API Reference

Zero Trust

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Access

AccessAI Controls

AccessAI ControlsMcp

AccessAI ControlsMcpPortals

List MCP Portals

client.zeroTrust.access.aiControls.mcp.portals.list(PortalListParams { account_id, page, per_page, search } params, RequestOptionsoptions?): V4PagePaginationArray<PortalListResponse { id, hostname, name, 9 more } >

GET/accounts/{account_id}/access/ai-controls/mcp/portals

Create a new MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.create(PortalCreateParams { account_id, id, hostname, 6 more } params, RequestOptionsoptions?): PortalCreateResponse { id, hostname, name, 9 more }

POST/accounts/{account_id}/access/ai-controls/mcp/portals

Read details of an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.read(stringid, PortalReadParams { account_id } params, RequestOptionsoptions?): PortalReadResponse { id, hostname, name, 9 more }

GET/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Update an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.update(stringid, PortalUpdateParams { account_id, allow_code_mode, code_mode, 5 more } params, RequestOptionsoptions?): PortalUpdateResponse { id, hostname, name, 9 more }

PUT/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Delete an MCP Portal

client.zeroTrust.access.aiControls.mcp.portals.delete(stringid, PortalDeleteParams { account_id } params, RequestOptionsoptions?): PortalDeleteResponse { id, hostname, name, 8 more }

DELETE/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

ModelsExpand Collapse

PortalListResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalCreateResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalReadResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalUpdateResponse { id, hostname, name, 9 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

servers: Array<Server>

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

server_id: string

Unique identifier for the MCP server.

maxLength32

minLength1

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

default_disabled?: boolean

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

on_behalf?: boolean

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

updated_tools?: Array<UpdatedTool>

name: string

enabled?: boolean

portal_alias?: string

portal_description?: string

server_alias?: string

server_description?: string

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

PortalDeleteResponse { id, hostname, name, 8 more }

id: string

Unique identifier for the MCP portal.

maxLength32

minLength1

hostname: string

Hostname where the MCP portal is available.

name: string

Display name for the MCP portal.

maxLength350

Deprecatedallow_code_mode?: boolean

Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.

code_mode?: "off" | "opt_in" | "default_on" | "enforced"

Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.

One of the following:

"off"

"opt_in"

"default_on"

"enforced"

created_at?: string

formatdate-time

created_by?: string

description?: string

Optional description of the MCP portal.

maxLength512

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway.

AccessAI ControlsMcpServers

List MCP Servers

client.zeroTrust.access.aiControls.mcp.servers.list(ServerListParams { account_id, page, per_page, search } params, RequestOptionsoptions?): V4PagePaginationArray<ServerListResponse { id, auth_type, hostname, 19 more } >

GET/accounts/{account_id}/access/ai-controls/mcp/servers

Create a new MCP Server

client.zeroTrust.access.aiControls.mcp.servers.create(ServerCreateParams { account_id, id, auth_type, 9 more } params, RequestOptionsoptions?): ServerCreateResponse { id, auth_type, hostname, 19 more }

POST/accounts/{account_id}/access/ai-controls/mcp/servers

Read the details of an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.read(stringid, ServerReadParams { account_id } params, RequestOptionsoptions?): ServerReadResponse { id, auth_type, hostname, 19 more }

GET/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Update an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.update(stringid, ServerUpdateParams { account_id, auth_credentials, client_secret, 6 more } params, RequestOptionsoptions?): ServerUpdateResponse { id, auth_type, hostname, 19 more }

PUT/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Delete an MCP Server

client.zeroTrust.access.aiControls.mcp.servers.delete(stringid, ServerDeleteParams { account_id } params, RequestOptionsoptions?): ServerDeleteResponse { id, auth_type, hostname, 19 more }

DELETE/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Sync MCP Server Capabilities

client.zeroTrust.access.aiControls.mcp.servers.sync(stringid, ServerSyncParams { account_id } params, RequestOptionsoptions?): ServerSyncResponse { error, error_details, status }

POST/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync

ModelsExpand Collapse

ServerListResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerCreateResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerReadResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerUpdateResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerDeleteResponse { id, auth_type, hostname, 19 more }

id: string

Unique identifier for the MCP server.

maxLength32

minLength1

auth_type: "oauth" | "bearer" | "unauthenticated"

Authentication method used to connect to the upstream MCP server.

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

URL of the upstream MCP endpoint.

formaturi

name: string

Display name for the MCP server.

maxLength350

prompts: Array<Record<string, unknown>>

tools: Array<Record<string, unknown>>

auth_config_summary?: AuthConfigSummary { auth_mode, client_secret_version, config, 2 more }

Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.

auth_mode?: "dcr" | "manual"

One of the following:

"dcr"

"manual"

client_secret_version?: number

config?: Config { authorization_endpoint, issuer, resource, 2 more }

authorization_endpoint?: string

issuer?: string

resource?: string

revocation_endpoint?: string

token_endpoint?: string

has_client_secret?: boolean

registration_info?: RegistrationInfo { client_id, redirect_uris, scope, token_endpoint_auth_method }

client_id?: string

redirect_uris?: Array<string>

scope?: string

token_endpoint_auth_method?: string

authentication_status?: "not_required" | "required" | "connected" | 2 more

Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.

One of the following:

"not_required"

"required"

"connected"

"stale"

"manual"

created_at?: string

formatdate-time

created_by?: string

description?: string | null

Optional description of the MCP server.

maxLength512

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

is_shared_oauth_callback_enabled?: boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.

last_successful_sync?: string

formatdate-time

last_synced?: string

formatdate-time

modified_at?: string

formatdate-time

modified_by?: string

secure_web_gateway?: boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.

status?: "waiting" | "ready" | "stale" | "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts?: Array<UpdatedPrompt>

Server-wide prompt capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

updated_tools?: Array<UpdatedTool>

Server-wide tool capability overrides.

name: string

Name of the tool or prompt capability to override.

alias?: string

Custom name exposed for the capability.

maxLength40

description?: string

Custom description exposed for the capability.

enabled?: boolean

Whether the capability is available through the MCP server.

