    "type": "identity_denied",
    "app_count": 0,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create a custom page

`client.zeroTrust.access.customPages.create(CustomPageCreateParamsparams, RequestOptionsoptions?): CustomPageWithoutHTML`

**post** `/accounts/{account_id}/access/custom_pages`

Create a custom page

### Parameters

- `params: CustomPageCreateParams`

  - `account_id: string`

    Path param: Identifier.

  - `custom_html: string`

    Body param: Custom page HTML.

  - `name: string`

    Body param: Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Body param: Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

### Returns

- `CustomPageWithoutHTML`

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const customPageWithoutHTML = await client.zeroTrust.access.customPages.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  custom_html: '<html><body><h1>Access Denied</h1></body></html>',
  name: 'name',
  type: 'identity_denied',
});

console.log(customPageWithoutHTML.uid);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "name",
    "type": "identity_denied",
    "app_count": 0,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update a custom page

`client.zeroTrust.access.customPages.update(stringcustomPageId, CustomPageUpdateParamsparams, RequestOptionsoptions?): CustomPageWithoutHTML`

**put** `/accounts/{account_id}/access/custom_pages/{custom_page_id}`

Update a custom page

### Parameters

- `customPageId: string`

  UUID.

- `params: CustomPageUpdateParams`

  - `account_id: string`

    Path param: Identifier.

  - `custom_html: string`

    Body param: Custom page HTML.

  - `name: string`

    Body param: Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Body param: Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

### Returns

- `CustomPageWithoutHTML`

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const customPageWithoutHTML = await client.zeroTrust.access.customPages.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  {
    account_id: '023e105f4ecef8ad9ca31a8372d0c353',
    custom_html: '<html><body><h1>Access Denied</h1></body></html>',
    name: 'name',
    type: 'identity_denied',
  },
);

console.log(customPageWithoutHTML.uid);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "name",
    "type": "identity_denied",
    "app_count": 0,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "uid": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete a custom page

`client.zeroTrust.access.customPages.delete(stringcustomPageId, CustomPageDeleteParamsparams, RequestOptionsoptions?): CustomPageDeleteResponse`

**delete** `/accounts/{account_id}/access/custom_pages/{custom_page_id}`

Delete a custom page

### Parameters

- `customPageId: string`

  UUID.

- `params: CustomPageDeleteParams`

  - `account_id: string`

    Identifier.

### Returns

- `CustomPageDeleteResponse`

  - `id?: string`

    UUID.

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const customPage = await client.zeroTrust.access.customPages.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(customPage.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Custom Page

- `CustomPage`

  - `custom_html: string`

    Custom page HTML.

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Custom Page Without HTML

- `CustomPageWithoutHTML`

  - `name: string`

    Custom page name.

  - `type: "identity_denied" | "forbidden"`

    Custom page type.

    - `"identity_denied"`

    - `"forbidden"`

  - `uid?: string`

    UUID.

### Custom Page Delete Response

- `CustomPageDeleteResponse`

  - `id?: string`

    UUID.

# Tags

## List tags

`client.zeroTrust.access.tags.list(TagListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<Tag>`

**get** `/accounts/{account_id}/access/tags`

List tags

### Parameters

- `params: TagListParams`

  - `account_id: string`

    Path param: Identifier.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `Tag`

  A tag

  - `name: string`

    The name of the tag

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const tag of client.zeroTrust.access.tags.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(tag.name);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "name": "engineers",
      "app_count": 1,
      "created_at": "2014-01-01T05:20:00.12345Z",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get a tag

`client.zeroTrust.access.tags.get(stringtagName, TagGetParamsparams, RequestOptionsoptions?): Tag`

**get** `/accounts/{account_id}/access/tags/{tag_name}`

Get a tag

### Parameters

- `tagName: string`

  The name of the tag

- `params: TagGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `Tag`

  A tag

  - `name: string`

    The name of the tag

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const tag = await client.zeroTrust.access.tags.get('engineers', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(tag.name);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "engineers",
    "app_count": 1,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create a tag

`client.zeroTrust.access.tags.create(TagCreateParamsparams, RequestOptionsoptions?): Tag`

**post** `/accounts/{account_id}/access/tags`

Create a tag

### Parameters

- `params: TagCreateParams`

  - `account_id: string`

    Path param: Identifier.

