--- title: Zero Trust --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Zero Trust #### Zero TrustDevices ##### [List devices (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/methods/list) Deprecated client.ZeroTrust.Devices.List(ctx, query) (\*SinglePage\[[Device]()], error) GET/accounts/{account\_id}/devices ##### [Get device (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/methods/get) Deprecated client.ZeroTrust.Devices.Get(ctx, deviceID, query) (\*[DeviceGetResponse](), error) GET/accounts/{account\_id}/devices/{device\_id} ##### ModelsExpand Collapse
type Device struct{…} ID stringOptional Registration ID. Equal to Device ID except for accounts which enabled multi-user mode. maxLength36 Link to this property Created TimeOptional When the device was created. formatdate-time Link to this property Deleted boolOptional True if the device was deleted. Link to this property
DeviceType DeviceDeviceTypeOptional One of the following: const DeviceDeviceTypeWindows DeviceDeviceType = "windows" Link to this property const DeviceDeviceTypeMac DeviceDeviceType = "mac" Link to this property const DeviceDeviceTypeLinux DeviceDeviceType = "linux" Link to this property const DeviceDeviceTypeAndroid DeviceDeviceType = "android" Link to this property const DeviceDeviceTypeIos DeviceDeviceType = "ios" Link to this property const DeviceDeviceTypeChromeos DeviceDeviceType = "chromeos" Link to this property
Link to this property IP stringOptional IPv4 or IPv6 address. Link to this property Key stringOptional The device’s public key. Link to this property LastSeen TimeOptional When the device last connected to Cloudflare services. formatdate-time Link to this property MacAddress stringOptional The device mac address. Link to this property Manufacturer stringOptional The device manufacturer name. Link to this property Model stringOptional The device model name. Link to this property Name stringOptional The device name. Link to this property OSDistroName stringOptional The Linux distro name. Link to this property OSDistroRevision stringOptional The Linux distro revision. Link to this property OSVersion stringOptional The operating system version. Link to this property OSVersionExtra stringOptional Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property RevokedAt TimeOptional When the device was revoked. formatdate-time Link to this property SerialNumber stringOptional The device serial number. Link to this property Updated TimeOptional When the device was updated. formatdate-time Link to this property
User DeviceUserOptional ID stringOptional UUID. maxLength36 Link to this property Email stringOptional The contact email address of the user. maxLength90 Link to this property Name stringOptional The enrolled device user’s name. Link to this property
Link to this property Version stringOptional The WARP client version. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices%20%3E%20(model)%20device%20%3E%20(schema)>) #### Zero TrustDevicesDevices ##### [List devices](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/devices/methods/list) client.ZeroTrust.Devices.Devices.List(ctx, params) (\*CursorPagination\[[DeviceDeviceListResponse]()], error) GET/accounts/{account\_id}/devices/physical-devices ##### [Get device](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/devices/methods/get) client.ZeroTrust.Devices.Devices.Get(ctx, deviceID, params) (\*[DeviceDeviceGetResponse](), error) GET/accounts/{account\_id}/devices/physical-devices/{device\_id} ##### [Delete device](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/devices/methods/delete) client.ZeroTrust.Devices.Devices.Delete(ctx, deviceID, body) (\*[DeviceDeviceDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/physical-devices/{device\_id} ##### [Revoke device registrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/devices/methods/revoke) Deprecated client.ZeroTrust.Devices.Devices.Revoke(ctx, deviceID, body) (\*[DeviceDeviceRevokeResponse](), error) POST/accounts/{account\_id}/devices/physical-devices/{device\_id}/revoke #### Zero TrustDevicesResilience #### Zero TrustDevicesResilienceGlobal WARP Override ##### [Get Global Disconnect](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/get) client.ZeroTrust.Devices.Resilience.GlobalWARPOverride.Get(ctx, query) (\*[DeviceResilienceGlobalWARPOverrideGetResponse](), error) GET/accounts/{account\_id}/devices/resilience/disconnect ##### [Set Global Disconnect](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/create) client.ZeroTrust.Devices.Resilience.GlobalWARPOverride.New(ctx, params) (\*[DeviceResilienceGlobalWARPOverrideNewResponse](), error) POST/accounts/{account\_id}/devices/resilience/disconnect #### Zero TrustDevicesRegistrations ##### [List registrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/list) client.ZeroTrust.Devices.Registrations.List(ctx, params) (\*CursorPagination\[[DeviceRegistrationListResponse]()], error) GET/accounts/{account\_id}/devices/registrations ##### [Get registration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/get) client.ZeroTrust.Devices.Registrations.Get(ctx, registrationID, params) (\*[DeviceRegistrationGetResponse](), error) GET/accounts/{account\_id}/devices/registrations/{registration\_id} ##### [Delete registration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/delete) client.ZeroTrust.Devices.Registrations.Delete(ctx, registrationID, body) (\*[DeviceRegistrationDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/registrations/{registration\_id} ##### [Delete registrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/bulk_delete) client.ZeroTrust.Devices.Registrations.BulkDelete(ctx, params) (\*[DeviceRegistrationBulkDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/registrations ##### [Revoke registrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/revoke) Deprecated client.ZeroTrust.Devices.Registrations.Revoke(ctx, params) (\*[DeviceRegistrationRevokeResponse](), error) POST/accounts/{account\_id}/devices/registrations/revoke ##### [Unrevoke registrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/registrations/methods/unrevoke) Deprecated client.ZeroTrust.Devices.Registrations.Unrevoke(ctx, params) (\*[DeviceRegistrationUnrevokeResponse](), error) POST/accounts/{account\_id}/devices/registrations/unrevoke #### Zero TrustDevicesDEX Tests ##### [List Device DEX tests](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/list) client.ZeroTrust.Devices.DEXTests.List(ctx, params) (\*V4PagePaginationArray\[[SchemaHTTP]()], error) GET/accounts/{account\_id}/dex/devices/dex\_tests ##### [Get Device DEX test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/get) client.ZeroTrust.Devices.DEXTests.Get(ctx, dexTestID, query) (\*[SchemaHTTP](), error) GET/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### [Create Device DEX test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/create) client.ZeroTrust.Devices.DEXTests.New(ctx, params) (\*[SchemaHTTP](), error) POST/accounts/{account\_id}/dex/devices/dex\_tests ##### [Update Device DEX test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/update) client.ZeroTrust.Devices.DEXTests.Update(ctx, dexTestID, params) (\*[SchemaHTTP](), error) PUT/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### [Delete Device DEX test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/delete) client.ZeroTrust.Devices.DEXTests.Delete(ctx, dexTestID, body) (\*[DeviceDEXTestDeleteResponse](), error) DELETE/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### ModelsExpand Collapse
type SchemaData struct{…} The configuration object which contains the details for the WARP client to conduct the test. Host string The desired endpoint to test. Link to this property
Kind SchemaDataKind The type of test. One of the following: const SchemaDataKindHTTP SchemaDataKind = "http" Link to this property const SchemaDataKindTraceroute SchemaDataKind = "traceroute" Link to this property
Link to this property Method SchemaDataMethodOptional The HTTP request method type. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_data%20%3E%20(schema)>)
type SchemaHTTP struct{…} Data SchemaData The configuration object which contains the details for the WARP client to conduct the test. Link to this property Enabled bool Determines whether or not the test is active. Link to this property Interval string How often the test will run. Link to this property Name string The name of the DEX test. Must be unique. Link to this property Created TimeOptional Date the test was created, in RFC 3339 format. formatdate-time Link to this property Description stringOptional Additional details about the test. Link to this property
TargetPolicies \[]SchemaHTTPTargetPolicyOptional DEX rules targeted by this test ID string The id of the DEX rule. maxLength36 Link to this property Default boolOptional Whether the DEX rule is the account default. Link to this property Name stringOptional The name of the DEX rule. Link to this property
Link to this property Targeted boolOptional Link to this property TestID stringOptional The unique identifier for the test. maxLength32 Link to this property Updated TimeOptional Date the test was last updated, in RFC 3339 format. formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_http%20%3E%20(schema)>) #### Zero TrustDevicesIP Profiles ##### [List IP profiles](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/list) client.ZeroTrust.Devices.IPProfiles.List(ctx, params) (\*V4PagePaginationArray\[[IPProfile]()], error) GET/accounts/{account\_id}/devices/ip-profiles ##### [Get IP profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/get) client.ZeroTrust.Devices.IPProfiles.Get(ctx, profileID, query) (\*[IPProfile](), error) GET/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### [Create IP profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/create) client.ZeroTrust.Devices.IPProfiles.New(ctx, params) (\*[IPProfile](), error) POST/accounts/{account\_id}/devices/ip-profiles ##### [Update IP profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/update) client.ZeroTrust.Devices.IPProfiles.Update(ctx, profileID, params) (\*[IPProfile](), error) PATCH/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### [Delete IP profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/delete) client.ZeroTrust.Devices.IPProfiles.Delete(ctx, profileID, body) (\*[DeviceIPProfileDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### ModelsExpand Collapse
type IPProfile struct{…} ID string The ID of the Device IP profile. Link to this property CreatedAt string The RFC3339Nano timestamp when the Device IP profile was created. Link to this property Description string An optional description of the Device IP profile. Link to this property Enabled bool Whether the Device IP profile is enabled. Link to this property Match string The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml\_attributes”. maxLength10000 Link to this property Name string A user-friendly name for the Device IP profile. Link to this property Precedence int64 The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field. Link to this property SubnetID string The ID of the Subnet. Link to this property UpdatedAt string The RFC3339Nano timestamp when the Device IP profile was last updated. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.ip_profiles%20%3E%20(model)%20ip_profile%20%3E%20(schema)>) #### Zero TrustDevicesDeployment Groups ##### [List deployment groups](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/list) client.ZeroTrust.Devices.DeploymentGroups.List(ctx, params) (\*V4PagePaginationArray\[[DeploymentGroup]()], error) GET/accounts/{account\_id}/devices/deployment-groups ##### [Get deployment group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/get) client.ZeroTrust.Devices.DeploymentGroups.Get(ctx, groupID, query) (\*[DeploymentGroup](), error) GET/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### [Create deployment group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/create) client.ZeroTrust.Devices.DeploymentGroups.New(ctx, params) (\*[DeploymentGroup](), error) POST/accounts/{account\_id}/devices/deployment-groups ##### [Update deployment group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/edit) client.ZeroTrust.Devices.DeploymentGroups.Edit(ctx, groupID, params) (\*[DeploymentGroup](), error) PATCH/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### [Delete deployment group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/delete) client.ZeroTrust.Devices.DeploymentGroups.Delete(ctx, groupID, body) (\*[DeviceDeploymentGroupDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### ModelsExpand Collapse
type DeploymentGroup struct{…} ID string The ID of the deployment group. Link to this property CreatedAt string The RFC3339Nano timestamp when the deployment group was created. Link to this property Name string A user-friendly name for the deployment group. maxLength255 minLength1 Link to this property UpdatedAt string The RFC3339Nano timestamp when the deployment group was last updated. Link to this property
VersionConfig \[]DeploymentGroupVersionConfig Contains version configurations for different target environments. TargetEnvironment string The target environment for the client version (e.g., windows, macos). Link to this property Version string The specific client version to deploy. Link to this property
Link to this property PolicyIDs \[]stringOptional Contains a list of policy IDs assigned to this deployment group. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.deployment_groups%20%3E%20(model)%20deployment_group%20%3E%20(schema)>) #### Zero TrustDevicesNetworks ##### [List your device managed networks](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/networks/methods/list) client.ZeroTrust.Devices.Networks.List(ctx, query) (\*SinglePage\[[DeviceNetwork]()], error) GET/accounts/{account\_id}/devices/networks ##### [Get device managed network details](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/networks/methods/get) client.ZeroTrust.Devices.Networks.Get(ctx, networkID, query) (\*[DeviceNetwork](), error) GET/accounts/{account\_id}/devices/networks/{network\_id} ##### [Create a device managed network](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/networks/methods/create) client.ZeroTrust.Devices.Networks.New(ctx, params) (\*[DeviceNetwork](), error) POST/accounts/{account\_id}/devices/networks ##### [Update a device managed network](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/networks/methods/update) client.ZeroTrust.Devices.Networks.Update(ctx, networkID, params) (\*[DeviceNetwork](), error) PUT/accounts/{account\_id}/devices/networks/{network\_id} ##### [Delete a device managed network](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/networks/methods/delete) client.ZeroTrust.Devices.Networks.Delete(ctx, networkID, body) (\*SinglePage\[[DeviceNetwork]()], error) DELETE/accounts/{account\_id}/devices/networks/{network\_id} ##### ModelsExpand Collapse
type DeviceNetwork struct{…}
Config DeviceNetworkConfigOptional The configuration object containing information for the WARP client to detect the managed network. TLSSockaddr string A network address of the form “host:port” that the WARP client will use to detect the presence of a TLS host. Link to this property Sha256 stringOptional The SHA-256 hash of the TLS certificate presented by the host found at tls\_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate. Link to this property
Link to this property Name stringOptional The name of the device managed network. This name must be unique. Link to this property NetworkID stringOptional API UUID. maxLength36 Link to this property Type DeviceNetworkTypeOptional The type of device managed network. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.networks%20%3E%20(model)%20device_network%20%3E%20(schema)>) #### Zero TrustDevicesFleet Status ##### [Get the latest status of a device.](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/fleet_status/methods/get) client.ZeroTrust.Devices.FleetStatus.Get(ctx, deviceID, params) (\*[DeviceFleetStatusGetResponse](), error) GET/accounts/{account\_id}/dex/devices/{device\_id}/fleet-status/live #### Zero TrustDevicesPolicies ##### ModelsExpand Collapse
type DevicePolicyCertificates struct{…} Enabled bool The current status of the device policy certificate provisioning feature for WARP clients. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20device_policy_certificates%20%3E%20(schema)>)
type FallbackDomain struct{…} Suffix string The domain suffix to match when resolving locally. Link to this property Description stringOptional A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property DNSServer \[]stringOptional A list of IP addresses to handle domain resolution. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20fallback_domain%20%3E%20(schema)>)
type SettingsPolicy struct{…} AllowModeSwitch boolOptional Whether to allow the user to switch WARP between modes. Link to this property AllowUpdates boolOptional Whether to receive update notifications when a new version of the client is available. Link to this property AllowedToLeave boolOptional Whether to allow devices to leave the organization. Link to this property AutoConnect float64Optional The amount of time in seconds to reconnect after having been disabled. Link to this property
BrowserExtensionConfig SettingsPolicyBrowserExtensionConfigOptional Browser extension proxy settings. Required when profile\_type is browser\_extension and invalid for WARP profiles.