ServerSyncResponse { error, error_details, status }

error?: string

error_details?: ErrorDetails { cause, is_upstream, mcp_code, 2 more }

cause?: string

Underlying error message

is_upstream?: boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code?: number

MCP protocol error code

retryable?: boolean

Whether the error is transient and worth retrying

status_code?: number

HTTP status code from the server

status?: "waiting" | "ready" | "stale" | "error"

One of the following:

"waiting"

"ready"

"stale"

"error"

AccessGateway CA

List SSH Certificate Authorities (CA)

client.zeroTrust.access.gatewayCA.list(GatewayCAListParams { account_id } params, RequestOptionsoptions?): SinglePage<GatewayCAListResponse { id, public_key } >

GET/accounts/{account_id}/access/gateway_ca

Add a new SSH Certificate Authority (CA)

client.zeroTrust.access.gatewayCA.create(GatewayCACreateParams { account_id } params, RequestOptionsoptions?): GatewayCACreateResponse { id, public_key }

POST/accounts/{account_id}/access/gateway_ca

Delete an SSH Certificate Authority (CA)

client.zeroTrust.access.gatewayCA.delete(stringcertificateID, GatewayCADeleteParams { account_id } params, RequestOptionsoptions?): GatewayCADeleteResponse { id }

DELETE/accounts/{account_id}/access/gateway_ca/{certificate_id}

ModelsExpand Collapse

GatewayCAListResponse { id, public_key }

id?: string

The key ID of this certificate.

public_key?: string

The public key of this certificate.

GatewayCACreateResponse { id, public_key }

id?: string

The key ID of this certificate.

public_key?: string

The public key of this certificate.

GatewayCADeleteResponse { id }

id?: string

UUID.

maxLength36

AccessIdP Federation Grants

List IdP federation grants

client.zeroTrust.access.IdPFederationGrants.list(IdPFederationGrantListParams { account_id } params, RequestOptionsoptions?): IdPFederationGrantListResponse { id, idp_id }

GET/accounts/{account_id}/access/idp_federation_grants

Create an IdP federation grant

client.zeroTrust.access.IdPFederationGrants.create(IdPFederationGrantCreateParams { account_id, idp_id } params, RequestOptionsoptions?): IdPFederationGrant { id, idp_id }

POST/accounts/{account_id}/access/idp_federation_grants

Get an IdP federation grant

client.zeroTrust.access.IdPFederationGrants.get(stringgrantID, IdPFederationGrantGetParams { account_id } params, RequestOptionsoptions?): IdPFederationGrant { id, idp_id }

GET/accounts/{account_id}/access/idp_federation_grants/{grant_id}

Delete an IdP federation grant

client.zeroTrust.access.IdPFederationGrants.delete(stringgrantID, IdPFederationGrantDeleteParams { account_id } params, RequestOptionsoptions?): IdPFederationGrantDeleteResponse { id }

DELETE/accounts/{account_id}/access/idp_federation_grants/{grant_id}

ModelsExpand Collapse

IdPFederationGrant { id, idp_id }

id: string

UID of the IdP federation grant.

maxLength32

idp_id: string

UID of the identity provider being federated.

formatuuid

IdPFederationGrantListResponse = Array<IdPFederationGrant { id, idp_id } >

id: string

UID of the IdP federation grant.

maxLength32

idp_id: string

UID of the identity provider being federated.

formatuuid

IdPFederationGrantDeleteResponse { id }

id?: string

UID of the deleted IdP federation grant.

maxLength32

AccessSAML Certificates

List SAML certificate sets

client.zeroTrust.access.samlCertificates.list(SAMLCertificateListParams { account_id, id, page, per_page } params, RequestOptionsoptions?): V4PagePaginationArray<SAMLCertificateListResponse { created_at, uid, updated_at, 2 more } >

GET/accounts/{account_id}/access/saml_certificates

Get SAML certificate set

client.zeroTrust.access.samlCertificates.get(stringsamlCERTSetID, SAMLCertificateGetParams { account_id } params, RequestOptionsoptions?): SAMLCertificateGetResponse { created_at, uid, updated_at, 2 more }

GET/accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}

Rotate SAML certificate

client.zeroTrust.access.samlCertificates.rotate(stringsamlCERTSetID, SAMLCertificateRotateParams { account_id } params, RequestOptionsoptions?): SAMLCertificateRotateResponse { created_at, uid, updated_at, 2 more }

POST/accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}/rotate

Download current certificate in PEM format

client.zeroTrust.access.samlCertificates.getPem(stringsamlCERTSetID, SAMLCertificateGetPemParams { account_id } params, RequestOptionsoptions?): Response

GET/accounts/{account_id}/access/saml_certificates/{saml_cert_set_id}/pem

ModelsExpand Collapse

SAMLCertificateListResponse { created_at, uid, updated_at, 2 more }

created_at: string

When the certificate set was created

formatdate-time

uid: string

Unique identifier for the certificate set

updated_at: string

When the certificate set was last updated

formatdate-time

current_certificate?: CurrentCertificate { is_current, not_after, public_certificate, uid }

The current active certificate

is_current: boolean

Indicates whether the certificate can be used for IdP configuration.

not_after: string

Certificate expiration date

formatdate-time

public_certificate: string

The public certificate in PEM format

uid: string

Unique identifier for the certificate

previous_certificate?: unknown

The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate.

SAMLCertificateGetResponse { created_at, uid, updated_at, 2 more }

created_at: string

When the certificate set was created

formatdate-time

uid: string

Unique identifier for the certificate set

updated_at: string

When the certificate set was last updated

formatdate-time

current_certificate?: CurrentCertificate { is_current, not_after, public_certificate, uid }

The current active certificate

is_current: boolean

Indicates whether the certificate can be used for IdP configuration.

not_after: string

Certificate expiration date

formatdate-time

public_certificate: string

The public certificate in PEM format

uid: string

Unique identifier for the certificate

previous_certificate?: unknown

The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate.