  - `name?: string`

    Body param: The name of the tag

### Returns

- `Tag`

  A tag

  - `name: string`

    The name of the tag

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const tag = await client.zeroTrust.access.tags.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(tag.name);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "engineers",
    "app_count": 1,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update a tag

`client.zeroTrust.access.tags.update(stringtagName, TagUpdateParamsparams, RequestOptionsoptions?): Tag`

**put** `/accounts/{account_id}/access/tags/{tag_name}`

Update a tag

### Parameters

- `tagName: string`

  The name of the tag

- `params: TagUpdateParams`

  - `account_id: string`

    Path param: Identifier.

  - `name: string`

    Body param: The name of the tag

### Returns

- `Tag`

  A tag

  - `name: string`

    The name of the tag

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const tag = await client.zeroTrust.access.tags.update('engineers', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  name: 'engineers',
});

console.log(tag.name);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "engineers",
    "app_count": 1,
    "created_at": "2014-01-01T05:20:00.12345Z",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete a tag

`client.zeroTrust.access.tags.delete(stringtagName, TagDeleteParamsparams, RequestOptionsoptions?): TagDeleteResponse`

**delete** `/accounts/{account_id}/access/tags/{tag_name}`

Delete a tag

### Parameters

- `tagName: string`

  The name of the tag

- `params: TagDeleteParams`

  - `account_id: string`

    Identifier.

### Returns

- `TagDeleteResponse`

  - `name?: string`

    The name of the tag

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const tag = await client.zeroTrust.access.tags.delete('engineers', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(tag.name);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "name": "engineers"
  }
}
```

## Domain Types

### Tag

- `Tag`

  A tag

  - `name: string`

    The name of the tag

### Tag Delete Response

- `TagDeleteResponse`

  - `name?: string`

    The name of the tag

# Policies

## List Access reusable policies

`client.zeroTrust.access.policies.list(PolicyListParamsparams, RequestOptionsoptions?): V4PagePaginationArray<PolicyListResponse>`

**get** `/accounts/{account_id}/access/policies`

Lists Access reusable policies.

### Parameters

- `params: PolicyListParams`

  - `account_id: string`

    Path param: Identifier.

  - `page?: number`

    Query param: Page number of results.

  - `per_page?: number`

    Query param: Number of results per page.

### Returns

- `PolicyListResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const policyListResponse of client.zeroTrust.access.policies.list({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
})) {
  console.log(policyListResponse.id);
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "app_count": 2,
      "approval_groups": [
        {
          "approvals_needed": 1,
          "email_addresses": [
            "test1@cloudflare.com",
            "test2@cloudflare.com"
          ],
          "email_list_uuid": "email_list_uuid"
        },
        {
          "approvals_needed": 3,
          "email_addresses": [
            "test@cloudflare.com",
            "test2@cloudflare.com"
          ],
          "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
        }
      ],
      "approval_required": true,
      "connection_rules": {
        "rdp": {
          "allowed_clipboard_local_to_remote_formats": [
            "text"
          ],
          "allowed_clipboard_remote_to_local_formats": [
            "text"
          ]
        }
      },
      "created_at": "2014-01-01T05:20:00.12345Z",
      "decision": "allow",
      "exclude": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "include": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "isolation_required": false,
      "mfa_config": {
        "allowed_authenticators": [
          "totp",
          "biometrics",
          "security_key"
        ],
        "mfa_disabled": false,
        "session_duration": "24h"
      },
      "name": "Allow devs",
      "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
      "purpose_justification_required": true,
      "require": [
        {
          "group": {
            "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
          }
        }
      ],
      "reusable": true,
      "session_duration": "24h",
      "updated_at": "2014-01-01T05:20:00.12345Z"
    }
  ],
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000,
    "total_pages": 100
  }
}
```

## Get an Access reusable policy

`client.zeroTrust.access.policies.get(stringpolicyId, PolicyGetParamsparams, RequestOptionsoptions?): PolicyGetResponse`

**get** `/accounts/{account_id}/access/policies/{policy_id}`

Fetches a single Access reusable policy.

### Parameters

- `policyId: string`

  The UUID of the policy

- `params: PolicyGetParams`

  - `account_id: string`

    Identifier.