ProxyControl SettingsPolicyBrowserExtensionConfigProxyControl Whether the user may disable the browser extension proxy. One of the following: const SettingsPolicyBrowserExtensionConfigProxyControlUnlocked SettingsPolicyBrowserExtensionConfigProxyControl = "unlocked" Link to this property const SettingsPolicyBrowserExtensionConfigProxyControlLocked SettingsPolicyBrowserExtensionConfigProxyControl = "locked" Link to this property
Link to this property ProxyEnabled bool Whether the browser extension proxy is active. Link to this property
Link to this property CaptivePortal float64Optional Turn on the captive portal after the specified amount of time. Link to this property Default boolOptional Whether the policy is the account default. WARP group profiles cannot set this field. Link to this property Description stringOptional A description of the policy. maxLength500 Link to this property DisableAutoFallback boolOptional If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true. Link to this property
DNSSearchSuffixes \[]SettingsPolicyDNSSearchSuffixOptional List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. Suffix string The DNS search suffix to append when resolving short hostnames. Link to this property Description stringOptional A description of the DNS search suffix. Link to this property
Link to this property Enabled boolOptional Whether the policy will be applied to matching devices. Link to this property
Exclude \[]SplitTunnelExcludeOptional List of routes excluded in the WARP client’s tunnel. One of the following:
type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithAddress struct{…} Address string The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithHost struct{…} Host string The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property ExcludeOfficeIPs boolOptional Whether to add Microsoft IPs to Split Tunnel exclusions. Link to this property
FallbackDomains \[]FallbackDomainOptional Suffix string The domain suffix to match when resolving locally. Link to this property Description stringOptional A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property DNSServer \[]stringOptional A list of IP addresses to handle domain resolution. Link to this property
Link to this property GatewayUniqueID stringOptional Link to this property
GlobalAcceleration SettingsPolicyGlobalAccelerationOptional Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/. APIEndpoints \[]string IP:port entries for the API endpoints. Link to this property Enabled bool Global acceleration settings are used only when “enabled”. Link to this property MasqueEndpoints \[]string IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property WireguardEndpoints \[]string IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property Autoswitch boolOptional Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided. Link to this property
Link to this property
Include \[]SplitTunnelIncludeOptional List of routes included in the WARP client’s tunnel. One of the following:
type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithAddress struct{…} Address string The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithHost struct{…} Host string The domain name to include in the tunnel. If host is present, address must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property LANAllowMinutes float64Optional The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset. Link to this property LANAllowSubnetSize float64Optional The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset. Link to this property Match stringOptional The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service\_token\_uuid”, “identity.saml\_attributes”, “network”, “os.name”, “os.version”. maxLength500 Link to this property Name stringOptional The name of the device settings profile. maxLength100 Link to this property PolicyID stringOptional maxLength36 Link to this property Precedence float64Optional The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field. Link to this property
ProfileType SettingsPolicyProfileTypeOptional The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed. One of the following: const SettingsPolicyProfileTypeWARP SettingsPolicyProfileType = "warp" Link to this property const SettingsPolicyProfileTypeBrowserExtension SettingsPolicyProfileType = "browser\_extension" Link to this property
Link to this property RegisterInterfaceIPWithDNS boolOptional Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server. Link to this property SccmVpnBoundarySupport boolOptional Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only). Link to this property
ServiceModeV2 SettingsPolicyServiceModeV2Optional Mode stringOptional The mode to run the WARP client under. Link to this property Port float64Optional The port number when used with proxy mode. Link to this property
Link to this property SupportURL stringOptional The URL to launch when the Send Feedback button is clicked. Link to this property SwitchLocked boolOptional Whether to allow the user to turn off the WARP switch and disconnect the client. Link to this property
DeprecatedTargetTests \[]SettingsPolicyTargetTestOptional ID stringOptional The id of the DEX test targeting this policy. Link to this property Name stringOptional The name of the DEX test targeting this policy. Link to this property
Link to this property TunnelProtocol stringOptional Determines which tunnel protocol to use. Link to this property UninstallProtection boolOptional Determines whether uninstalling the WARP client requires an override code. (Windows only). Link to this property
VirtualNetworks SettingsPolicyVirtualNetworksOptional Virtual network access settings for the device. Allowed \[]string List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required. Link to this property Default string The default virtual network ID. Must be included in the allowed list. formatuuid Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20settings_policy%20%3E%20(schema)>)
type SplitTunnelExclude interface{…} One of the following:
type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithAddress struct{…} Address string The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithHost struct{…} Host string The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_exclude%20%3E%20(schema)>)
type SplitTunnelInclude interface{…} One of the following:
type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithAddress struct{…} Address string The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithHost struct{…} Host string The domain name to include in the tunnel. If host is present, address must not be present. Link to this property Description stringOptional A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_include%20%3E%20(schema)>) #### Zero TrustDevicesPoliciesDefault ##### [Get the default device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/get) client.ZeroTrust.Devices.Policies.Default.Get(ctx, query) (\*[DevicePolicyDefaultGetResponse](), error) GET/accounts/{account\_id}/devices/policy ##### [Update the default device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/edit) client.ZeroTrust.Devices.Policies.Default.Edit(ctx, params) (\*[DevicePolicyDefaultEditResponse](), error) PATCH/accounts/{account\_id}/devices/policy #### Zero TrustDevicesPoliciesDefaultExcludes ##### [Get the Split Tunnel exclude list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/get) client.ZeroTrust.Devices.Policies.Default.Excludes.Get(ctx, query) (\*SinglePage\[[SplitTunnelExclude]()], error) GET/accounts/{account\_id}/devices/policy/exclude ##### [Set the Split Tunnel exclude list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/update) client.ZeroTrust.Devices.Policies.Default.Excludes.Update(ctx, params) (\*SinglePage\[[SplitTunnelExclude]()], error) PUT/accounts/{account\_id}/devices/policy/exclude #### Zero TrustDevicesPoliciesDefaultIncludes ##### [Get the Split Tunnel include list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/get) client.ZeroTrust.Devices.Policies.Default.Includes.Get(ctx, query) (\*SinglePage\[[SplitTunnelInclude]()], error) GET/accounts/{account\_id}/devices/policy/include ##### [Set the Split Tunnel include list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/update) client.ZeroTrust.Devices.Policies.Default.Includes.Update(ctx, params) (\*SinglePage\[[SplitTunnelInclude]()], error) PUT/accounts/{account\_id}/devices/policy/include #### Zero TrustDevicesPoliciesDefaultFallback Domains ##### [Get your Local Domain Fallback list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/get) client.ZeroTrust.Devices.Policies.Default.FallbackDomains.Get(ctx, query) (\*SinglePage\[[FallbackDomain]()], error) GET/accounts/{account\_id}/devices/policy/fallback\_domains ##### [Set your Local Domain Fallback list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/update) client.ZeroTrust.Devices.Policies.Default.FallbackDomains.Update(ctx, params) (\*SinglePage\[[FallbackDomain]()], error) PUT/accounts/{account\_id}/devices/policy/fallback\_domains #### Zero TrustDevicesPoliciesDefaultCertificates ##### [Get device certificate provisioning status](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/get) client.ZeroTrust.Devices.Policies.Default.Certificates.Get(ctx, query) (\*[DevicePolicyCertificates](), error) GET/zones/{zone\_id}/devices/policy/certificates ##### [Update device certificate provisioning status](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/edit) client.ZeroTrust.Devices.Policies.Default.Certificates.Edit(ctx, params) (\*[DevicePolicyCertificates](), error) PATCH/zones/{zone\_id}/devices/policy/certificates #### Zero TrustDevicesPoliciesCustom ##### [List device settings profiles](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/list) client.ZeroTrust.Devices.Policies.Custom.List(ctx, params) (\*SinglePage\[[SettingsPolicy]()], error) GET/accounts/{account\_id}/devices/policies ##### [Get device settings profile by ID](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/get) client.ZeroTrust.Devices.Policies.Custom.Get(ctx, policyID, query) (\*[SettingsPolicy](), error) GET/accounts/{account\_id}/devices/policy/{policy\_id} ##### [Create a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/create) client.ZeroTrust.Devices.Policies.Custom.New(ctx, params) (\*[SettingsPolicy](), error) POST/accounts/{account\_id}/devices/policy ##### [Update a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/edit) client.ZeroTrust.Devices.Policies.Custom.Edit(ctx, policyID, params) (\*[SettingsPolicy](), error) PATCH/accounts/{account\_id}/devices/policy/{policy\_id} ##### [Delete a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/delete) client.ZeroTrust.Devices.Policies.Custom.Delete(ctx, policyID, body) (\*SinglePage\[[SettingsPolicy]()], error) DELETE/accounts/{account\_id}/devices/policy/{policy\_id} #### Zero TrustDevicesPoliciesCustomExcludes ##### [Get the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/get) client.ZeroTrust.Devices.Policies.Custom.Excludes.Get(ctx, policyID, query) (\*SinglePage\[[SplitTunnelExclude]()], error) GET/accounts/{account\_id}/devices/policy/{policy\_id}/exclude ##### [Set the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/update) client.ZeroTrust.Devices.Policies.Custom.Excludes.Update(ctx, policyID, params) (\*SinglePage\[[SplitTunnelExclude]()], error) PUT/accounts/{account\_id}/devices/policy/{policy\_id}/exclude #### Zero TrustDevicesPoliciesCustomIncludes ##### [Get the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/get) client.ZeroTrust.Devices.Policies.Custom.Includes.Get(ctx, policyID, query) (\*SinglePage\[[SplitTunnelInclude]()], error) GET/accounts/{account\_id}/devices/policy/{policy\_id}/include ##### [Set the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/update) client.ZeroTrust.Devices.Policies.Custom.Includes.Update(ctx, policyID, params) (\*SinglePage\[[SplitTunnelInclude]()], error) PUT/accounts/{account\_id}/devices/policy/{policy\_id}/include #### Zero TrustDevicesPoliciesCustomFallback Domains ##### [Get the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/get) client.ZeroTrust.Devices.Policies.Custom.FallbackDomains.Get(ctx, policyID, query) (\*SinglePage\[[FallbackDomain]()], error) GET/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains ##### [Set the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/update) client.ZeroTrust.Devices.Policies.Custom.FallbackDomains.Update(ctx, policyID, params) (\*SinglePage\[[FallbackDomain]()], error) PUT/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains #### Zero TrustDevicesPosture ##### [List posture rules](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/methods/list) client.ZeroTrust.Devices.Posture.List(ctx, query) (\*SinglePage\[[DevicePostureRule]()], error) GET/accounts/{account\_id}/devices/posture ##### [Get posture rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/methods/get) client.ZeroTrust.Devices.Posture.Get(ctx, ruleID, query) (\*[DevicePostureRule](), error) GET/accounts/{account\_id}/devices/posture/{rule\_id} ##### [Create posture rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/methods/create) client.ZeroTrust.Devices.Posture.New(ctx, params) (\*[DevicePostureRule](), error) POST/accounts/{account\_id}/devices/posture ##### [Update posture rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/methods/update) client.ZeroTrust.Devices.Posture.Update(ctx, ruleID, params) (\*[DevicePostureRule](), error) PUT/accounts/{account\_id}/devices/posture/{rule\_id} ##### [Delete posture rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/methods/delete) client.ZeroTrust.Devices.Posture.Delete(ctx, ruleID, body) (\*[DevicePostureDeleteResponse](), error) DELETE/accounts/{account\_id}/devices/posture/{rule\_id} ##### ModelsExpand Collapse type CarbonblackInput string [Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20carbonblack_input%20%3E%20(schema)>)
type ClientCertificateInput struct{…} CertificateID string UUID of Cloudflare managed certificate. maxLength36 Link to this property Cn string Common Name that is protected by the certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20client_certificate_input%20%3E%20(schema)>)
type CrowdstrikeInput struct{…} ConnectionID string Posture Integration ID. Link to this property LastSeen stringOptional For more details on last seen, please refer to the Crowdstrike documentation. Link to this property
Operator CrowdstrikeInputOperatorOptional Operator. One of the following: const CrowdstrikeInputOperatorLess CrowdstrikeInputOperator = "<" Link to this property const CrowdstrikeInputOperatorLessOrEquals CrowdstrikeInputOperator = "<=" Link to this property const CrowdstrikeInputOperatorGreater CrowdstrikeInputOperator = ">" Link to this property const CrowdstrikeInputOperatorGreaterOrEquals CrowdstrikeInputOperator = ">=" Link to this property const CrowdstrikeInputOperatorEquals CrowdstrikeInputOperator = "==" Link to this property
Link to this property OS stringOptional Os Version. Link to this property Overall stringOptional Overall. Link to this property SensorConfig stringOptional SensorConfig. Link to this property
State CrowdstrikeInputStateOptional For more details on state, please refer to the Crowdstrike documentation. One of the following: const CrowdstrikeInputStateOnline CrowdstrikeInputState = "online" Link to this property const CrowdstrikeInputStateOffline CrowdstrikeInputState = "offline" Link to this property const CrowdstrikeInputStateUnknown CrowdstrikeInputState = "unknown" Link to this property