SAMLCertificateRotateResponse { created_at, uid, updated_at, 2 more }

created_at: string

When the certificate set was created

formatdate-time

uid: string

Unique identifier for the certificate set

updated_at: string

When the certificate set was last updated

formatdate-time

current_certificate?: CurrentCertificate { is_current, not_after, public_certificate, uid }

The current active certificate

is_current: boolean

Indicates whether the certificate can be used for IdP configuration.

not_after: string

Certificate expiration date

formatdate-time

public_certificate: string

The public certificate in PEM format

uid: string

Unique identifier for the certificate

previous_certificate?: unknown

The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate.

AccessInfrastructure

AccessInfrastructureTargets

List all targets

client.zeroTrust.access.infrastructure.targets.list(TargetListParams { account_id, created_after, created_before, 19 more } params, RequestOptionsoptions?): V4PagePaginationArray<TargetListResponse { id, created_at, hostname, 3 more } >

GET/accounts/{account_id}/infrastructure/targets

Get target

client.zeroTrust.access.infrastructure.targets.get(stringtargetID, TargetGetParams { account_id } params, RequestOptionsoptions?): TargetGetResponse { id, created_at, hostname, 3 more }

GET/accounts/{account_id}/infrastructure/targets/{target_id}

Create new target

client.zeroTrust.access.infrastructure.targets.create(TargetCreateParams { account_id, hostname, ip, tags } params, RequestOptionsoptions?): TargetCreateResponse { id, created_at, hostname, 3 more }

POST/accounts/{account_id}/infrastructure/targets

Update target

client.zeroTrust.access.infrastructure.targets.update(stringtargetID, TargetUpdateParams { account_id, hostname, ip, tags } params, RequestOptionsoptions?): TargetUpdateResponse { id, created_at, hostname, 3 more }

PUT/accounts/{account_id}/infrastructure/targets/{target_id}

Delete target

client.zeroTrust.access.infrastructure.targets.delete(stringtargetID, TargetDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/infrastructure/targets/{target_id}

Create new targets

client.zeroTrust.access.infrastructure.targets.bulkUpdate(TargetBulkUpdateParams { account_id, body } params, RequestOptionsoptions?): SinglePage<TargetBulkUpdateResponse { id, created_at, hostname, 3 more } >

PUT/accounts/{account_id}/infrastructure/targets/batch

Delete targets (Deprecated)

Deprecated

client.zeroTrust.access.infrastructure.targets.bulkDelete(TargetBulkDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/infrastructure/targets/batch

Delete targets

client.zeroTrust.access.infrastructure.targets.bulkDeleteV2(TargetBulkDeleteV2Params { account_id, target_ids } params, RequestOptionsoptions?): void

POST/accounts/{account_id}/infrastructure/targets/batch_delete

ModelsExpand Collapse

TargetListResponse { id, created_at, hostname, 3 more }

id: string

Target identifier

formatuuid

maxLength36

created_at: string

Date and time at which the target was created

formatdate-time

hostname: string

A non-unique field that refers to a target

ip: IP { ipv4, ipv6 }

The IPv4/IPv6 address that identifies where to reach a target

ipv4?: IPV4 { ip_addr, virtual_network_id }

The target’s IPv4 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

ipv6?: IPV6 { ip_addr, virtual_network_id }

The target’s IPv6 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

modified_at: string

Date and time at which the target was modified

formatdate-time

tags?: Record<string, string> | null

Tags assigned to the target. Empty when no tags are assigned.

TargetGetResponse { id, created_at, hostname, 3 more }

id: string

Target identifier

formatuuid

maxLength36

created_at: string

Date and time at which the target was created

formatdate-time

hostname: string

A non-unique field that refers to a target

ip: IP { ipv4, ipv6 }

The IPv4/IPv6 address that identifies where to reach a target

ipv4?: IPV4 { ip_addr, virtual_network_id }

The target’s IPv4 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

ipv6?: IPV6 { ip_addr, virtual_network_id }

The target’s IPv6 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

modified_at: string

Date and time at which the target was modified

formatdate-time

tags?: Record<string, string> | null

Tags assigned to the target. Empty when no tags are assigned.

TargetCreateResponse { id, created_at, hostname, 3 more }

id: string

Target identifier

formatuuid

maxLength36

created_at: string

Date and time at which the target was created

formatdate-time

hostname: string

A non-unique field that refers to a target

ip: IP { ipv4, ipv6 }

The IPv4/IPv6 address that identifies where to reach a target

ipv4?: IPV4 { ip_addr, virtual_network_id }

The target’s IPv4 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

ipv6?: IPV6 { ip_addr, virtual_network_id }

The target’s IPv6 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

modified_at: string

Date and time at which the target was modified

formatdate-time

tags?: Record<string, string> | null

Tags assigned to the target. Empty when no tags are assigned.

TargetUpdateResponse { id, created_at, hostname, 3 more }

id: string

Target identifier

formatuuid

maxLength36

created_at: string

Date and time at which the target was created

formatdate-time

hostname: string

A non-unique field that refers to a target

ip: IP { ipv4, ipv6 }

The IPv4/IPv6 address that identifies where to reach a target

ipv4?: IPV4 { ip_addr, virtual_network_id }

The target’s IPv4 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

ipv6?: IPV6 { ip_addr, virtual_network_id }

The target’s IPv6 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

modified_at: string

Date and time at which the target was modified

formatdate-time

tags?: Record<string, string> | null

Tags assigned to the target. Empty when no tags are assigned.

TargetBulkUpdateResponse { id, created_at, hostname, 3 more }

id: string

Target identifier

formatuuid

maxLength36

created_at: string

Date and time at which the target was created

formatdate-time

hostname: string

A non-unique field that refers to a target

ip: IP { ipv4, ipv6 }

The IPv4/IPv6 address that identifies where to reach a target

ipv4?: IPV4 { ip_addr, virtual_network_id }

The target’s IPv4 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

ipv6?: IPV6 { ip_addr, virtual_network_id }

The target’s IPv6 address

ip_addr?: string

IP address of the target

virtual_network_id?: string

(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.

formatuuid

modified_at: string

Date and time at which the target was modified

formatdate-time

tags?: Record<string, string> | null

Tags assigned to the target. Empty when no tags are assigned.