### Returns

- `PolicyGetResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.policies.get('f174e90a-fafe-4643-bbbc-4a0ed4fc8415', {
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
});

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "app_count": 2,
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "reusable": true,
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Create an Access reusable policy

`client.zeroTrust.access.policies.create(PolicyCreateParamsparams, RequestOptionsoptions?): PolicyCreateResponse`

**post** `/accounts/{account_id}/access/policies`

Creates a new Access reusable policy.

### Parameters

- `params: PolicyCreateParams`

  - `account_id: string`

    Path param: Identifier.

  - `decision: Decision`

    Body param: The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `include: Array<AccessRule>`

    Body param: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `name: string`

    Body param: The name of the Access policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Body param: Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Body param: Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    Body param: The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `exclude?: Array<AccessRule>`

    Body param: Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Body param: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Body param: Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `purpose_justification_prompt?: string`

    Body param: A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Body param: Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Body param: Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    Body param: The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

### Returns

- `PolicyCreateResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.policies.create({
  account_id: '023e105f4ecef8ad9ca31a8372d0c353',
  decision: 'allow',
  include: [{ group: { id: 'aa0a4aab-672b-4bdb-bc33-a59f1130a11f' } }],
  name: 'Allow devs',
});

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "app_count": 2,
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "reusable": true,
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Update an Access reusable policy

`client.zeroTrust.access.policies.update(stringpolicyId, PolicyUpdateParamsparams, RequestOptionsoptions?): PolicyUpdateResponse`

**put** `/accounts/{account_id}/access/policies/{policy_id}`

Updates a Access reusable policy.

### Parameters

- `policyId: string`

  The UUID of the policy

- `params: PolicyUpdateParams`

  - `account_id: string`

    Path param: Identifier.

  - `decision: Decision`

    Body param: The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `include: Array<AccessRule>`

    Body param: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `name: string`

    Body param: The name of the Access policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Body param: Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Body param: Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    Body param: The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `exclude?: Array<AccessRule>`

    Body param: Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Body param: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Body param: Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `purpose_justification_prompt?: string`

    Body param: A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Body param: Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Body param: Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `session_duration?: string`

    Body param: The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

### Returns

- `PolicyUpdateResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.policies.update(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  {
    account_id: '023e105f4ecef8ad9ca31a8372d0c353',
    decision: 'allow',
    include: [{ group: { id: 'aa0a4aab-672b-4bdb-bc33-a59f1130a11f' } }],
    name: 'Allow devs',
  },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "app_count": 2,
    "approval_groups": [
      {
        "approvals_needed": 1,
        "email_addresses": [
          "test1@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "email_list_uuid"
      },
      {
        "approvals_needed": 3,
        "email_addresses": [
          "test@cloudflare.com",
          "test2@cloudflare.com"
        ],
        "email_list_uuid": "597147a1-976b-4ef2-9af0-81d5d007fc34"
      }
    ],
    "approval_required": true,
    "connection_rules": {
      "rdp": {
        "allowed_clipboard_local_to_remote_formats": [
          "text"
        ],
        "allowed_clipboard_remote_to_local_formats": [
          "text"
        ]
      }
    },
    "created_at": "2014-01-01T05:20:00.12345Z",
    "decision": "allow",
    "exclude": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "include": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "isolation_required": false,
    "mfa_config": {
      "allowed_authenticators": [
        "totp",
        "biometrics",
        "security_key"
      ],
      "mfa_disabled": false,
      "session_duration": "24h"
    },
    "name": "Allow devs",
    "purpose_justification_prompt": "Please enter a justification for entering this protected domain.",
    "purpose_justification_required": true,
    "require": [
      {
        "group": {
          "id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
        }
      }
    ],
    "reusable": true,
    "session_duration": "24h",
    "updated_at": "2014-01-01T05:20:00.12345Z"
  }
}
```

## Delete an Access reusable policy

`client.zeroTrust.access.policies.delete(stringpolicyId, PolicyDeleteParamsparams, RequestOptionsoptions?): PolicyDeleteResponse`

**delete** `/accounts/{account_id}/access/policies/{policy_id}`

Deletes an Access reusable policy.

### Parameters

- `policyId: string`

  The UUID of the policy

- `params: PolicyDeleteParams`

  - `account_id: string`

    Identifier.

### Returns

- `PolicyDeleteResponse`

  - `id?: string`

    The UUID of the policy

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const policy = await client.zeroTrust.access.policies.delete(
  'f174e90a-fafe-4643-bbbc-4a0ed4fc8415',
  { account_id: '023e105f4ecef8ad9ca31a8372d0c353' },
);

console.log(policy.id);
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
  }
}
```

## Domain Types

### Approval Group

- `ApprovalGroup`

  A group of email addresses that can approve a temporary authentication request.