Link to this property Version stringOptional Version. Link to this property
VersionOperator CrowdstrikeInputVersionOperatorOptional Version Operator. One of the following: const CrowdstrikeInputVersionOperatorLess CrowdstrikeInputVersionOperator = "<" Link to this property const CrowdstrikeInputVersionOperatorLessOrEquals CrowdstrikeInputVersionOperator = "<=" Link to this property const CrowdstrikeInputVersionOperatorGreater CrowdstrikeInputVersionOperator = ">" Link to this property const CrowdstrikeInputVersionOperatorGreaterOrEquals CrowdstrikeInputVersionOperator = ">=" Link to this property const CrowdstrikeInputVersionOperatorEquals CrowdstrikeInputVersionOperator = "==" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20crowdstrike_input%20%3E%20(schema)>)
type DeviceInput interface{…} The value to be checked against. One of the following:
type FileInput struct{…}
OperatingSystem FileInputOperatingSystem Operating system. One of the following: const FileInputOperatingSystemWindows FileInputOperatingSystem = "windows" Link to this property const FileInputOperatingSystemLinux FileInputOperatingSystem = "linux" Link to this property const FileInputOperatingSystemMac FileInputOperatingSystem = "mac" Link to this property
Link to this property Path string File path. Link to this property Exists boolOptional Whether or not file exists. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
Link to this property
type UniqueClientIDInput struct{…} ID string List ID. Link to this property
OperatingSystem UniqueClientIDInputOperatingSystem Operating System. One of the following: const UniqueClientIDInputOperatingSystemAndroid UniqueClientIDInputOperatingSystem = "android" Link to this property const UniqueClientIDInputOperatingSystemIos UniqueClientIDInputOperatingSystem = "ios" Link to this property const UniqueClientIDInputOperatingSystemChromeos UniqueClientIDInputOperatingSystem = "chromeos" Link to this property
Link to this property
Link to this property
type DomainJoinedInput struct{…} OperatingSystem DomainJoinedInputOperatingSystem Operating System. Link to this property Domain stringOptional Domain. Link to this property
Link to this property
type OSVersionInput struct{…} OperatingSystem OSVersionInputOperatingSystem Operating System. Link to this property
Operator OSVersionInputOperator Operator. One of the following: const OSVersionInputOperatorLess OSVersionInputOperator = "<" Link to this property const OSVersionInputOperatorLessOrEquals OSVersionInputOperator = "<=" Link to this property const OSVersionInputOperatorGreater OSVersionInputOperator = ">" Link to this property const OSVersionInputOperatorGreaterOrEquals OSVersionInputOperator = ">=" Link to this property const OSVersionInputOperatorEquals OSVersionInputOperator = "==" Link to this property
Link to this property Version string Version of OS. Link to this property OSDistroName stringOptional Operating System Distribution Name (linux only). Link to this property OSDistroRevision stringOptional Version of OS Distribution (linux only). Link to this property OSVersionExtra stringOptional Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property
Link to this property
type FirewallInput struct{…} Enabled bool Enabled. Link to this property
OperatingSystem FirewallInputOperatingSystem Operating System. One of the following: const FirewallInputOperatingSystemWindows FirewallInputOperatingSystem = "windows" Link to this property const FirewallInputOperatingSystemMac FirewallInputOperatingSystem = "mac" Link to this property
Link to this property
Link to this property
type SentineloneInput struct{…}
OperatingSystem SentineloneInputOperatingSystem Operating system. One of the following: const SentineloneInputOperatingSystemWindows SentineloneInputOperatingSystem = "windows" Link to this property const SentineloneInputOperatingSystemLinux SentineloneInputOperatingSystem = "linux" Link to this property const SentineloneInputOperatingSystemMac SentineloneInputOperatingSystem = "mac" Link to this property
Link to this property Path string File path. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
Link to this property
type DeviceInputTeamsDevicesCarbonblackInputRequest struct{…}
OperatingSystem DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystem Operating system. One of the following: const DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystemWindows DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystem = "windows" Link to this property const DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystemLinux DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystem = "linux" Link to this property const DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystemMac DeviceInputTeamsDevicesCarbonblackInputRequestOperatingSystem = "mac" Link to this property
Link to this property Path string File path. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
Link to this property
type DeviceInputTeamsDevicesAccessSerialNumberListInputRequest struct{…} ID string UUID of Access List. maxLength36 Link to this property
Link to this property
type DiskEncryptionInput struct{…} CheckDisks \[]CarbonblackInputOptional List of volume names to be checked for encryption. Link to this property RequireAll boolOptional Whether to check all disks for encryption. Link to this property
Link to this property
type DeviceInputTeamsDevicesApplicationInputRequest struct{…}
OperatingSystem DeviceInputTeamsDevicesApplicationInputRequestOperatingSystem Operating system. One of the following: const DeviceInputTeamsDevicesApplicationInputRequestOperatingSystemWindows DeviceInputTeamsDevicesApplicationInputRequestOperatingSystem = "windows" Link to this property const DeviceInputTeamsDevicesApplicationInputRequestOperatingSystemLinux DeviceInputTeamsDevicesApplicationInputRequestOperatingSystem = "linux" Link to this property const DeviceInputTeamsDevicesApplicationInputRequestOperatingSystemMac DeviceInputTeamsDevicesApplicationInputRequestOperatingSystem = "mac" Link to this property
Link to this property Path string Path for the application. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
Link to this property
type ClientCertificateInput struct{…} CertificateID string UUID of Cloudflare managed certificate. maxLength36 Link to this property Cn string Common Name that is protected by the certificate. Link to this property
Link to this property
type DeviceInputTeamsDevicesClientCertificateV2InputRequest struct{…} CertificateID string UUID of Cloudflare managed certificate. maxLength36 Link to this property CheckPrivateKey bool Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. Link to this property
OperatingSystem DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystem Operating system. One of the following: const DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystemWindows DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystem = "windows" Link to this property const DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystemLinux DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystem = "linux" Link to this property const DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystemMac DeviceInputTeamsDevicesClientCertificateV2InputRequestOperatingSystem = "mac" Link to this property
Link to this property Cn stringOptional Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial\_number} and ${hostname} are valid variables. Link to this property
ExtendedKeyUsage \[]DeviceInputTeamsDevicesClientCertificateV2InputRequestExtendedKeyUsageOptional List of values indicating purposes for which the certificate public key can be used. One of the following: const DeviceInputTeamsDevicesClientCertificateV2InputRequestExtendedKeyUsageClientAuth DeviceInputTeamsDevicesClientCertificateV2InputRequestExtendedKeyUsage = "clientAuth" Link to this property const DeviceInputTeamsDevicesClientCertificateV2InputRequestExtendedKeyUsageEmailProtection DeviceInputTeamsDevicesClientCertificateV2InputRequestExtendedKeyUsage = "emailProtection" Link to this property
Link to this property
Locations DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsOptional Paths \[]stringOptional List of paths to check for client certificate on linux. Link to this property
TrustStores \[]DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsTrustStoreOptional List of trust stores to check for client certificate. One of the following: const DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsTrustStoreSystem DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsTrustStore = "system" Link to this property const DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsTrustStoreUser DeviceInputTeamsDevicesClientCertificateV2InputRequestLocationsTrustStore = "user" Link to this property
Link to this property
Link to this property SubjectAlternativeNames \[]stringOptional List of certificate Subject Alternative Names. Link to this property
Link to this property
type DeviceInputTeamsDevicesAntivirusInputRequest struct{…} UpdateWindowDays float64Optional Number of days that the antivirus should be updated within. Link to this property
Link to this property
type WorkspaceOneInput struct{…}
ComplianceStatus WorkspaceOneInputComplianceStatus Compliance Status. One of the following: const WorkspaceOneInputComplianceStatusCompliant WorkspaceOneInputComplianceStatus = "compliant" Link to this property const WorkspaceOneInputComplianceStatusNoncompliant WorkspaceOneInputComplianceStatus = "noncompliant" Link to this property const WorkspaceOneInputComplianceStatusUnknown WorkspaceOneInputComplianceStatus = "unknown" Link to this property
Link to this property ConnectionID string Posture Integration ID. Link to this property
Link to this property
type CrowdstrikeInput struct{…} ConnectionID string Posture Integration ID. Link to this property LastSeen stringOptional For more details on last seen, please refer to the Crowdstrike documentation. Link to this property
Operator CrowdstrikeInputOperatorOptional Operator. One of the following: const CrowdstrikeInputOperatorLess CrowdstrikeInputOperator = "<" Link to this property const CrowdstrikeInputOperatorLessOrEquals CrowdstrikeInputOperator = "<=" Link to this property const CrowdstrikeInputOperatorGreater CrowdstrikeInputOperator = ">" Link to this property const CrowdstrikeInputOperatorGreaterOrEquals CrowdstrikeInputOperator = ">=" Link to this property const CrowdstrikeInputOperatorEquals CrowdstrikeInputOperator = "==" Link to this property
Link to this property OS stringOptional Os Version. Link to this property Overall stringOptional Overall. Link to this property SensorConfig stringOptional SensorConfig. Link to this property
State CrowdstrikeInputStateOptional For more details on state, please refer to the Crowdstrike documentation. One of the following: const CrowdstrikeInputStateOnline CrowdstrikeInputState = "online" Link to this property const CrowdstrikeInputStateOffline CrowdstrikeInputState = "offline" Link to this property const CrowdstrikeInputStateUnknown CrowdstrikeInputState = "unknown" Link to this property
Link to this property Version stringOptional Version. Link to this property
VersionOperator CrowdstrikeInputVersionOperatorOptional Version Operator. One of the following: const CrowdstrikeInputVersionOperatorLess CrowdstrikeInputVersionOperator = "<" Link to this property const CrowdstrikeInputVersionOperatorLessOrEquals CrowdstrikeInputVersionOperator = "<=" Link to this property const CrowdstrikeInputVersionOperatorGreater CrowdstrikeInputVersionOperator = ">" Link to this property const CrowdstrikeInputVersionOperatorGreaterOrEquals CrowdstrikeInputVersionOperator = ">=" Link to this property const CrowdstrikeInputVersionOperatorEquals CrowdstrikeInputVersionOperator = "==" Link to this property
Link to this property
Link to this property
type IntuneInput struct{…}
ComplianceStatus IntuneInputComplianceStatus Compliance Status. One of the following: const IntuneInputComplianceStatusCompliant IntuneInputComplianceStatus = "compliant" Link to this property const IntuneInputComplianceStatusNoncompliant IntuneInputComplianceStatus = "noncompliant" Link to this property const IntuneInputComplianceStatusUnknown IntuneInputComplianceStatus = "unknown" Link to this property const IntuneInputComplianceStatusNotapplicable IntuneInputComplianceStatus = "notapplicable" Link to this property const IntuneInputComplianceStatusIngraceperiod IntuneInputComplianceStatus = "ingraceperiod" Link to this property const IntuneInputComplianceStatusError IntuneInputComplianceStatus = "error" Link to this property
Link to this property ConnectionID string Posture Integration ID. Link to this property
Link to this property
type KolideInput struct{…} ConnectionID string Posture Integration ID. Link to this property
AuthState \[]KolideInputAuthStateOptional The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. One of the following: const KolideInputAuthStateGood KolideInputAuthState = "Good" Link to this property const KolideInputAuthStateNotified KolideInputAuthState = "Notified" Link to this property const KolideInputAuthStateWillBlock KolideInputAuthState = "Will Block" Link to this property const KolideInputAuthStateBlocked KolideInputAuthState = "Blocked" Link to this property
Link to this property
CountOperator KolideInputCountOperatorOptional Count Operator. One of the following: const KolideInputCountOperatorLess KolideInputCountOperator = "<" Link to this property const KolideInputCountOperatorLessOrEquals KolideInputCountOperator = "<=" Link to this property const KolideInputCountOperatorGreater KolideInputCountOperator = ">" Link to this property const KolideInputCountOperatorGreaterOrEquals KolideInputCountOperator = ">=" Link to this property const KolideInputCountOperatorEquals KolideInputCountOperator = "==" Link to this property
Link to this property IssueCount stringOptional The Number of Issues. Link to this property
Link to this property
type TaniumInput struct{…} ConnectionID string Posture Integration ID. Link to this property EidLastSeen stringOptional For more details on eid last seen, refer to the Tanium documentation. Link to this property
Operator TaniumInputOperatorOptional Operator to evaluate risk\_level or eid\_last\_seen. One of the following: const TaniumInputOperatorLess TaniumInputOperator = "<" Link to this property const TaniumInputOperatorLessOrEquals TaniumInputOperator = "<=" Link to this property const TaniumInputOperatorGreater TaniumInputOperator = ">" Link to this property const TaniumInputOperatorGreaterOrEquals TaniumInputOperator = ">=" Link to this property const TaniumInputOperatorEquals TaniumInputOperator = "==" Link to this property
Link to this property
RiskLevel TaniumInputRiskLevelOptional For more details on risk level, refer to the Tanium documentation. One of the following: const TaniumInputRiskLevelLow TaniumInputRiskLevel = "low" Link to this property const TaniumInputRiskLevelMedium TaniumInputRiskLevel = "medium" Link to this property const TaniumInputRiskLevelHigh TaniumInputRiskLevel = "high" Link to this property const TaniumInputRiskLevelCritical TaniumInputRiskLevel = "critical" Link to this property
Link to this property
ScoreOperator TaniumInputScoreOperatorOptional Score Operator. One of the following: const TaniumInputScoreOperatorLess TaniumInputScoreOperator = "<" Link to this property const TaniumInputScoreOperatorLessOrEquals TaniumInputScoreOperator = "<=" Link to this property const TaniumInputScoreOperatorGreater TaniumInputScoreOperator = ">" Link to this property const TaniumInputScoreOperatorGreaterOrEquals TaniumInputScoreOperator = ">=" Link to this property const TaniumInputScoreOperatorEquals TaniumInputScoreOperator = "==" Link to this property