AccessApplications

List Access applications

client.zeroTrust.access.applications.list(ApplicationListParams { account_id, zone_id, aud, 7 more } params?, RequestOptionsoptions?): V4PagePaginationArray<ApplicationListResponse>

GET/{accounts_or_zones}/{account_or_zone_id}/access/apps

Get an Access application

client.zeroTrust.access.applications.get(AppIDappID, ApplicationGetParams { account_id, zone_id } params?, RequestOptionsoptions?): ApplicationGetResponse

GET/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}

Add an Access application

client.zeroTrust.access.applications.create(ApplicationCreateParamsparams, RequestOptionsoptions?): ApplicationCreateResponse

POST/{accounts_or_zones}/{account_or_zone_id}/access/apps

Update an Access application

client.zeroTrust.access.applications.update(AppIDappID, ApplicationUpdateParamsparams, RequestOptionsoptions?): ApplicationUpdateResponse

PUT/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}

Delete an Access application

client.zeroTrust.access.applications.delete(AppIDappID, ApplicationDeleteParams { account_id, zone_id } params?, RequestOptionsoptions?): ApplicationDeleteResponse { id }

DELETE/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}

Revoke application tokens

client.zeroTrust.access.applications.revokeTokens(AppIDappID, ApplicationRevokeTokensParams { account_id, zone_id } params?, RequestOptionsoptions?): ApplicationRevokeTokensResponse | null

POST/{accounts_or_zones}/{account_or_zone_id}/access/apps/{app_id}/revoke_tokens

ModelsExpand Collapse

AllowedHeaders = string

AllowedIdPs = string

The identity providers selected for application.

AllowedMethods = "GET" | "POST" | "HEAD" | 6 more

One of the following:

"GET"

"POST"

"HEAD"

"PUT"

"DELETE"

"CONNECT"

"OPTIONS"

"TRACE"

"PATCH"

AllowedOrigins = string

AppID = string

Identifier.

Application = SelfHostedApplication { domain, type, id, 22 more } | SaaSApplication { id, allowed_idps, app_launcher_visible, 9 more } | BrowserSSHApplication { domain, type, id, 22 more } | 5 more

One of the following:

SelfHostedApplication { domain, type, id, 22 more }

domain: string

The domain and path that Access will secure.

type: string

The application type.

id?: string

UUID.

maxLength36

allow_iframe?: boolean

Enables loading application content in an iFrame.

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

app_launcher_visible?: boolean

Displays the application in the App Launcher.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

cors_headers?: CORSHeaders { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }

created_at?: string

formatdate-time

custom_deny_message?: string

The custom error message shown to a user when they are denied access to the application.

custom_deny_url?: string

The custom URL a user is redirected to when they are denied access to the application.

eager_redirect_cookie_setting?: boolean

Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.

enable_binding_cookie?: boolean

Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

http_only_cookie_attribute?: boolean

Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

logo_url?: string

The image URL for the logo shown in the App Launcher dashboard.

name?: string

The name of the application.

options_preflight_bypass?: boolean

Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

same_site_cookie_attribute?: string

Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

service_auth_401_redirect?: boolean

Returns a 401 status code when the request is blocked by a Service Auth policy.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

skip_interstitial?: boolean

Enables automatic authentication through cloudflared.

updated_at?: string

formatdate-time

use_clientless_isolation_app_launcher_url?: boolean

Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.

SaaSApplication { id, allowed_idps, app_launcher_visible, 9 more }

id?: string

UUID.

maxLength36

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

app_launcher_visible?: boolean

Displays the application in the App Launcher.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

created_at?: string

formatdate-time

logo_url?: string

The image URL for the logo shown in the App Launcher dashboard.

name?: string

The name of the application.

saas_app?: AccessSAMLSaaSApp2 { auth_type, consumer_service_url, created_at, 8 more } | AccessOIDCSaaSApp2 { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }

One of the following:

AccessSAMLSaaSApp2 { auth_type, consumer_service_url, created_at, 8 more }

auth_type?: "saml" | "oidc"

Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”

One of the following:

"saml"

"oidc"

consumer_service_url?: string

The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.

created_at?: string

formatdate-time

custom_attributes?: Array<CustomAttribute>

friendly_name?: string

The SAML FriendlyName of the attribute.

name?: string

The name of the attribute.

name_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" | "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" | "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"

A globally unique name for an identity or service provider.

One of the following:

"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"

"urn:oasis:names:tc:SAML:2.0:attrname-format:basic"

"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"

required?: boolean

If the attribute is required when building a SAML assertion.

source?: Source { name, name_by_idp }

name?: string

The name of the IdP attribute.

name_by_idp?: Record<string, string>

A mapping from IdP ID to attribute name.

idp_entity_id?: string

The unique identifier for your SaaS application.

name_id_format?: SaaSAppNameIDFormat

The format of the name identifier sent to the SaaS application.

name_id_transform_jsonata?: string

A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.

public_key?: string

The Access public certificate that will be used to verify your identity.

sp_entity_id?: string

A globally unique name for an identity or service provider.

sso_endpoint?: string

The endpoint where your SaaS application will send login requests.

updated_at?: string

formatdate-time

AccessOIDCSaaSApp2 { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }

access_token_lifetime?: string

The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.

allow_pkce_without_client_secret?: boolean

If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.

app_launcher_url?: string

The URL where this applications tile redirects users

auth_type?: "saml" | "oidc"

Identifier of the authentication protocol used for the saas app. Required for OIDC.

One of the following:

"saml"

"oidc"

client_id?: string

The application client id

client_secret?: string

The application client secret, only returned on POST request.

created_at?: string

formatdate-time

custom_claims?: Array<CustomClaim>

name?: string

The name of the claim.

required?: boolean

If the claim is required when building an OIDC token.

scope?: "groups" | "profile" | "email" | "openid"

The scope of the claim.

