Access
AccessAI Controls
AccessAI ControlsMcp
AccessAI ControlsMcpPortals
List MCP Portals
Create a new MCP Portal
Read details of an MCP Portal
Update an MCP Portal
Delete an MCP Portal
ModelsExpand Collapse
PortalListResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated_tools or updated_prompts.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalCreateResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated_tools or updated_prompts.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalReadResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated_tools or updated_prompts.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalUpdateResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated_tools or updated_prompts.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalDeleteResponse object { id, hostname, name, 8 more }
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
AccessAI ControlsMcpServers
List MCP Servers
Create a new MCP Server
Read the details of an MCP Server
Update an MCP Server
Delete an MCP Server
Sync MCP Server Capabilities
ModelsExpand Collapse
ServerListResponse object { id, auth_type, hostname, 19 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts: optional array of object { name, alias, description, enabled } Server-wide prompt capability overrides.
Server-wide prompt capability overrides.
ServerCreateResponse object { id, auth_type, hostname, 19 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts: optional array of object { name, alias, description, enabled } Server-wide prompt capability overrides.
Server-wide prompt capability overrides.
ServerReadResponse object { id, auth_type, hostname, 19 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts: optional array of object { name, alias, description, enabled } Server-wide prompt capability overrides.
Server-wide prompt capability overrides.
ServerUpdateResponse object { id, auth_type, hostname, 19 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts: optional array of object { name, alias, description, enabled } Server-wide prompt capability overrides.
Server-wide prompt capability overrides.
ServerDeleteResponse object { id, auth_type, hostname, 19 more }
auth_type: "oauth" or "bearer" or "unauthenticated"Authentication method used to connect to the upstream MCP server.
Authentication method used to connect to the upstream MCP server.
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts: optional array of object { name, alias, description, enabled } Server-wide prompt capability overrides.
Server-wide prompt capability overrides.
AccessGateway CA
List SSH Certificate Authorities (CA)
Add a new SSH Certificate Authority (CA)
Delete an SSH Certificate Authority (CA)
ModelsExpand Collapse
AccessIdP Federation Grants
List IdP federation grants
Create an IdP federation grant
Get an IdP federation grant
Delete an IdP federation grant
AccessSAML Certificates
List SAML certificate sets
Get SAML certificate set
Rotate SAML certificate
Download current certificate in PEM format
ModelsExpand Collapse
AccessInfrastructure
AccessInfrastructureTargets
List all targets
Get target
Create new target
Update target
Delete target
Create new targets
Delete targets
ModelsExpand Collapse
AccessApplications
List Access applications
Get an Access application
Add an Access application
Update an Access application
Delete an Access application
Revoke application tokens
ModelsExpand Collapse
Application = object { domain, type, id, 22 more } or object { id, allowed_idps, app_launcher_visible, 9 more } or object { domain, type, id, 22 more } or 5 more
SelfHostedApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
SaaSApplication object { id, allowed_idps, app_launcher_visible, 9 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
saas_app: optional object { auth_type, consumer_service_url, created_at, 8 more } or object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }
AccessSAMLSaaSApp2 object { auth_type, consumer_service_url, created_at, 8 more }
auth_type: optional "saml" or "oidc"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.
custom_attributes: optional array of object { friendly_name, name, name_format, 2 more }
A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
AccessOIDCSaaSApp2 object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }
The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
auth_type: optional "saml" or "oidc"Identifier of the authentication protocol used for the saas app. Required for OIDC.
Identifier of the authentication protocol used for the saas app. Required for OIDC.
custom_claims: optional array of object { name, required, scope, source }
grant_types: optional array of "authorization_code" or "authorization_code_with_pkce" or "refresh_tokens" or 2 moreThe OIDC flows supported by this application
The OIDC flows supported by this application
A regex to filter Cloudflare groups returned in ID token and userinfo endpoint.
hybrid_and_implicit_options: optional object { return_access_token_from_authorization_endpoint, return_id_token_from_authorization_endpoint }
The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BrowserSSHApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
BrowserVNCApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
AppLauncherApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
DeviceEnrollmentPermissionsApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BrowserIsolationPermissionsApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BookmarkApplication object { domain, type, id, 7 more }
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
ApplicationPolicy object { id, approval_groups, approval_required, 13 more }
approval_groups: optional array of ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
connection_rules: optional object { rdp } The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
rdp: optional object { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
The RDP-specific rules that define clipboard behavior for RDP connections.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.