Link to this property TotalScore float64Optional For more details on total score, refer to the Tanium documentation. Link to this property
Link to this property
type SentineloneS2sInput struct{…} ConnectionID string Posture Integration ID. Link to this property ActiveThreats float64Optional The Number of active threats. Link to this property Infected boolOptional Whether device is infected. Link to this property IsActive boolOptional Whether device is active. Link to this property
NetworkStatus SentineloneS2sInputNetworkStatusOptional Network status of device. One of the following: const SentineloneS2sInputNetworkStatusConnected SentineloneS2sInputNetworkStatus = "connected" Link to this property const SentineloneS2sInputNetworkStatusDisconnected SentineloneS2sInputNetworkStatus = "disconnected" Link to this property const SentineloneS2sInputNetworkStatusDisconnecting SentineloneS2sInputNetworkStatus = "disconnecting" Link to this property const SentineloneS2sInputNetworkStatusConnecting SentineloneS2sInputNetworkStatus = "connecting" Link to this property
Link to this property
OperationalState SentineloneS2sInputOperationalStateOptional Agent operational state. One of the following: const SentineloneS2sInputOperationalStateNa SentineloneS2sInputOperationalState = "na" Link to this property const SentineloneS2sInputOperationalStatePartiallyDisabled SentineloneS2sInputOperationalState = "partially\_disabled" Link to this property const SentineloneS2sInputOperationalStateAutoFullyDisabled SentineloneS2sInputOperationalState = "auto\_fully\_disabled" Link to this property const SentineloneS2sInputOperationalStateFullyDisabled SentineloneS2sInputOperationalState = "fully\_disabled" Link to this property const SentineloneS2sInputOperationalStateAutoPartiallyDisabled SentineloneS2sInputOperationalState = "auto\_partially\_disabled" Link to this property const SentineloneS2sInputOperationalStateDisabledError SentineloneS2sInputOperationalState = "disabled\_error" Link to this property const SentineloneS2sInputOperationalStateDBCorruption SentineloneS2sInputOperationalState = "db\_corruption" Link to this property
Link to this property
Operator SentineloneS2sInputOperatorOptional Operator. One of the following: const SentineloneS2sInputOperatorLess SentineloneS2sInputOperator = "<" Link to this property const SentineloneS2sInputOperatorLessOrEquals SentineloneS2sInputOperator = "<=" Link to this property const SentineloneS2sInputOperatorGreater SentineloneS2sInputOperator = ">" Link to this property const SentineloneS2sInputOperatorGreaterOrEquals SentineloneS2sInputOperator = ">=" Link to this property const SentineloneS2sInputOperatorEquals SentineloneS2sInputOperator = "==" Link to this property
Link to this property
Link to this property
type DeviceInputTeamsDevicesCustomS2sInputRequest struct{…} ConnectionID string Posture Integration ID. Link to this property
Operator DeviceInputTeamsDevicesCustomS2sInputRequestOperator Operator. One of the following: const DeviceInputTeamsDevicesCustomS2sInputRequestOperatorLess DeviceInputTeamsDevicesCustomS2sInputRequestOperator = "<" Link to this property const DeviceInputTeamsDevicesCustomS2sInputRequestOperatorLessOrEquals DeviceInputTeamsDevicesCustomS2sInputRequestOperator = "<=" Link to this property const DeviceInputTeamsDevicesCustomS2sInputRequestOperatorGreater DeviceInputTeamsDevicesCustomS2sInputRequestOperator = ">" Link to this property const DeviceInputTeamsDevicesCustomS2sInputRequestOperatorGreaterOrEquals DeviceInputTeamsDevicesCustomS2sInputRequestOperator = ">=" Link to this property const DeviceInputTeamsDevicesCustomS2sInputRequestOperatorEquals DeviceInputTeamsDevicesCustomS2sInputRequestOperator = "==" Link to this property
Link to this property Score float64 A value between 0-100 assigned to devices set by the 3rd party posture provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_input%20%3E%20(schema)>)
type DeviceMatch struct{…}
Platform DeviceMatchPlatformOptional One of the following: const DeviceMatchPlatformWindows DeviceMatchPlatform = "windows" Link to this property const DeviceMatchPlatformMac DeviceMatchPlatform = "mac" Link to this property const DeviceMatchPlatformLinux DeviceMatchPlatform = "linux" Link to this property const DeviceMatchPlatformAndroid DeviceMatchPlatform = "android" Link to this property const DeviceMatchPlatformIos DeviceMatchPlatform = "ios" Link to this property const DeviceMatchPlatformChromeos DeviceMatchPlatform = "chromeos" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_match%20%3E%20(schema)>)
type DevicePostureRule struct{…} ID stringOptional API UUID. maxLength36 Link to this property Description stringOptional The description of the device posture rule. Link to this property Enabled boolOptional Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue\_count input, and true otherwise. Link to this property Expiration stringOptional Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. Link to this property Input DeviceInputOptional The value to be checked against. Link to this property
Match \[]DeviceMatchOptional The conditions that the client must match to run the rule.
Platform DeviceMatchPlatformOptional One of the following: const DeviceMatchPlatformWindows DeviceMatchPlatform = "windows" Link to this property const DeviceMatchPlatformMac DeviceMatchPlatform = "mac" Link to this property const DeviceMatchPlatformLinux DeviceMatchPlatform = "linux" Link to this property const DeviceMatchPlatformAndroid DeviceMatchPlatform = "android" Link to this property const DeviceMatchPlatformIos DeviceMatchPlatform = "ios" Link to this property const DeviceMatchPlatformChromeos DeviceMatchPlatform = "chromeos" Link to this property
Link to this property
Link to this property Name stringOptional The name of the device posture rule. Link to this property Schedule stringOptional Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m. Link to this property
Type DevicePostureRuleTypeOptional The type of device posture rule. One of the following: const DevicePostureRuleTypeFile DevicePostureRuleType = "file" Link to this property const DevicePostureRuleTypeApplication DevicePostureRuleType = "application" Link to this property const DevicePostureRuleTypeTanium DevicePostureRuleType = "tanium" Link to this property const DevicePostureRuleTypeGateway DevicePostureRuleType = "gateway" Link to this property const DevicePostureRuleTypeWARP DevicePostureRuleType = "warp" Link to this property const DevicePostureRuleTypeDiskEncryption DevicePostureRuleType = "disk\_encryption" Link to this property const DevicePostureRuleTypeSerialNumber DevicePostureRuleType = "serial\_number" Link to this property const DevicePostureRuleTypeSentinelone DevicePostureRuleType = "sentinelone" Link to this property const DevicePostureRuleTypeCarbonblack DevicePostureRuleType = "carbonblack" Link to this property const DevicePostureRuleTypeFirewall DevicePostureRuleType = "firewall" Link to this property const DevicePostureRuleTypeOSVersion DevicePostureRuleType = "os\_version" Link to this property const DevicePostureRuleTypeDomainJoined DevicePostureRuleType = "domain\_joined" Link to this property const DevicePostureRuleTypeClientCertificate DevicePostureRuleType = "client\_certificate" Link to this property const DevicePostureRuleTypeClientCertificateV2 DevicePostureRuleType = "client\_certificate\_v2" Link to this property const DevicePostureRuleTypeAntivirus DevicePostureRuleType = "antivirus" Link to this property const DevicePostureRuleTypeUniqueClientID DevicePostureRuleType = "unique\_client\_id" Link to this property const DevicePostureRuleTypeKolide DevicePostureRuleType = "kolide" Link to this property const DevicePostureRuleTypeTaniumS2s DevicePostureRuleType = "tanium\_s2s" Link to this property const DevicePostureRuleTypeCrowdstrikeS2s DevicePostureRuleType = "crowdstrike\_s2s" Link to this property const DevicePostureRuleTypeIntune DevicePostureRuleType = "intune" Link to this property const DevicePostureRuleTypeWorkspaceOne DevicePostureRuleType = "workspace\_one" Link to this property const DevicePostureRuleTypeSentineloneS2s DevicePostureRuleType = "sentinelone\_s2s" Link to this property const DevicePostureRuleTypeCustomS2s DevicePostureRuleType = "custom\_s2s" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_posture_rule%20%3E%20(schema)>)
type DiskEncryptionInput struct{…} CheckDisks \[]CarbonblackInputOptional List of volume names to be checked for encryption. Link to this property RequireAll boolOptional Whether to check all disks for encryption. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20disk_encryption_input%20%3E%20(schema)>)
type DomainJoinedInput struct{…} OperatingSystem DomainJoinedInputOperatingSystem Operating System. Link to this property Domain stringOptional Domain. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20domain_joined_input%20%3E%20(schema)>)
type FileInput struct{…}
OperatingSystem FileInputOperatingSystem Operating system. One of the following: const FileInputOperatingSystemWindows FileInputOperatingSystem = "windows" Link to this property const FileInputOperatingSystemLinux FileInputOperatingSystem = "linux" Link to this property const FileInputOperatingSystemMac FileInputOperatingSystem = "mac" Link to this property
Link to this property Path string File path. Link to this property Exists boolOptional Whether or not file exists. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20file_input%20%3E%20(schema)>)
type FirewallInput struct{…} Enabled bool Enabled. Link to this property
OperatingSystem FirewallInputOperatingSystem Operating System. One of the following: const FirewallInputOperatingSystemWindows FirewallInputOperatingSystem = "windows" Link to this property const FirewallInputOperatingSystemMac FirewallInputOperatingSystem = "mac" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20firewall_input%20%3E%20(schema)>)
type IntuneInput struct{…}
ComplianceStatus IntuneInputComplianceStatus Compliance Status. One of the following: const IntuneInputComplianceStatusCompliant IntuneInputComplianceStatus = "compliant" Link to this property const IntuneInputComplianceStatusNoncompliant IntuneInputComplianceStatus = "noncompliant" Link to this property const IntuneInputComplianceStatusUnknown IntuneInputComplianceStatus = "unknown" Link to this property const IntuneInputComplianceStatusNotapplicable IntuneInputComplianceStatus = "notapplicable" Link to this property const IntuneInputComplianceStatusIngraceperiod IntuneInputComplianceStatus = "ingraceperiod" Link to this property const IntuneInputComplianceStatusError IntuneInputComplianceStatus = "error" Link to this property
Link to this property ConnectionID string Posture Integration ID. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20intune_input%20%3E%20(schema)>)
type KolideInput struct{…} ConnectionID string Posture Integration ID. Link to this property
AuthState \[]KolideInputAuthStateOptional The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. One of the following: const KolideInputAuthStateGood KolideInputAuthState = "Good" Link to this property const KolideInputAuthStateNotified KolideInputAuthState = "Notified" Link to this property const KolideInputAuthStateWillBlock KolideInputAuthState = "Will Block" Link to this property const KolideInputAuthStateBlocked KolideInputAuthState = "Blocked" Link to this property
Link to this property
CountOperator KolideInputCountOperatorOptional Count Operator. One of the following: const KolideInputCountOperatorLess KolideInputCountOperator = "<" Link to this property const KolideInputCountOperatorLessOrEquals KolideInputCountOperator = "<=" Link to this property const KolideInputCountOperatorGreater KolideInputCountOperator = ">" Link to this property const KolideInputCountOperatorGreaterOrEquals KolideInputCountOperator = ">=" Link to this property const KolideInputCountOperatorEquals KolideInputCountOperator = "==" Link to this property
Link to this property IssueCount stringOptional The Number of Issues. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20kolide_input%20%3E%20(schema)>)
type OSVersionInput struct{…} OperatingSystem OSVersionInputOperatingSystem Operating System. Link to this property
Operator OSVersionInputOperator Operator. One of the following: const OSVersionInputOperatorLess OSVersionInputOperator = "<" Link to this property const OSVersionInputOperatorLessOrEquals OSVersionInputOperator = "<=" Link to this property const OSVersionInputOperatorGreater OSVersionInputOperator = ">" Link to this property const OSVersionInputOperatorGreaterOrEquals OSVersionInputOperator = ">=" Link to this property const OSVersionInputOperatorEquals OSVersionInputOperator = "==" Link to this property
Link to this property Version string Version of OS. Link to this property OSDistroName stringOptional Operating System Distribution Name (linux only). Link to this property OSDistroRevision stringOptional Version of OS Distribution (linux only). Link to this property OSVersionExtra stringOptional Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20os_version_input%20%3E%20(schema)>)
type SentineloneInput struct{…}
OperatingSystem SentineloneInputOperatingSystem Operating system. One of the following: const SentineloneInputOperatingSystemWindows SentineloneInputOperatingSystem = "windows" Link to this property const SentineloneInputOperatingSystemLinux SentineloneInputOperatingSystem = "linux" Link to this property const SentineloneInputOperatingSystemMac SentineloneInputOperatingSystem = "mac" Link to this property
Link to this property Path string File path. Link to this property Sha256 stringOptional SHA-256. Link to this property Thumbprint stringOptional Signing certificate thumbprint. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_input%20%3E%20(schema)>)
type SentineloneS2sInput struct{…} ConnectionID string Posture Integration ID. Link to this property ActiveThreats float64Optional The Number of active threats. Link to this property Infected boolOptional Whether device is infected. Link to this property IsActive boolOptional Whether device is active. Link to this property
NetworkStatus SentineloneS2sInputNetworkStatusOptional Network status of device. One of the following: const SentineloneS2sInputNetworkStatusConnected SentineloneS2sInputNetworkStatus = "connected" Link to this property const SentineloneS2sInputNetworkStatusDisconnected SentineloneS2sInputNetworkStatus = "disconnected" Link to this property const SentineloneS2sInputNetworkStatusDisconnecting SentineloneS2sInputNetworkStatus = "disconnecting" Link to this property const SentineloneS2sInputNetworkStatusConnecting SentineloneS2sInputNetworkStatus = "connecting" Link to this property
Link to this property
OperationalState SentineloneS2sInputOperationalStateOptional Agent operational state. One of the following: const SentineloneS2sInputOperationalStateNa SentineloneS2sInputOperationalState = "na" Link to this property const SentineloneS2sInputOperationalStatePartiallyDisabled SentineloneS2sInputOperationalState = "partially\_disabled" Link to this property const SentineloneS2sInputOperationalStateAutoFullyDisabled SentineloneS2sInputOperationalState = "auto\_fully\_disabled" Link to this property const SentineloneS2sInputOperationalStateFullyDisabled SentineloneS2sInputOperationalState = "fully\_disabled" Link to this property const SentineloneS2sInputOperationalStateAutoPartiallyDisabled SentineloneS2sInputOperationalState = "auto\_partially\_disabled" Link to this property const SentineloneS2sInputOperationalStateDisabledError SentineloneS2sInputOperationalState = "disabled\_error" Link to this property const SentineloneS2sInputOperationalStateDBCorruption SentineloneS2sInputOperationalState = "db\_corruption" Link to this property