One of the following:

"groups"

"profile"

"email"

"openid"

source?: Source { name, name_by_idp }

name?: string

The name of the IdP claim.

name_by_idp?: Array<NameByIdP>

A mapping from IdP ID to attribute name.

idp_id?: string

The UID of the IdP.

source_name?: string

The name of the IdP provided attribute.

grant_types?: Array<"authorization_code" | "authorization_code_with_pkce" | "refresh_tokens" | 2 more>

The OIDC flows supported by this application

One of the following:

"authorization_code"

"authorization_code_with_pkce"

"refresh_tokens"

"hybrid"

"implicit"

group_filter_regex?: string

A regex to filter Cloudflare groups returned in ID token and userinfo endpoint.

hybrid_and_implicit_options?: HybridAndImplicitOptions { return_access_token_from_authorization_endpoint, return_id_token_from_authorization_endpoint }

return_access_token_from_authorization_endpoint?: boolean

If an Access Token should be returned from the OIDC Authorization endpoint

return_id_token_from_authorization_endpoint?: boolean

If an ID Token should be returned from the OIDC Authorization endpoint

public_key?: string

The Access public certificate that will be used to verify your identity.

redirect_uris?: Array<string>

The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens

refresh_token_options?: RefreshTokenOptions { lifetime }

lifetime?: string

How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.

scopes?: Array<"openid" | "groups" | "email" | "profile">

Define the user information shared with access, “offline_access” scope will be automatically enabled if refresh tokens are enabled

One of the following:

"openid"

"groups"

"email"

"profile"

updated_at?: string

formatdate-time

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

type?: string

The application type.

updated_at?: string

formatdate-time

BrowserSSHApplication { domain, type, id, 22 more }

domain: string

The domain and path that Access will secure.

type: string

The application type.

id?: string

UUID.

maxLength36

allow_iframe?: boolean

Enables loading application content in an iFrame.

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

app_launcher_visible?: boolean

Displays the application in the App Launcher.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

cors_headers?: CORSHeaders { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }

created_at?: string

formatdate-time

custom_deny_message?: string

The custom error message shown to a user when they are denied access to the application.

custom_deny_url?: string

The custom URL a user is redirected to when they are denied access to the application.

eager_redirect_cookie_setting?: boolean

Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.

enable_binding_cookie?: boolean

Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

http_only_cookie_attribute?: boolean

Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

logo_url?: string

The image URL for the logo shown in the App Launcher dashboard.

name?: string

The name of the application.

options_preflight_bypass?: boolean

Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

same_site_cookie_attribute?: string

Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

service_auth_401_redirect?: boolean

Returns a 401 status code when the request is blocked by a Service Auth policy.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

skip_interstitial?: boolean

Enables automatic authentication through cloudflared.

updated_at?: string

formatdate-time

use_clientless_isolation_app_launcher_url?: boolean

Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.

BrowserVNCApplication { domain, type, id, 22 more }

domain: string

The domain and path that Access will secure.

type: string

The application type.

id?: string

UUID.

maxLength36

allow_iframe?: boolean

Enables loading application content in an iFrame.

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

app_launcher_visible?: boolean

Displays the application in the App Launcher.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

cors_headers?: CORSHeaders { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }

created_at?: string

formatdate-time

custom_deny_message?: string

The custom error message shown to a user when they are denied access to the application.

custom_deny_url?: string

The custom URL a user is redirected to when they are denied access to the application.

eager_redirect_cookie_setting?: boolean

Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.

enable_binding_cookie?: boolean

Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.

http_only_cookie_attribute?: boolean

Enables the HttpOnly cookie attribute, which increases security against XSS attacks.

logo_url?: string

The image URL for the logo shown in the App Launcher dashboard.

name?: string

The name of the application.

options_preflight_bypass?: boolean

Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.

same_site_cookie_attribute?: string

Sets the SameSite cookie setting, which provides increased security against CSRF attacks.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

service_auth_401_redirect?: boolean

Returns a 401 status code when the request is blocked by a Service Auth policy.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

skip_interstitial?: boolean

Enables automatic authentication through cloudflared.

updated_at?: string

formatdate-time

use_clientless_isolation_app_launcher_url?: boolean

Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.

AppLauncherApplication { type, id, allowed_idps, 8 more }

type: "self_hosted" | "saas" | "ssh" | 6 more

The application type.

One of the following:

"self_hosted"

"saas"

"ssh"

"vnc"

"app_launcher"

"warp"

"biso"

"bookmark"

"dash_sso"

id?: string

UUID.

maxLength36

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

created_at?: string

formatdate-time

domain?: string

The domain and path that Access will secure.

name?: string

The name of the application.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

updated_at?: string

formatdate-time

DeviceEnrollmentPermissionsApplication { type, id, allowed_idps, 8 more }

type: "self_hosted" | "saas" | "ssh" | 6 more

The application type.

One of the following:

"self_hosted"

"saas"

"ssh"

"vnc"

"app_launcher"

"warp"

"biso"

"bookmark"

"dash_sso"

id?: string

UUID.

maxLength36

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

created_at?: string

formatdate-time

domain?: string

The domain and path that Access will secure.

name?: string

The name of the application.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

updated_at?: string

formatdate-time

BrowserIsolationPermissionsApplication { type, id, allowed_idps, 8 more }

type: "self_hosted" | "saas" | "ssh" | 6 more

The application type.