  - `approvals_needed: number`

    The number of approvals needed to obtain access.

  - `email_addresses?: Array<string>`

    A list of emails that can approve the access request.

  - `email_list_uuid?: string`

    The UUID of an re-usable email list.

### Policy

- `Policy`

  - `id?: string`

    UUID.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<unknown>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `created_at?: string`

  - `decision?: "allow" | "deny" | "non_identity" | "bypass"`

    The action Access will take if a user matches this policy.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy.

  - `name?: string`

    The name of the Access policy.

  - `precedence?: number`

    The order of execution for this policy. Must be unique for each policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `updated_at?: string`

### Policy List Response

- `PolicyListResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Get Response

- `PolicyGetResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Create Response

- `PolicyCreateResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Update Response

- `PolicyUpdateResponse`

  - `id?: string`

    The UUID of the policy

  - `app_count?: number`

    Number of access applications currently using this policy.

  - `approval_groups?: Array<ApprovalGroup>`

    Administrators who can approve a temporary authentication request.

    - `approvals_needed: number`

      The number of approvals needed to obtain access.

    - `email_addresses?: Array<string>`

      A list of emails that can approve the access request.

    - `email_list_uuid?: string`

      The UUID of an re-usable email list.

  - `approval_required?: boolean`

    Requires the user to request access from an administrator at the start of each session.

  - `connection_rules?: ConnectionRules`

    The rules that define how users may connect to targets secured by your application.

    - `rdp?: RDP`

      The RDP-specific rules that define clipboard behavior for RDP connections.

      - `allowed_clipboard_local_to_remote_formats?: Array<"text">`

        Clipboard formats allowed when copying from local machine to remote RDP session.

        - `"text"`

      - `allowed_clipboard_remote_to_local_formats?: Array<"text">`

        Clipboard formats allowed when copying from remote RDP session to local machine.

        - `"text"`

  - `created_at?: string`

  - `decision?: Decision`

    The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

    - `"allow"`

    - `"deny"`

    - `"non_identity"`

    - `"bypass"`

  - `exclude?: Array<AccessRule>`

    Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

    - `GroupRule`

      Matches an Access group.

      - `group: Group`

        - `id: string`

          The ID of a previously created Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

      - `any_valid_service_token: AnyValidServiceToken`

        An empty object which matches on all service tokens.

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

      - `auth_context: AuthContext`

        - `id: string`

          The ID of an Authentication context.

        - `ac_id: string`

          The ACID of an Authentication context.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

      - `auth_method: AuthMethod`

        - `auth_method: string`

          The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

      - `azureAD: AzureAD`

        - `id: string`

          The ID of an Azure group.

        - `identity_provider_id: string`

          The ID of your Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

      - `certificate: Certificate`

    - `AccessCommonNameRule`

      Matches a specific common name.

      - `common_name: CommonName`

        - `common_name: string`

          The common name to match.

    - `CountryRule`

      Matches a specific country

      - `geo: Geo`

        - `country_code: string`

          The country code that should be matched.

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

      - `device_posture: DevicePosture`

        - `integration_uid: string`

          The ID of a device posture integration.

    - `DomainRule`

      Match an entire email domain.

      - `email_domain: EmailDomain`

        - `domain: string`

          The email domain to match.

    - `EmailListRule`

      Matches an email address from a list.

      - `email_list: EmailList`

        - `id: string`

          The ID of a previously created email list.

    - `EmailRule`

      Matches a specific email.

      - `email: Email`

        - `email: string`

          The email of the user.

    - `EveryoneRule`

      Matches everyone.

      - `everyone: Everyone`

        An empty object which matches on all users.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

      - `external_evaluation: ExternalEvaluation`

        - `evaluate_url: string`

          The API endpoint containing your business logic.

        - `keys_url: string`

          The API endpoint containing the key that Access uses to verify that the response came from your API.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

      - `"github-organization": GitHubOrganization`

        - `identity_provider_id: string`

          The ID of your Github identity provider.

        - `name: string`

          The name of the organization.

        - `team?: string`

          The name of the team

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

      - `gsuite: GSuite`

        - `email: string`

          The email of the Google Workspace group.