Link to this property
Operator SentineloneS2sInputOperatorOptional Operator. One of the following: const SentineloneS2sInputOperatorLess SentineloneS2sInputOperator = "<" Link to this property const SentineloneS2sInputOperatorLessOrEquals SentineloneS2sInputOperator = "<=" Link to this property const SentineloneS2sInputOperatorGreater SentineloneS2sInputOperator = ">" Link to this property const SentineloneS2sInputOperatorGreaterOrEquals SentineloneS2sInputOperator = ">=" Link to this property const SentineloneS2sInputOperatorEquals SentineloneS2sInputOperator = "==" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_s2s_input%20%3E%20(schema)>)
type TaniumInput struct{…} ConnectionID string Posture Integration ID. Link to this property EidLastSeen stringOptional For more details on eid last seen, refer to the Tanium documentation. Link to this property
Operator TaniumInputOperatorOptional Operator to evaluate risk\_level or eid\_last\_seen. One of the following: const TaniumInputOperatorLess TaniumInputOperator = "<" Link to this property const TaniumInputOperatorLessOrEquals TaniumInputOperator = "<=" Link to this property const TaniumInputOperatorGreater TaniumInputOperator = ">" Link to this property const TaniumInputOperatorGreaterOrEquals TaniumInputOperator = ">=" Link to this property const TaniumInputOperatorEquals TaniumInputOperator = "==" Link to this property
Link to this property
RiskLevel TaniumInputRiskLevelOptional For more details on risk level, refer to the Tanium documentation. One of the following: const TaniumInputRiskLevelLow TaniumInputRiskLevel = "low" Link to this property const TaniumInputRiskLevelMedium TaniumInputRiskLevel = "medium" Link to this property const TaniumInputRiskLevelHigh TaniumInputRiskLevel = "high" Link to this property const TaniumInputRiskLevelCritical TaniumInputRiskLevel = "critical" Link to this property
Link to this property
ScoreOperator TaniumInputScoreOperatorOptional Score Operator. One of the following: const TaniumInputScoreOperatorLess TaniumInputScoreOperator = "<" Link to this property const TaniumInputScoreOperatorLessOrEquals TaniumInputScoreOperator = "<=" Link to this property const TaniumInputScoreOperatorGreater TaniumInputScoreOperator = ">" Link to this property const TaniumInputScoreOperatorGreaterOrEquals TaniumInputScoreOperator = ">=" Link to this property const TaniumInputScoreOperatorEquals TaniumInputScoreOperator = "==" Link to this property
Link to this property TotalScore float64Optional For more details on total score, refer to the Tanium documentation. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20tanium_input%20%3E%20(schema)>)
type UniqueClientIDInput struct{…} ID string List ID. Link to this property
OperatingSystem UniqueClientIDInputOperatingSystem Operating System. One of the following: const UniqueClientIDInputOperatingSystemAndroid UniqueClientIDInputOperatingSystem = "android" Link to this property const UniqueClientIDInputOperatingSystemIos UniqueClientIDInputOperatingSystem = "ios" Link to this property const UniqueClientIDInputOperatingSystemChromeos UniqueClientIDInputOperatingSystem = "chromeos" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20unique_client_id_input%20%3E%20(schema)>)
type WorkspaceOneInput struct{…}
ComplianceStatus WorkspaceOneInputComplianceStatus Compliance Status. One of the following: const WorkspaceOneInputComplianceStatusCompliant WorkspaceOneInputComplianceStatus = "compliant" Link to this property const WorkspaceOneInputComplianceStatusNoncompliant WorkspaceOneInputComplianceStatus = "noncompliant" Link to this property const WorkspaceOneInputComplianceStatusUnknown WorkspaceOneInputComplianceStatus = "unknown" Link to this property
Link to this property ConnectionID string Posture Integration ID. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20workspace_one_input%20%3E%20(schema)>) #### Zero TrustDevicesPostureIntegrations ##### [List posture integrations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/list) client.ZeroTrust.Devices.Posture.Integrations.List(ctx, query) (\*SinglePage\[[Integration]()], error) GET/accounts/{account\_id}/devices/posture/integration ##### [Get posture integration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/get) client.ZeroTrust.Devices.Posture.Integrations.Get(ctx, integrationID, query) (\*[Integration](), error) GET/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### [Create posture integration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/create) client.ZeroTrust.Devices.Posture.Integrations.New(ctx, params) (\*[Integration](), error) POST/accounts/{account\_id}/devices/posture/integration ##### [Update posture integration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/edit) client.ZeroTrust.Devices.Posture.Integrations.Edit(ctx, integrationID, params) (\*[Integration](), error) PATCH/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### [Delete posture integration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/delete) client.ZeroTrust.Devices.Posture.Integrations.Delete(ctx, integrationID, body) (\*unknown, error) DELETE/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### ModelsExpand Collapse
type Integration struct{…} ID stringOptional API UUID. maxLength36 Link to this property
Config IntegrationConfigOptional The configuration object containing third-party integration information. APIURL string The Workspace One API URL provided in the Workspace One Admin Dashboard. Link to this property AuthURL string The Workspace One Authorization URL depending on your region. Link to this property ClientID string The Workspace One client ID provided in the Workspace One Admin Dashboard. Link to this property
Link to this property Interval stringOptional The interval between each posture check with the third-party API. Use m for minutes (e.g. 5m) and h for hours (e.g. 12h). Link to this property Name stringOptional The name of the device posture integration. Link to this property
Type IntegrationTypeOptional The type of device posture integration. One of the following: const IntegrationTypeWorkspaceOne IntegrationType = "workspace\_one" Link to this property const IntegrationTypeCrowdstrikeS2s IntegrationType = "crowdstrike\_s2s" Link to this property const IntegrationTypeUptycs IntegrationType = "uptycs" Link to this property const IntegrationTypeIntune IntegrationType = "intune" Link to this property const IntegrationTypeKolide IntegrationType = "kolide" Link to this property const IntegrationTypeTaniumS2s IntegrationType = "tanium\_s2s" Link to this property const IntegrationTypeSentineloneS2s IntegrationType = "sentinelone\_s2s" Link to this property const IntegrationTypeCustomS2s IntegrationType = "custom\_s2s" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture.integrations%20%3E%20(model)%20integration%20%3E%20(schema)>) #### Zero TrustDevicesRevoke ##### [Revoke devices (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/revoke/methods/create) Deprecated client.ZeroTrust.Devices.Revoke.New(ctx, params) (\*unknown, error) POST/accounts/{account\_id}/devices/revoke #### Zero TrustDevicesSettings ##### [Get device settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/settings/methods/get) client.ZeroTrust.Devices.Settings.Get(ctx, query) (\*[DeviceSettings](), error) GET/accounts/{account\_id}/devices/settings ##### [Update device settings (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/settings/methods/update) Deprecated client.ZeroTrust.Devices.Settings.Update(ctx, params) (\*[DeviceSettings](), error) PUT/accounts/{account\_id}/devices/settings ##### [Update device settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/settings/methods/edit) client.ZeroTrust.Devices.Settings.Edit(ctx, params) (\*[DeviceSettings](), error) PATCH/accounts/{account\_id}/devices/settings ##### [Reset device settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/settings/methods/delete) client.ZeroTrust.Devices.Settings.Delete(ctx, body) (\*[DeviceSettings](), error) DELETE/accounts/{account\_id}/devices/settings ##### ModelsExpand Collapse
type DeviceSettings struct{…} DisableForTime float64Optional Sets the time limit, in seconds, that a user can use an override code to bypass WARP. Link to this property ExternalEmergencySignalEnabled boolOptional Controls whether the external emergency disconnect feature is enabled. Link to this property ExternalEmergencySignalFingerprint stringOptional The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external\_emergency\_signal\_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value. Link to this property ExternalEmergencySignalInterval stringOptional The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds. Link to this property ExternalEmergencySignalURL stringOptional The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host. Link to this property GatewayProxyEnabled boolOptional Enable gateway proxy filtering on TCP. Link to this property GatewayUdpProxyEnabled boolOptional Enable gateway proxy filtering on UDP. Link to this property RootCertificateInstallationEnabled boolOptional Enable installation of cloudflare managed root certificate. Link to this property UseZtVirtualIP boolOptional Enable using CGNAT virtual IPv4. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.settings%20%3E%20(model)%20device_settings%20%3E%20(schema)>) #### Zero TrustDevicesUnrevoke ##### [Unrevoke devices (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/unrevoke/methods/create) Deprecated client.ZeroTrust.Devices.Unrevoke.New(ctx, params) (\*unknown, error) POST/accounts/{account\_id}/devices/unrevoke #### Zero TrustDevicesOverride Codes ##### [Get override codes (deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/override_codes/methods/list) Deprecated client.ZeroTrust.Devices.OverrideCodes.List(ctx, deviceID, query) (\*[DeviceOverrideCodeListResponse](), error) GET/accounts/{account\_id}/devices/{device\_id}/override\_codes ##### [Get override codes](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/devices/subresources/override_codes/methods/get) client.ZeroTrust.Devices.OverrideCodes.Get(ctx, registrationID, query) (\*[DeviceOverrideCodeGetResponse](), error) GET/accounts/{account\_id}/devices/registrations/{registration\_id}/override\_codes #### Zero TrustIdentity Providers ##### [List Access identity providers](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/methods/list) client.ZeroTrust.IdentityProviders.List(ctx, params) (\*V4PagePaginationArray\[[IdentityProviderListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Get an Access identity provider](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/methods/get) client.ZeroTrust.IdentityProviders.Get(ctx, identityProviderID, query) (\*[IdentityProvider](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Add an Access identity provider](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/methods/create) client.ZeroTrust.IdentityProviders.New(ctx, params) (\*[IdentityProvider](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Update an Access identity provider](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/methods/update) client.ZeroTrust.IdentityProviders.Update(ctx, identityProviderID, params) (\*[IdentityProvider](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Delete an Access identity provider](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/methods/delete) client.ZeroTrust.IdentityProviders.Delete(ctx, identityProviderID, body) (\*[IdentityProviderDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### ModelsExpand Collapse
type AzureAD struct{…}
Config AzureADConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property ConditionalAccessEnabled boolOptional Should Cloudflare try to load authentication contexts from your account Link to this property DirectoryID stringOptional Your Azure directory uuid Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property
Prompt AzureADConfigPromptOptional Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: const AzureADConfigPromptLogin AzureADConfigPrompt = "login" Link to this property const AzureADConfigPromptSelectAccount AzureADConfigPrompt = "select\_account" Link to this property const AzureADConfigPromptNone AzureADConfigPrompt = "none" Link to this property
Link to this property SupportGroups boolOptional Should Cloudflare try to load groups from your account Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet AzureADSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate AzureADSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20azure_ad%20%3E%20(schema)>)
type GenericOAuthConfig struct{…} ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20generic_oauth_config%20%3E%20(schema)>)
type IdentityProvider interface{…} One of the following:
type AzureAD struct{…}
Config AzureADConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property ConditionalAccessEnabled boolOptional Should Cloudflare try to load authentication contexts from your account Link to this property DirectoryID stringOptional Your Azure directory uuid Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property
Prompt AzureADConfigPromptOptional Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: const AzureADConfigPromptLogin AzureADConfigPrompt = "login" Link to this property const AzureADConfigPromptSelectAccount AzureADConfigPrompt = "select\_account" Link to this property const AzureADConfigPromptNone AzureADConfigPrompt = "none" Link to this property
Link to this property SupportGroups boolOptional Should Cloudflare try to load groups from your account Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet AzureADSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate AzureADSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessCentrify struct{…}
Config IdentityProviderAccessCentrifyConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. CentrifyAccount stringOptional Your centrify account url Link to this property CentrifyAppID stringOptional Your centrify app id Link to this property Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessCentrifySAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessCentrifySAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessFacebook struct{…} Config GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessFacebookSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessFacebookSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessGitHub struct{…} Config GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessGitHubSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessGitHubSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessGoogle struct{…}
Config IdentityProviderAccessGoogleConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessGoogleSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessGoogleSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessGoogleApps struct{…}
Config IdentityProviderAccessGoogleAppsConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. AppsDomain stringOptional Your companies TLD Link to this property Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property