One of the following:

"self_hosted"

"saas"

"ssh"

"vnc"

"app_launcher"

"warp"

"biso"

"bookmark"

"dash_sso"

id?: string

UUID.

maxLength36

allowed_idps?: Array<AllowedIdPs>

The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.

aud?: string

Audience tag.

maxLength64

auto_redirect_to_identity?: boolean

When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.

created_at?: string

formatdate-time

domain?: string

The domain and path that Access will secure.

name?: string

The name of the application.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

session_duration?: string

The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.

updated_at?: string

formatdate-time

BookmarkApplication { domain, type, id, 7 more }

domain: string

The URL or domain of the bookmark.

type: string

The application type.

id?: string

UUID.

maxLength36

app_launcher_visible?: boolean

aud?: string

Audience tag.

maxLength64

created_at?: string

formatdate-time

logo_url?: string

The image URL for the logo shown in the App Launcher dashboard.

name?: string

The name of the application.

scim_config?: SCIMConfig { idp_uid, remote_uri, authentication, 3 more }

Configuration for provisioning to this application via SCIM. This is currently in closed beta.

idp_uid: string

The UID of the IdP to use as the source for SCIM resources to provision to this application.

remote_uri: string

The base URI for the application’s SCIM-compatible API.

authentication?: SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | 2 more

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

One of the following:

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

Array<SCIMConfigAuthenticationHTTPBasic { password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme } | SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme } >

SCIMConfigAuthenticationHTTPBasic { password, scheme, user }

Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.

password: string

Password used to authenticate with the remote SCIM service.

scheme: "httpbasic"

The authentication scheme to use when making SCIM requests to this application.

user: string

User name used to authenticate with the remote SCIM service.

AccessSCIMConfigAuthenticationOAuthBearerToken2 { token, scheme }

Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.

token: string

Token used to authenticate with the remote SCIM service.

scheme: "oauthbearertoken"

The authentication scheme to use when making SCIM requests to this application.

SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more }

Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.

authorization_url: string

URL used to generate the auth code used during token generation.

client_id: string

Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.

client_secret: string

Secret used to authenticate when generating a token for authenticating with the remove SCIM service.

scheme: "oauth2"

The authentication scheme to use when making SCIM requests to this application.

token_url: string

URL used to generate the token used to authenticate with the remote SCIM service.

scopes?: Array<string>

The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.

AccessSCIMConfigAuthenticationAccessServiceToken { client_id, client_secret, scheme }

Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.

client_id: string

Client ID of the Access service token used to authenticate with the remote service.

client_secret: string

Client secret of the Access service token used to authenticate with the remote service.

scheme: "access_service_token"

The authentication scheme to use when making SCIM requests to this application.

deactivate_on_delete?: boolean

If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.

enabled?: boolean

Whether SCIM provisioning is turned on for this application.

mappings?: Array<SCIMConfigMapping { schema, enabled, filter, 3 more } >

A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.

schema: string

Which SCIM resource type this mapping applies to.

enabled?: boolean

Whether or not this mapping is enabled.

filter?: string

A SCIM filter expression that matches resources that should be provisioned to this application.

operations?: Operations { create, delete, update }

Whether or not this mapping applies to creates, updates, or deletes.

create?: boolean

Whether or not this mapping applies to create (POST) operations.

delete?: boolean

Whether or not this mapping applies to DELETE operations.

update?: boolean

Whether or not this mapping applies to update (PATCH/PUT) operations.

strictness?: "strict" | "passthrough"

The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.

One of the following:

"strict"

"passthrough"

transform_jsonata?: string

A JSONata expression that transforms the resource before provisioning it in the application.

updated_at?: string

formatdate-time

ApplicationPolicy { id, approval_groups, approval_required, 13 more }

id?: string

The UUID of the policy

maxLength36

approval_groups?: Array<ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } >

Administrators who can approve a temporary authentication request.

approvals_needed: number

The number of approvals needed to obtain access.

minimum0

email_addresses?: Array<string>

A list of emails that can approve the access request.

email_list_uuid?: string

The UUID of an re-usable email list.

approval_required?: boolean

Requires the user to request access from an administrator at the start of each session.

connection_rules?: ConnectionRules { rdp }

The rules that define how users may connect to targets secured by your application.

rdp?: RDP { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats }

The RDP-specific rules that define clipboard behavior for RDP connections.

allowed_clipboard_local_to_remote_formats?: Array<"text" | "file">

Clipboard formats allowed when copying from local machine to remote RDP session.

One of the following:

"text"

"file"

allowed_clipboard_remote_to_local_formats?: Array<"text" | "file">

Clipboard formats allowed when copying from remote RDP session to local machine.

One of the following:

"text"

"file"

created_at?: string

formatdate-time

decision?: Decision

The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.

exclude?: Array<AccessRule>

Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.

One of the following:

GroupRule { group }

Matches an Access group.

group: Group { id }

id: string

The ID of a previously created Access group.

AnyValidServiceTokenRule { any_valid_service_token }

Matches any valid Access Service Token

any_valid_service_token: AnyValidServiceToken

An empty object which matches on all service tokens.

AccessAuthContextRule { auth_context }

Matches an Azure Authentication Context. Requires an Azure identity provider.

auth_context: AuthContext { id, ac_id, identity_provider_id }

id: string

The ID of an Authentication context.

ac_id: string

The ACID of an Authentication context.

identity_provider_id: string

The ID of your Azure identity provider.

AuthenticationMethodRule { auth_method }

Enforce different MFA options

auth_method: AuthMethod { auth_method }

auth_method: string

The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

AzureGroupRule { azureAD }

Matches an Azure group. Requires an Azure identity provider.

azureAD: AzureAD { id, identity_provider_id }

id: string

The ID of an Azure group.

identity_provider_id: string

The ID of your Azure identity provider.

CertificateRule { certificate }

Matches any valid client certificate.

certificate: Certificate

AccessCommonNameRule { common_name }

Matches a specific common name.

common_name: CommonName { common_name }

common_name: string

The common name to match.

CountryRule { geo }

Matches a specific country

geo: Geo { country_code }

country_code: string

The country code that should be matched.

AccessDevicePostureRule { device_posture }

Enforces a device posture rule has run successfully

device_posture: DevicePosture { integration_uid, account_id }

integration_uid: string

The ID of a device posture integration.

account_id?: string

The ID of the account that owns the device posture integration.

maxLength32

DomainRule { email_domain }

Match an entire email domain.

email_domain: EmailDomain { domain }

domain: string

The email domain to match.