        - `identity_provider_id: string`

          The ID of your Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

      - `login_method: LoginMethod`

        - `id: string`

          The ID of an identity provider.

    - `IPListRule`

      Matches an IP address from a list.

      - `ip_list: IPList`

        - `id: string`

          The ID of a previously created IP list.

    - `IPRule`

      Matches an IP address block.

      - `ip: IP`

        - `ip: string`

          An IPv4 or IPv6 CIDR block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

      - `okta: Okta`

        - `identity_provider_id: string`

          The ID of your Okta identity provider.

        - `name: string`

          The name of the Okta group.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

      - `saml: SAML`

        - `attribute_name: string`

          The name of the SAML attribute.

        - `attribute_value: string`

          The SAML attribute value to look for.

        - `identity_provider_id: string`

          The ID of your SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

      - `oidc: OIDC`

        - `claim_name: string`

          The name of the OIDC claim.

        - `claim_value: string`

          The OIDC claim value to look for.

        - `identity_provider_id: string`

          The ID of your OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

      - `service_token: ServiceToken`

        - `token_id: string`

          The ID of a Service Token.

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

      - `linked_app_token: LinkedAppToken`

        - `app_uid: string`

          The ID of an Access OIDC SaaS application

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

      - `user_risk_score: UserRiskScore`

        - `user_risk_score: Array<"low" | "medium" | "high" | "unscored">`

          A list of risk score levels to match. Values can be low, medium, high, or unscored.

          - `"low"`

          - `"medium"`

          - `"high"`

          - `"unscored"`

  - `include?: Array<AccessRule>`

    Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `isolation_required?: boolean`

    Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.

  - `mfa_config?: MfaConfig`

    Configures multi-factor authentication (MFA) settings.

    - `allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">`

      Lists the MFA methods that users can authenticate with.

      - `"totp"`

      - `"biometrics"`

      - `"security_key"`

    - `mfa_disabled?: boolean`

      Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

    - `session_duration?: string`

      Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.

  - `name?: string`

    The name of the Access policy.

  - `purpose_justification_prompt?: string`

    A custom message that will appear on the purpose justification screen.

  - `purpose_justification_required?: boolean`

    Require users to enter a justification when they log in to the application.

  - `require?: Array<AccessRule>`

    Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

    - `GroupRule`

      Matches an Access group.

    - `AnyValidServiceTokenRule`

      Matches any valid Access Service Token

    - `AccessAuthContextRule`

      Matches an Azure Authentication Context.
      Requires an Azure identity provider.

    - `AuthenticationMethodRule`

      Enforce different MFA options

    - `AzureGroupRule`

      Matches an Azure group.
      Requires an Azure identity provider.

    - `CertificateRule`

      Matches any valid client certificate.

    - `AccessCommonNameRule`

      Matches a specific common name.

    - `CountryRule`

      Matches a specific country

    - `AccessDevicePostureRule`

      Enforces a device posture rule has run successfully

    - `DomainRule`

      Match an entire email domain.

    - `EmailListRule`

      Matches an email address from a list.

    - `EmailRule`

      Matches a specific email.

    - `EveryoneRule`

      Matches everyone.

    - `ExternalEvaluationRule`

      Create Allow or Block policies which evaluate the user based on custom criteria.

    - `GitHubOrganizationRule`

      Matches a Github organization.
      Requires a Github identity provider.

    - `GSuiteGroupRule`

      Matches a group in Google Workspace.
      Requires a Google Workspace identity provider.

    - `AccessLoginMethodRule`

      Matches a specific identity provider id.

    - `IPListRule`

      Matches an IP address from a list.

    - `IPRule`

      Matches an IP address block.

    - `OktaGroupRule`

      Matches an Okta group.
      Requires an Okta identity provider.

    - `SAMLGroupRule`

      Matches a SAML group.
      Requires a SAML identity provider.

    - `AccessOIDCClaimRule`

      Matches an OIDC claim.
      Requires an OIDC identity provider.

    - `ServiceTokenRule`

      Matches a specific Access Service Token

    - `AccessLinkedAppTokenRule`

      Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

    - `AccessUserRiskScoreRule`

      Matches a user's risk score.

  - `reusable?: true`

    - `true`

  - `session_duration?: string`

    The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.

  - `updated_at?: string`

### Policy Delete Response

- `PolicyDeleteResponse`

  - `id?: string`

    The UUID of the policy