Prompt IdentityProviderAccessGoogleAppsConfigPromptOptional Configures the prompt behavior for Google authentication. One of the following: const IdentityProviderAccessGoogleAppsConfigPromptNone IdentityProviderAccessGoogleAppsConfigPrompt = "none" Link to this property const IdentityProviderAccessGoogleAppsConfigPromptConsent IdentityProviderAccessGoogleAppsConfigPrompt = "consent" Link to this property const IdentityProviderAccessGoogleAppsConfigPromptSelectAccount IdentityProviderAccessGoogleAppsConfigPrompt = "select\_account" Link to this property
Link to this property UseLoginHint boolOptional Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessGoogleAppsSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessGoogleAppsSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessLinkedin struct{…} Config GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessLinkedinSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessLinkedinSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessOIDC struct{…}
Config IdentityProviderAccessOIDCConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. AuthURL stringOptional The authorization\_endpoint URL of your IdP Link to this property CERTsURL stringOptional The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property PKCEEnabled boolOptional Enable Proof Key for Code Exchange (PKCE) Link to this property Scopes \[]stringOptional OAuth scopes Link to this property TokenURL stringOptional The token\_endpoint URL of your IdP Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessOIDCSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessOIDCSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessOkta struct{…}
Config IdentityProviderAccessOktaConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. AuthorizationServerID stringOptional Your okta authorization server id Link to this property Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property OktaAccount stringOptional Your okta account url Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessOktaSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessOktaSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessOnelogin struct{…}
Config IdentityProviderAccessOneloginConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property OneloginAccount stringOptional Your OneLogin account url Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessOneloginSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessOneloginSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessPingone struct{…}
Config IdentityProviderAccessPingoneConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Claims \[]stringOptional Custom claims Link to this property ClientID stringOptional Your OAuth Client ID Link to this property ClientSecret stringOptional Your OAuth Client Secret Link to this property EmailClaimName stringOptional The claim name for email in the id\_token response. Link to this property PingEnvID stringOptional Your PingOne environment identifier Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessPingoneSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessPingoneSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessSAML struct{…}
Config IdentityProviderAccessSAMLConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Attributes \[]stringOptional A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property EmailAttributeName stringOptional The attribute name for email in the SAML response. Link to this property EnableEncryption boolOptional Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property ForceAuthn boolOptional Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property
HeaderAttributes \[]IdentityProviderAccessSAMLConfigHeaderAttributeOptional Add a list of attribute names that will be returned in the response header from the Access callback. AttributeName stringOptional attribute name from the IDP Link to this property HeaderName stringOptional header that will be added on the request to the origin Link to this property
Link to this property IdPPublicCERTs \[]stringOptional X509 certificate to verify the signature in the SAML authentication response Link to this property IssuerURL stringOptional IdP Entity ID or Issuer URL Link to this property MaxSSOURLLength int64Optional The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property SignRequest boolOptional Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property SSOTargetURL stringOptional URL to send the SAML authentication requests to Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessSAMLSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessSAMLSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessYandex struct{…} Config GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessYandexSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessYandexSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessOnetimepin struct{…}
Config IdentityProviderAccessOnetimepinConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. RedirectURL stringOptional Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessOnetimepinSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessOnetimepinSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessCloudflare struct{…}
Config IdentityProviderAccessCloudflareConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. RedirectURL stringOptional Link to this property RestrictToAccountMembers boolOptional When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessCloudflareSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessCloudflareSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
type IdentityProviderAccessPasskeys struct{…}
Config IdentityProviderAccessPasskeysConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. LoginPageAutoPrompt boolOptional When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property RedirectURL stringOptional Link to this property
Link to this property Name string The name of the identity provider, shown to users on the login page. Link to this property Type IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property ID stringOptional UUID. maxLength36 Link to this property ReadOnly boolOptional Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
SAMLCertificateSet IdentityProviderAccessPasskeysSAMLCertificateSetOptional The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. CreatedAt Time Timestamp when the certificate set was created formatdate-time Link to this property UID string Unique identifier for the certificate set formatuuid Link to this property UpdatedAt Time Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
CurrentCertificate IdentityProviderAccessPasskeysSAMLCertificateSetCurrentCertificateOptional The currently active certificate used for encrypting SAML assertions IsCurrent bool Indicates whether this is the currently active certificate Link to this property NotAfter Time Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property PublicCertificate string PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property UID string Unique identifier for the certificate formatuuid Link to this property
Link to this property PreviousCertificate unknownOptional The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property SAMLCertificateSetID stringOptional The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property SCIMConfig IdentityProviderSCIMConfigOptional The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider%20%3E%20(schema)>)
type IdentityProviderSCIMConfig struct{…} The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Enabled boolOptional A flag to enable or disable SCIM for the identity provider. Link to this property
IdentityUpdateBehavior IdentityProviderSCIMConfigIdentityUpdateBehaviorOptional Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no\_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. One of the following: const IdentityProviderSCIMConfigIdentityUpdateBehaviorAutomatic IdentityProviderSCIMConfigIdentityUpdateBehavior = "automatic" Link to this property const IdentityProviderSCIMConfigIdentityUpdateBehaviorReauth IdentityProviderSCIMConfigIdentityUpdateBehavior = "reauth" Link to this property const IdentityProviderSCIMConfigIdentityUpdateBehaviorNoAction IdentityProviderSCIMConfigIdentityUpdateBehavior = "no\_action" Link to this property
Link to this property SCIMBaseURL stringOptional The base URL of Cloudflare’s SCIM V2.0 API endpoint. Link to this property SeatDeprovision boolOptional A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user\_deprovision is also enabled. Link to this property Secret stringOptional A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity\_providers/:idpID/refresh\_scim\_secret. Link to this property UserDeprovision boolOptional A flag to enable revoking a user’s session in Access and Gateway when they have been deprovisioned in the Identity Provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_scim_config%20%3E%20(schema)>)
type IdentityProviderType string The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. One of the following: const IdentityProviderTypeOnetimepin IdentityProviderType = "onetimepin" Link to this property const IdentityProviderTypeAzureAD IdentityProviderType = "azureAD" Link to this property const IdentityProviderTypeSAML IdentityProviderType = "saml" Link to this property const IdentityProviderTypeCentrify IdentityProviderType = "centrify" Link to this property const IdentityProviderTypeFacebook IdentityProviderType = "facebook" Link to this property const IdentityProviderTypeGitHub IdentityProviderType = "github" Link to this property const IdentityProviderTypeGoogleApps IdentityProviderType = "google-apps" Link to this property const IdentityProviderTypeGoogle IdentityProviderType = "google" Link to this property const IdentityProviderTypeLinkedin IdentityProviderType = "linkedin" Link to this property const IdentityProviderTypeOIDC IdentityProviderType = "oidc" Link to this property const IdentityProviderTypeOkta IdentityProviderType = "okta" Link to this property const IdentityProviderTypeOnelogin IdentityProviderType = "onelogin" Link to this property const IdentityProviderTypePingone IdentityProviderType = "pingone" Link to this property const IdentityProviderTypeYandex IdentityProviderType = "yandex" Link to this property const IdentityProviderTypeCloudflare IdentityProviderType = "cloudflare" Link to this property const IdentityProviderTypePasskeys IdentityProviderType = "passkeys" Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_type%20%3E%20(schema)>) #### Zero TrustIdentity ProvidersSCIM #### Zero TrustIdentity ProvidersSCIMGroups ##### [List SCIM Group resources](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/groups/methods/list) client.ZeroTrust.IdentityProviders.SCIM.Groups.List(ctx, identityProviderID, params) (\*V4PagePaginationArray\[[ZeroTrustGroup]()], error) GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/groups #### Zero TrustIdentity ProvidersSCIMUsers ##### [List SCIM User resources](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/users/methods/list) client.ZeroTrust.IdentityProviders.SCIM.Users.List(ctx, identityProviderID, params) (\*V4PagePaginationArray\[[AccessUser]()], error) GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/users #### Zero TrustIdentity ProvidersSAML Certificate ##### [Create SAML encryption certificate for Identity Provider](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/identity_providers/subresources/saml_certificate/methods/create) client.ZeroTrust.IdentityProviders.SAMLCertificate.New(ctx, identityProviderID, body) (\*[IdentityProviderSAMLCertificateNewResponse](), error) POST/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/saml\_certificate #### Zero TrustOrganizations ##### [Get your Zero Trust organization](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/methods/list) client.ZeroTrust.Organizations.List(ctx, query) (\*[OrganizationListResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Create your Zero Trust organization](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/methods/create) client.ZeroTrust.Organizations.New(ctx, params) (\*[Organization](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Update your Zero Trust organization](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/methods/update) client.ZeroTrust.Organizations.Update(ctx, params) (\*[Organization](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Revoke all Access tokens for a user](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/methods/revoke_users) client.ZeroTrust.Organizations.RevokeUsers(ctx, params) (\*[OrganizationRevokeUsersResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations/revoke\_user ##### ModelsExpand Collapse
type LoginDesign struct{…} BackgroundColor stringOptional The background color on your login page. Link to this property FooterText stringOptional The text at the bottom of your login page. Link to this property HeaderText stringOptional The text at the top of your login page. Link to this property LogoPath stringOptional The URL of the logo on your login page. Link to this property TextColor stringOptional The text color on your login page. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20login_design%20%3E%20(schema)>)
type Organization struct{…} AllowAuthenticateViaWARP boolOptional When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property AuthDomain stringOptional The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. Link to this property
CustomPages OrganizationCustomPagesOptional Forbidden stringOptional The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property IdentityDenied stringOptional The uid of the custom page to use when a user is denied access. Link to this property
Link to this property DenyUnmatchedRequests boolOptional Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property DenyUnmatchedRequestsExemptedZoneNames \[]stringOptional Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property IsUIReadOnly boolOptional Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property LoginDesign LoginDesignOptional Link to this property
MfaConfig OrganizationMfaConfigOptional Configures multi-factor authentication (MFA) settings for an organization.
AllowedAuthenticators \[]OrganizationMfaConfigAllowedAuthenticatorOptional Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: const OrganizationMfaConfigAllowedAuthenticatorTotp OrganizationMfaConfigAllowedAuthenticator = "totp" Link to this property const OrganizationMfaConfigAllowedAuthenticatorBiometrics OrganizationMfaConfigAllowedAuthenticator = "biometrics" Link to this property const OrganizationMfaConfigAllowedAuthenticatorSecurityKey OrganizationMfaConfigAllowedAuthenticator = "security\_key" Link to this property const OrganizationMfaConfigAllowedAuthenticatorPivKey OrganizationMfaConfigAllowedAuthenticator = "piv\_key" Link to this property const OrganizationMfaConfigAllowedAuthenticatorSSHFido2Key OrganizationMfaConfigAllowedAuthenticator = "ssh\_fido2\_key" Link to this property
Link to this property AmrMatchingSessionDuration stringOptional Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property RequiredAaguids stringOptional Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property SessionDuration stringOptional Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
MfaPivKeyRequirements OrganizationMfaPivKeyRequirementsOptional Configures PIV key requirements for MFA using hardware security keys.