EmailListRule { email_list }

Matches an email address from a list.

email_list: EmailList { id }

id: string

The ID of a previously created email list.

EmailRule { email }

Matches a specific email.

email: Email { email }

email: string

The email of the user.

formatemail

EveryoneRule { everyone }

Matches everyone.

everyone: Everyone

An empty object which matches on all users.

ExternalEvaluationRule { external_evaluation }

Create Allow or Block policies which evaluate the user based on custom criteria.

external_evaluation: ExternalEvaluation { evaluate_url, keys_url }

evaluate_url: string

The API endpoint containing your business logic.

keys_url: string

The API endpoint containing the key that Access uses to verify that the response came from your API.

GitHubOrganizationRule { github-organization }

Matches a Github organization. Requires a Github identity provider.

"github-organization": GitHubOrganization { identity_provider_id, name, team }

identity_provider_id: string

The ID of your Github identity provider.

name: string

The name of the organization.

team?: string

The name of the team

GSuiteGroupRule { gsuite }

Matches a group in Google Workspace. Requires a Google Workspace identity provider.

gsuite: GSuite { email, identity_provider_id }

email: string

The email of the Google Workspace group.

identity_provider_id: string

The ID of your Google Workspace identity provider.

AccessLoginMethodRule { login_method }

Matches a specific identity provider id.

login_method: LoginMethod { id }

id: string

The ID of an identity provider.

IPListRule { ip_list }

Matches an IP address from a list.

ip_list: IPList { id }

id: string

The ID of a previously created IP list.

IPRule { ip }

Matches an IP address block.

ip: IP { ip }

ip: string

An IPv4 or IPv6 CIDR block.

OktaGroupRule { okta }

Matches an Okta group. Requires an Okta identity provider.

okta: Okta { identity_provider_id, name }

identity_provider_id: string

The ID of your Okta identity provider.

name: string

The name of the Okta group.

SAMLGroupRule { saml }

Matches a SAML group. Requires a SAML identity provider.

saml: SAML { attribute_name, attribute_value, identity_provider_id }

attribute_name: string

The name of the SAML attribute.

attribute_value: string

The SAML attribute value to look for.

identity_provider_id: string

The ID of your SAML identity provider.

AccessOIDCClaimRule { oidc }

Matches an OIDC claim. Requires an OIDC identity provider.

oidc: OIDC { claim_name, claim_value, identity_provider_id }

claim_name: string

The name of the OIDC claim.

claim_value: string

The OIDC claim value to look for.

identity_provider_id: string

The ID of your OIDC identity provider.

ServiceTokenRule { service_token }

Matches a specific Access Service Token

service_token: ServiceToken { token_id }

token_id: string

The ID of a Service Token.

AccessLinkedAppTokenRule { linked_app_token }

Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

linked_app_token: LinkedAppToken { app_uid }

app_uid: string

The ID of an Access OIDC SaaS application

AccessUserRiskScoreRule { user_risk_score }

Matches a user’s risk score.

user_risk_score: UserRiskScore { user_risk_score }

user_risk_score: Array<"low" | "medium" | "high" | "unscored">

A list of risk score levels to match. Values can be low, medium, high, or unscored.

One of the following:

"low"

"medium"

"high"

"unscored"

AccessCloudflareAccountMemberRule { cloudflare_account_member }

Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.

cloudflare_account_member: CloudflareAccountMember { account_id }

account_id?: string

Identifier.

maxLength32

include?: Array<AccessRule>

Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.

One of the following:

GroupRule { group }

Matches an Access group.

group: Group { id }

id: string

The ID of a previously created Access group.

AnyValidServiceTokenRule { any_valid_service_token }

Matches any valid Access Service Token

any_valid_service_token: AnyValidServiceToken

An empty object which matches on all service tokens.

AccessAuthContextRule { auth_context }

Matches an Azure Authentication Context. Requires an Azure identity provider.

auth_context: AuthContext { id, ac_id, identity_provider_id }

id: string

The ID of an Authentication context.

ac_id: string

The ACID of an Authentication context.

identity_provider_id: string

The ID of your Azure identity provider.

AuthenticationMethodRule { auth_method }

Enforce different MFA options

auth_method: AuthMethod { auth_method }

auth_method: string

The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

AzureGroupRule { azureAD }

Matches an Azure group. Requires an Azure identity provider.

azureAD: AzureAD { id, identity_provider_id }

id: string

The ID of an Azure group.

identity_provider_id: string

The ID of your Azure identity provider.

CertificateRule { certificate }

Matches any valid client certificate.

certificate: Certificate

AccessCommonNameRule { common_name }

Matches a specific common name.

common_name: CommonName { common_name }

common_name: string

The common name to match.

CountryRule { geo }

Matches a specific country

geo: Geo { country_code }

country_code: string

The country code that should be matched.

AccessDevicePostureRule { device_posture }

Enforces a device posture rule has run successfully

device_posture: DevicePosture { integration_uid, account_id }

integration_uid: string

The ID of a device posture integration.

account_id?: string

The ID of the account that owns the device posture integration.

maxLength32

DomainRule { email_domain }

Match an entire email domain.

email_domain: EmailDomain { domain }

domain: string

The email domain to match.

EmailListRule { email_list }

Matches an email address from a list.

email_list: EmailList { id }

id: string

The ID of a previously created email list.

EmailRule { email }

Matches a specific email.

email: Email { email }

email: string

The email of the user.

formatemail

EveryoneRule { everyone }

Matches everyone.

everyone: Everyone

An empty object which matches on all users.

ExternalEvaluationRule { external_evaluation }

Create Allow or Block policies which evaluate the user based on custom criteria.

external_evaluation: ExternalEvaluation { evaluate_url, keys_url }

evaluate_url: string

The API endpoint containing your business logic.

keys_url: string

The API endpoint containing the key that Access uses to verify that the response came from your API.

GitHubOrganizationRule { github-organization }

Matches a Github organization. Requires a Github identity provider.