PinPolicy OrganizationMfaPivKeyRequirementsPinPolicyOptional Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: const OrganizationMfaPivKeyRequirementsPinPolicyNever OrganizationMfaPivKeyRequirementsPinPolicy = "never" Link to this property const OrganizationMfaPivKeyRequirementsPinPolicyOnce OrganizationMfaPivKeyRequirementsPinPolicy = "once" Link to this property const OrganizationMfaPivKeyRequirementsPinPolicyAlways OrganizationMfaPivKeyRequirementsPinPolicy = "always" Link to this property
Link to this property RequireFipsDevice boolOptional Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
SSHKeySize \[]OrganizationMfaPivKeyRequirementsSSHKeySizeOptional Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: const OrganizationMfaPivKeyRequirementsSSHKeySize256 OrganizationMfaPivKeyRequirementsSSHKeySize = 256 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize384 OrganizationMfaPivKeyRequirementsSSHKeySize = 384 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize521 OrganizationMfaPivKeyRequirementsSSHKeySize = 521 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize2048 OrganizationMfaPivKeyRequirementsSSHKeySize = 2048 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize3072 OrganizationMfaPivKeyRequirementsSSHKeySize = 3072 Link to this property const OrganizationMfaPivKeyRequirementsSSHKeySize4096 OrganizationMfaPivKeyRequirementsSSHKeySize = 4096 Link to this property
Link to this property
SSHKeyType \[]OrganizationMfaPivKeyRequirementsSSHKeyTypeOptional Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: const OrganizationMfaPivKeyRequirementsSSHKeyTypeEcdsa OrganizationMfaPivKeyRequirementsSSHKeyType = "ecdsa" Link to this property const OrganizationMfaPivKeyRequirementsSSHKeyTypeEd25519 OrganizationMfaPivKeyRequirementsSSHKeyType = "ed25519" Link to this property const OrganizationMfaPivKeyRequirementsSSHKeyTypeRSA OrganizationMfaPivKeyRequirementsSSHKeyType = "rsa" Link to this property
Link to this property
TouchPolicy OrganizationMfaPivKeyRequirementsTouchPolicyOptional Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: const OrganizationMfaPivKeyRequirementsTouchPolicyNever OrganizationMfaPivKeyRequirementsTouchPolicy = "never" Link to this property const OrganizationMfaPivKeyRequirementsTouchPolicyAlways OrganizationMfaPivKeyRequirementsTouchPolicy = "always" Link to this property const OrganizationMfaPivKeyRequirementsTouchPolicyCached OrganizationMfaPivKeyRequirementsTouchPolicy = "cached" Link to this property
Link to this property
Link to this property MfaRequiredForAllApps boolOptional Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property Name stringOptional The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
ServiceTokenInactivity OrganizationServiceTokenInactivityOptional Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
Action OrganizationServiceTokenInactivityAction The action applied to an inactive service token. One of the following: const OrganizationServiceTokenInactivityActionDisable OrganizationServiceTokenInactivityAction = "disable" Link to this property const OrganizationServiceTokenInactivityActionDelete OrganizationServiceTokenInactivityAction = "delete" Link to this property
Link to this property Enabled bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property InactivityThresholdDays int64 The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property StrictServiceTokenAuth boolOptional Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property UIReadOnlyToggleReason stringOptional A description of the reason why the UI read only field is being toggled. Link to this property UserSeatExpirationInactiveTime stringOptional The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property WARPAuthNonBrowser401 boolOptional When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property WARPAuthSessionDuration stringOptional The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization%20%3E%20(schema)>) #### Zero TrustOrganizationsDOH ##### [Get your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/subresources/doh/methods/get) client.ZeroTrust.Organizations.DOH.Get(ctx, query) (\*[OrganizationDOHGetResponse](), error) GET/accounts/{account\_id}/access/organizations/doh ##### [Update your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/organizations/subresources/doh/methods/update) client.ZeroTrust.Organizations.DOH.Update(ctx, params) (\*[OrganizationDOHUpdateResponse](), error) PUT/accounts/{account\_id}/access/organizations/doh #### Zero TrustSeats ##### [Update a user seat](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/seats/methods/edit) client.ZeroTrust.Seats.Edit(ctx, params) (\*SinglePage\[[Seat]()], error) PATCH/accounts/{account\_id}/access/seats ##### ModelsExpand Collapse
type Seat struct{…} AccessSeat boolOptional True if the seat is part of Access. Link to this property CreatedAt TimeOptional formatdate-time Link to this property GatewaySeat boolOptional True if the seat is part of Gateway. Link to this property SeatUID stringOptional The unique API identifier for the Zero Trust seat. maxLength36 Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.seats%20%3E%20(model)%20seat%20%3E%20(schema)>) #### Zero TrustAccess #### Zero TrustAccessAI Controls #### Zero TrustAccessAI ControlsMcp #### Zero TrustAccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) client.ZeroTrust.Access.AIControls.Mcp.Portals.List(ctx, params) (\*V4PagePaginationArray\[[AccessAIControlMcpPortalListResponse]()], error) GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) client.ZeroTrust.Access.AIControls.Mcp.Portals.New(ctx, params) (\*[AccessAIControlMcpPortalNewResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) client.ZeroTrust.Access.AIControls.Mcp.Portals.Read(ctx, id, query) (\*[AccessAIControlMcpPortalReadResponse](), error) GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) client.ZeroTrust.Access.AIControls.Mcp.Portals.Update(ctx, id, params) (\*[AccessAIControlMcpPortalUpdateResponse](), error) PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) client.ZeroTrust.Access.AIControls.Mcp.Portals.Delete(ctx, id, body) (\*[AccessAIControlMcpPortalDeleteResponse](), error) DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} #### Zero TrustAccessAI ControlsMcpServers ##### [List MCP Servers](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/list) client.ZeroTrust.Access.AIControls.Mcp.Servers.List(ctx, params) (\*V4PagePaginationArray\[[AccessAIControlMcpServerListResponse]()], error) GET/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Create a new MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/create) client.ZeroTrust.Access.AIControls.Mcp.Servers.New(ctx, params) (\*[AccessAIControlMcpServerNewResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Read the details of an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/read) client.ZeroTrust.Access.AIControls.Mcp.Servers.Read(ctx, id, query) (\*[AccessAIControlMcpServerReadResponse](), error) GET/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Update an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/update) client.ZeroTrust.Access.AIControls.Mcp.Servers.Update(ctx, id, params) (\*[AccessAIControlMcpServerUpdateResponse](), error) PUT/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Delete an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/delete) client.ZeroTrust.Access.AIControls.Mcp.Servers.Delete(ctx, id, body) (\*[AccessAIControlMcpServerDeleteResponse](), error) DELETE/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Sync MCP Server Capabilities](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/sync) client.ZeroTrust.Access.AIControls.Mcp.Servers.Sync(ctx, id, body) (\*[AccessAIControlMcpServerSyncResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/servers/{id}/sync #### Zero TrustAccessGateway CA ##### [List SSH Certificate Authorities (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/list) client.ZeroTrust.Access.GatewayCA.List(ctx, query) (\*SinglePage\[[AccessGatewayCAListResponse]()], error) GET/accounts/{account\_id}/access/gateway\_ca ##### [Add a new SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/create) client.ZeroTrust.Access.GatewayCA.New(ctx, body) (\*[AccessGatewayCANewResponse](), error) POST/accounts/{account\_id}/access/gateway\_ca ##### [Delete an SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/delete) client.ZeroTrust.Access.GatewayCA.Delete(ctx, certificateID, body) (\*[AccessGatewayCADeleteResponse](), error) DELETE/accounts/{account\_id}/access/gateway\_ca/{certificate\_id} #### Zero TrustAccessIdP Federation Grants ##### [List IdP federation grants](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/list) client.ZeroTrust.Access.IdPFederationGrants.List(ctx, query) (\*\[] [IdPFederationGrant](), error) GET/accounts/{account\_id}/access/idp\_federation\_grants ##### [Create an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/create) client.ZeroTrust.Access.IdPFederationGrants.New(ctx, params) (\*[IdPFederationGrant](), error) POST/accounts/{account\_id}/access/idp\_federation\_grants ##### [Get an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/get) client.ZeroTrust.Access.IdPFederationGrants.Get(ctx, grantID, query) (\*[IdPFederationGrant](), error) GET/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### [Delete an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/delete) client.ZeroTrust.Access.IdPFederationGrants.Delete(ctx, grantID, body) (\*[AccessIdPFederationGrantDeleteResponse](), error) DELETE/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### ModelsExpand Collapse
type IdPFederationGrant struct{…} ID string UID of the IdP federation grant. maxLength32 Link to this property IdPID string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant%20%3E%20(schema)>) #### Zero TrustAccessSAML Certificates ##### [List SAML certificate sets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/list) client.ZeroTrust.Access.SAMLCertificates.List(ctx, params) (\*V4PagePaginationArray\[[AccessSAMLCertificateListResponse]()], error) GET/accounts/{account\_id}/access/saml\_certificates ##### [Get SAML certificate set](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get) client.ZeroTrust.Access.SAMLCertificates.Get(ctx, samlCERTSetID, query) (\*[AccessSAMLCertificateGetResponse](), error) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id} ##### [Rotate SAML certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/rotate) client.ZeroTrust.Access.SAMLCertificates.Rotate(ctx, samlCERTSetID, body) (\*[AccessSAMLCertificateRotateResponse](), error) POST/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/rotate ##### [Download current certificate in PEM format](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get_pem) client.ZeroTrust.Access.SAMLCertificates.GetPem(ctx, samlCERTSetID, query) (\*Response, error) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/pem #### Zero TrustAccessInfrastructure #### Zero TrustAccessInfrastructureTargets ##### [List all targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/list) client.ZeroTrust.Access.Infrastructure.Targets.List(ctx, params) (\*V4PagePaginationArray\[[AccessInfrastructureTargetListResponse]()], error) GET/accounts/{account\_id}/infrastructure/targets ##### [Get target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/get) client.ZeroTrust.Access.Infrastructure.Targets.Get(ctx, targetID, query) (\*[AccessInfrastructureTargetGetResponse](), error) GET/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/create) client.ZeroTrust.Access.Infrastructure.Targets.New(ctx, params) (\*[AccessInfrastructureTargetNewResponse](), error) POST/accounts/{account\_id}/infrastructure/targets ##### [Update target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update) client.ZeroTrust.Access.Infrastructure.Targets.Update(ctx, targetID, params) (\*[AccessInfrastructureTargetUpdateResponse](), error) PUT/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Delete target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/delete) client.ZeroTrust.Access.Infrastructure.Targets.Delete(ctx, targetID, body) error DELETE/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_update) client.ZeroTrust.Access.Infrastructure.Targets.BulkUpdate(ctx, params) (\*SinglePage\[[AccessInfrastructureTargetBulkUpdateResponse]()], error) PUT/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets (Deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete) Deprecated client.ZeroTrust.Access.Infrastructure.Targets.BulkDelete(ctx, body) error DELETE/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete_v2) client.ZeroTrust.Access.Infrastructure.Targets.BulkDeleteV2(ctx, params) error POST/accounts/{account\_id}/infrastructure/targets/batch\_delete #### Zero TrustAccessApplications ##### [List Access applications](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/list) client.ZeroTrust.Access.Applications.List(ctx, params) (\*V4PagePaginationArray\[[AccessApplicationListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Get an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/get) client.ZeroTrust.Access.Applications.Get(ctx, appID, query) (\*[AccessApplicationGetResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Add an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/create) client.ZeroTrust.Access.Applications.New(ctx, params) (\*[AccessApplicationNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Update an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/update) client.ZeroTrust.Access.Applications.Update(ctx, appID, params) (\*[AccessApplicationUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Delete an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/delete) client.ZeroTrust.Access.Applications.Delete(ctx, appID, body) (\*[AccessApplicationDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Revoke application tokens](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/revoke_tokens) client.ZeroTrust.Access.Applications.RevokeTokens(ctx, appID, body) (\*[AccessApplicationRevokeTokensResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/revoke\_tokens ##### ModelsExpand Collapse type AllowedHeaders string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_headers%20%3E%20(schema)>) type AllowedIdPs string The identity providers selected for application. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_idps%20%3E%20(schema)>)
type AllowedMethods string One of the following: const AllowedMethodsGet AllowedMethods = "GET" Link to this property const AllowedMethodsPost AllowedMethods = "POST" Link to this property const AllowedMethodsHead AllowedMethods = "HEAD" Link to this property const AllowedMethodsPut AllowedMethods = "PUT" Link to this property const AllowedMethodsDelete AllowedMethods = "DELETE" Link to this property const AllowedMethodsConnect AllowedMethods = "CONNECT" Link to this property const AllowedMethodsOptions AllowedMethods = "OPTIONS" Link to this property const AllowedMethodsTrace AllowedMethods = "TRACE" Link to this property const AllowedMethodsPatch AllowedMethods = "PATCH" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_methods%20%3E%20(schema)>) type AllowedOrigins string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_origins%20%3E%20(schema)>) type AppID string Identifier. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20app_id%20%3E%20(schema)>)
type Application interface{…} One of the following:
ApplicationSelfHostedApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationSelfHostedApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationSelfHostedApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationSaaSApplication ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property
SaaSApp ApplicationSaaSApplicationSaaSAppOptional One of the following:
ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2
AuthType ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeOptional Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeSAML ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthType = "saml" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeOIDC ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthType = "oidc" Link to this property
Link to this property ConsumerServiceURL stringOptional The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property CreatedAt TimeOptional formatdate-time Link to this property
CustomAttributes \[]ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributeOptional FriendlyName stringOptional The SAML FriendlyName of the attribute. Link to this property Name stringOptional The name of the attribute. Link to this property
NameFormat ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatOptional A globally unique name for an identity or service provider. One of the following: const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatUnspecified ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatBasic ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatURI ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property Required boolOptional If the attribute is required when building a SAML assertion. Link to this property
Source ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesSourceOptional Name stringOptional The name of the IdP attribute. Link to this property NameByIdP map\[string, string]Optional A mapping from IdP ID to attribute name. Link to this property
Link to this property
Link to this property IdPEntityID stringOptional The unique identifier for your SaaS application. Link to this property NameIDFormat SaaSAppNameIDFormatOptional The format of the name identifier sent to the SaaS application. Link to this property NameIDTransformJsonata stringOptional A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property SPEntityID stringOptional A globally unique name for an identity or service provider. Link to this property SSOEndpoint stringOptional The endpoint where your SaaS application will send login requests. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2 AccessTokenLifetime stringOptional The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property AllowPKCEWithoutClientSecret boolOptional If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property AppLauncherURL stringOptional The URL where this applications tile redirects users Link to this property