"github-organization": GitHubOrganization { identity_provider_id, name, team }

identity_provider_id: string

The ID of your Github identity provider.

name: string

The name of the organization.

team?: string

The name of the team

GSuiteGroupRule { gsuite }

Matches a group in Google Workspace. Requires a Google Workspace identity provider.

gsuite: GSuite { email, identity_provider_id }

email: string

The email of the Google Workspace group.

identity_provider_id: string

The ID of your Google Workspace identity provider.

AccessLoginMethodRule { login_method }

Matches a specific identity provider id.

login_method: LoginMethod { id }

id: string

The ID of an identity provider.

IPListRule { ip_list }

Matches an IP address from a list.

ip_list: IPList { id }

id: string

The ID of a previously created IP list.

IPRule { ip }

Matches an IP address block.

ip: IP { ip }

ip: string

An IPv4 or IPv6 CIDR block.

OktaGroupRule { okta }

Matches an Okta group. Requires an Okta identity provider.

okta: Okta { identity_provider_id, name }

identity_provider_id: string

The ID of your Okta identity provider.

name: string

The name of the Okta group.

SAMLGroupRule { saml }

Matches a SAML group. Requires a SAML identity provider.

saml: SAML { attribute_name, attribute_value, identity_provider_id }

attribute_name: string

The name of the SAML attribute.

attribute_value: string

The SAML attribute value to look for.

identity_provider_id: string

The ID of your SAML identity provider.

AccessOIDCClaimRule { oidc }

Matches an OIDC claim. Requires an OIDC identity provider.

oidc: OIDC { claim_name, claim_value, identity_provider_id }

claim_name: string

The name of the OIDC claim.

claim_value: string

The OIDC claim value to look for.

identity_provider_id: string

The ID of your OIDC identity provider.

ServiceTokenRule { service_token }

Matches a specific Access Service Token

service_token: ServiceToken { token_id }

token_id: string

The ID of a Service Token.

AccessLinkedAppTokenRule { linked_app_token }

Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.

linked_app_token: LinkedAppToken { app_uid }

app_uid: string

The ID of an Access OIDC SaaS application

AccessUserRiskScoreRule { user_risk_score }

Matches a user’s risk score.

user_risk_score: UserRiskScore { user_risk_score }

user_risk_score: Array<"low" | "medium" | "high" | "unscored">

A list of risk score levels to match. Values can be low, medium, high, or unscored.

One of the following:

"low"

"medium"

"high"

"unscored"

AccessCloudflareAccountMemberRule { cloudflare_account_member }

Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.

cloudflare_account_member: CloudflareAccountMember { account_id }

account_id?: string

Identifier.

maxLength32

isolation_required?: boolean

Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.

mfa_config?: MfaConfig { allowed_authenticators, mfa_disabled, session_duration }

Configures multi-factor authentication (MFA) settings.

allowed_authenticators?: Array<"totp" | "biometrics" | "security_key">

Lists the MFA methods that users can authenticate with.

One of the following:

"totp"

"biometrics"

"security_key"

mfa_disabled?: boolean

Indicates whether to disable MFA for this resource. This option is available at the application and policy level.

session_duration?: string

Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.

name?: string

The name of the Access policy.

purpose_justification_prompt?: string

A custom message that will appear on the purpose justification screen.

purpose_justification_required?: boolean

Require users to enter a justification when they log in to the application.

require?: Array<AccessRule>

Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.

One of the following:

GroupRule { group }

Matches an Access group.

group: Group { id }

id: string

The ID of a previously created Access group.

AnyValidServiceTokenRule { any_valid_service_token }

Matches any valid Access Service Token

any_valid_service_token: AnyValidServiceToken

An empty object which matches on all service tokens.

AccessAuthContextRule { auth_context }

Matches an Azure Authentication Context. Requires an Azure identity provider.

auth_context: AuthContext { id, ac_id, identity_provider_id }

id: string

The ID of an Authentication context.

ac_id: string

The ACID of an Authentication context.

identity_provider_id: string

The ID of your Azure identity provider.

AuthenticationMethodRule { auth_method }

Enforce different MFA options

auth_method: AuthMethod { auth_method }

auth_method: string

The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.

AzureGroupRule { azureAD }

Matches an Azure group. Requires an Azure identity provider.

azureAD: AzureAD { id, identity_provider_id }

id: string

The ID of an Azure group.

identity_provider_id: string

The ID of your Azure identity provider.

CertificateRule { certificate }

Matches any valid client certificate.

certificate: Certificate

AccessCommonNameRule { common_name }

Matches a specific common name.

common_name: CommonName { common_name }

common_name: string

The common name to match.

CountryRule { geo }

Matches a specific country

geo: Geo { country_code }

country_code: string

The country code that should be matched.

AccessDevicePostureRule { device_posture }

Enforces a device posture rule has run successfully

device_posture: DevicePosture { integration_uid, account_id }

integration_uid: string

The ID of a device posture integration.

account_id?: string

The ID of the account that owns the device posture integration.

maxLength32

DomainRule { email_domain }

Match an entire email domain.

email_domain: EmailDomain { domain }

domain: string

The email domain to match.

EmailListRule { email_list }

Matches an email address from a list.

email_list: EmailList { id }

id: string

The ID of a previously created email list.

EmailRule { email }

Matches a specific email.

email: Email { email }

email: string

The email of the user.

formatemail

EveryoneRule { everyone }

Matches everyone.

everyone: Everyone

An empty object which matches on all users.

ExternalEvaluationRule { external_evaluation }

Create Allow or Block policies which evaluate the user based on custom criteria.

external_evaluation: ExternalEvaluation { evaluate_url, keys_url }

evaluate_url: string

The API endpoint containing your business logic.

keys_url: string

The API endpoint containing the key that Access uses to verify that the response came from your API.

GitHubOrganizationRule { github-organization }

Matches a Github organization. Requires a Github identity provider.

"github-organization": GitHubOrganization { identity_provider_id, name, team }

identity_provider_id: string

The ID of your Github identity provider.

name: string

The name of the organization.

team?: string

The name of the team