AuthType ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeOptional Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeSAML ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthType = "saml" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeOIDC ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthType = "oidc" Link to this property
Link to this property ClientID stringOptional The application client id Link to this property ClientSecret stringOptional The application client secret, only returned on POST request. Link to this property CreatedAt TimeOptional formatdate-time Link to this property
CustomClaims \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimOptional Name stringOptional The name of the claim. Link to this property Required boolOptional If the claim is required when building an OIDC token. Link to this property
Scope ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeOptional The scope of the claim. One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeGroups ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "groups" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeProfile ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "profile" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeEmail ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "email" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeOpenid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "openid" Link to this property
Link to this property
Source ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsSourceOptional Name stringOptional The name of the IdP claim. Link to this property
NameByIdP \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsSourceNameByIdPOptional A mapping from IdP ID to attribute name. IdPID stringOptional The UID of the IdP. Link to this property SourceName stringOptional The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property
GrantTypes \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeOptional The OIDC flows supported by this application One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeAuthorizationCode ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "authorization\_code" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeAuthorizationCodeWithPKCE ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "authorization\_code\_with\_pkce" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeRefreshTokens ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "refresh\_tokens" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeHybrid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "hybrid" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeImplicit ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "implicit" Link to this property
Link to this property GroupFilterRegex stringOptional A regex to filter Cloudflare groups returned in ID token and userinfo endpoint. Link to this property
HybridAndImplicitOptions ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2HybridAndImplicitOptionsOptional ReturnAccessTokenFromAuthorizationEndpoint boolOptional If an Access Token should be returned from the OIDC Authorization endpoint Link to this property ReturnIDTokenFromAuthorizationEndpoint boolOptional If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property RedirectURIs \[]stringOptional The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
RefreshTokenOptions ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2RefreshTokenOptionsOptional Lifetime stringOptional How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
Scopes \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeOptional Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeOpenid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "openid" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeGroups ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "groups" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeEmail ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "email" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeProfile ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "profile" Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
Link to this property
SCIMConfig ApplicationSaaSApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationSaaSApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property Type stringOptional The application type. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBrowserSSHApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationBrowserSSHApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserSSHApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationBrowserVNCApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationBrowserVNCApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserVNCApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationAppLauncherApplication
Type ApplicationAppLauncherApplicationType The application type. One of the following: const ApplicationAppLauncherApplicationTypeSelfHosted ApplicationAppLauncherApplicationType = "self\_hosted" Link to this property const ApplicationAppLauncherApplicationTypeSaaS ApplicationAppLauncherApplicationType = "saas" Link to this property const ApplicationAppLauncherApplicationTypeSSH ApplicationAppLauncherApplicationType = "ssh" Link to this property const ApplicationAppLauncherApplicationTypeVNC ApplicationAppLauncherApplicationType = "vnc" Link to this property const ApplicationAppLauncherApplicationTypeAppLauncher ApplicationAppLauncherApplicationType = "app\_launcher" Link to this property const ApplicationAppLauncherApplicationTypeWARP ApplicationAppLauncherApplicationType = "warp" Link to this property const ApplicationAppLauncherApplicationTypeBISO ApplicationAppLauncherApplicationType = "biso" Link to this property const ApplicationAppLauncherApplicationTypeBookmark ApplicationAppLauncherApplicationType = "bookmark" Link to this property const ApplicationAppLauncherApplicationTypeDashSSO ApplicationAppLauncherApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationAppLauncherApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationAppLauncherApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplication
Type ApplicationDeviceEnrollmentPermissionsApplicationType The application type. One of the following: const ApplicationDeviceEnrollmentPermissionsApplicationTypeSelfHosted ApplicationDeviceEnrollmentPermissionsApplicationType = "self\_hosted" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeSaaS ApplicationDeviceEnrollmentPermissionsApplicationType = "saas" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeSSH ApplicationDeviceEnrollmentPermissionsApplicationType = "ssh" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeVNC ApplicationDeviceEnrollmentPermissionsApplicationType = "vnc" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeAppLauncher ApplicationDeviceEnrollmentPermissionsApplicationType = "app\_launcher" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeWARP ApplicationDeviceEnrollmentPermissionsApplicationType = "warp" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeBISO ApplicationDeviceEnrollmentPermissionsApplicationType = "biso" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeBookmark ApplicationDeviceEnrollmentPermissionsApplicationType = "bookmark" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeDashSSO ApplicationDeviceEnrollmentPermissionsApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplication
Type ApplicationBrowserIsolationPermissionsApplicationType The application type. One of the following: const ApplicationBrowserIsolationPermissionsApplicationTypeSelfHosted ApplicationBrowserIsolationPermissionsApplicationType = "self\_hosted" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeSaaS ApplicationBrowserIsolationPermissionsApplicationType = "saas" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeSSH ApplicationBrowserIsolationPermissionsApplicationType = "ssh" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeVNC ApplicationBrowserIsolationPermissionsApplicationType = "vnc" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeAppLauncher ApplicationBrowserIsolationPermissionsApplicationType = "app\_launcher" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeWARP ApplicationBrowserIsolationPermissionsApplicationType = "warp" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeBISO ApplicationBrowserIsolationPermissionsApplicationType = "biso" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeBookmark ApplicationBrowserIsolationPermissionsApplicationType = "bookmark" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeDashSSO ApplicationBrowserIsolationPermissionsApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationBrowserIsolationPermissionsApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBookmarkApplication Domain string The URL or domain of the bookmark. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AppLauncherVisible boolOptional Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property CreatedAt TimeOptional formatdate-time Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationBookmarkApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBookmarkApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application%20%3E%20(schema)>)
type ApplicationPolicy struct{…} ID stringOptional The UUID of the policy maxLength36 Link to this property
ApprovalGroups \[]ApprovalGroupOptional Administrators who can approve a temporary authentication request. ApprovalsNeeded float64 The number of approvals needed to obtain access. minimum0 Link to this property EmailAddresses \[]stringOptional A list of emails that can approve the access request. Link to this property EmailListUUID stringOptional The UUID of an re-usable email list. Link to this property
Link to this property ApprovalRequired boolOptional Requires the user to request access from an administrator at the start of each session. Link to this property
ConnectionRules ApplicationPolicyConnectionRulesOptional The rules that define how users may connect to targets secured by your application.
RDP ApplicationPolicyConnectionRulesRDPOptional The RDP-specific rules that define clipboard behavior for RDP connections.
AllowedClipboardLocalToRemoteFormats \[]ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatOptional Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: const ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatText ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormat = "text" Link to this property const ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatFile ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormat = "file" Link to this property
Link to this property
AllowedClipboardRemoteToLocalFormats \[]ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatOptional Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: const ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatText ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormat = "text" Link to this property const ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatFile ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormat = "file" Link to this property
Link to this property
Link to this property
Link to this property CreatedAt TimeOptional formatdate-time Link to this property Decision DecisionOptional The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
Exclude \[]AccessRuleOptional Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
Include \[]AccessRuleOptional Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property IsolationRequired boolOptional Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
MfaConfig ApplicationPolicyMfaConfigOptional Configures multi-factor authentication (MFA) settings.
AllowedAuthenticators \[]ApplicationPolicyMfaConfigAllowedAuthenticatorOptional Lists the MFA methods that users can authenticate with. One of the following: const ApplicationPolicyMfaConfigAllowedAuthenticatorTotp ApplicationPolicyMfaConfigAllowedAuthenticator = "totp" Link to this property const ApplicationPolicyMfaConfigAllowedAuthenticatorBiometrics ApplicationPolicyMfaConfigAllowedAuthenticator = "biometrics" Link to this property const ApplicationPolicyMfaConfigAllowedAuthenticatorSecurityKey ApplicationPolicyMfaConfigAllowedAuthenticator = "security\_key" Link to this property
Link to this property MfaDisabled boolOptional Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property SessionDuration stringOptional Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property Name stringOptional The name of the Access policy. Link to this property PurposeJustificationPrompt stringOptional A custom message that will appear on the purpose justification screen. Link to this property PurposeJustificationRequired boolOptional Require users to enter a justification when they log in to the application. Link to this property
Require \[]AccessRuleOptional Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_policy%20%3E%20(schema)>)
type ApplicationType string The application type. One of the following: const ApplicationTypeSelfHosted ApplicationType = "self\_hosted" Link to this property const ApplicationTypeEndUser ApplicationType = "end\_user" Link to this property const ApplicationTypeSaaS ApplicationType = "saas" Link to this property const ApplicationTypeSSH ApplicationType = "ssh" Link to this property const ApplicationTypeVNC ApplicationType = "vnc" Link to this property const ApplicationTypeAppLauncher ApplicationType = "app\_launcher" Link to this property const ApplicationTypeWARP ApplicationType = "warp" Link to this property const ApplicationTypeBISO ApplicationType = "biso" Link to this property const ApplicationTypeBookmark ApplicationType = "bookmark" Link to this property const ApplicationTypeDashSSO ApplicationType = "dash\_sso" Link to this property const ApplicationTypeInfrastructure ApplicationType = "infrastructure" Link to this property const ApplicationTypeRDP ApplicationType = "rdp" Link to this property const ApplicationTypeMcp ApplicationType = "mcp" Link to this property const ApplicationTypeMcpPortal ApplicationType = "mcp\_portal" Link to this property const ApplicationTypeProxyEndpoint ApplicationType = "proxy\_endpoint" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_type%20%3E%20(schema)>)
type CORSHeaders struct{…} AllowAllHeaders boolOptional Allows all HTTP request headers. Link to this property AllowAllMethods boolOptional Allows all HTTP request methods. Link to this property AllowAllOrigins boolOptional Allows all origins. Link to this property AllowCredentials boolOptional When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests. Link to this property AllowedHeaders \[]AllowedHeadersOptional Allowed HTTP request headers. Link to this property
AllowedMethods \[]AllowedMethodsOptional Allowed HTTP request methods. One of the following: const AllowedMethodsGet AllowedMethods = "GET" Link to this property const AllowedMethodsPost AllowedMethods = "POST" Link to this property const AllowedMethodsHead AllowedMethods = "HEAD" Link to this property const AllowedMethodsPut AllowedMethods = "PUT" Link to this property const AllowedMethodsDelete AllowedMethods = "DELETE" Link to this property const AllowedMethodsConnect AllowedMethods = "CONNECT" Link to this property const AllowedMethodsOptions AllowedMethods = "OPTIONS" Link to this property const AllowedMethodsTrace AllowedMethods = "TRACE" Link to this property const AllowedMethodsPatch AllowedMethods = "PATCH" Link to this property
Link to this property AllowedOrigins \[]AllowedOriginsOptional Allowed origins. Link to this property MaxAge float64Optional The maximum number of seconds the results of a preflight request can be cached. maximum86400 minimum-1 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20cors_headers%20%3E%20(schema)>)
type Decision string The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. One of the following: const DecisionAllow Decision = "allow" Link to this property const DecisionDeny Decision = "deny" Link to this property const DecisionNonIdentity Decision = "non\_identity" Link to this property const DecisionBypass Decision = "bypass" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20decision%20%3E%20(schema)>)
type OIDCSaaSApp struct{…} AccessTokenLifetime stringOptional The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property AllowPKCEWithoutClientSecret boolOptional If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property AppLauncherURL stringOptional The URL where this applications tile redirects users Link to this property
AuthType OIDCSaaSAppAuthTypeOptional Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: const OIDCSaaSAppAuthTypeSAML OIDCSaaSAppAuthType = "saml" Link to this property const OIDCSaaSAppAuthTypeOIDC OIDCSaaSAppAuthType = "oidc" Link to this property
Link to this property ClientID stringOptional The application client id Link to this property ClientSecret stringOptional The application client secret, only returned on POST request. Link to this property
CustomClaims \[]OIDCSaaSAppCustomClaimOptional Name stringOptional The name of the claim. Link to this property Required boolOptional If the claim is required when building an OIDC token. Link to this property
Scope OIDCSaaSAppCustomClaimsScopeOptional The scope of the claim. One of the following: const OIDCSaaSAppCustomClaimsScopeGroups OIDCSaaSAppCustomClaimsScope = "groups" Link to this property const OIDCSaaSAppCustomClaimsScopeProfile OIDCSaaSAppCustomClaimsScope = "profile" Link to this property const OIDCSaaSAppCustomClaimsScopeEmail OIDCSaaSAppCustomClaimsScope = "email" Link to this property const OIDCSaaSAppCustomClaimsScopeOpenid OIDCSaaSAppCustomClaimsScope = "openid" Link to this property
Link to this property
Source OIDCSaaSAppCustomClaimsSourceOptional Name stringOptional The name of the IdP claim. Link to this property NameByIdP map\[string, string]Optional A mapping from IdP ID to claim name. Link to this property
Link to this property
Link to this property
GrantTypes \[]OIDCSaaSAppGrantTypeOptional The OIDC flows supported by this application One of the following: const OIDCSaaSAppGrantTypeAuthorizationCode OIDCSaaSAppGrantType = "authorization\_code" Link to this property const OIDCSaaSAppGrantTypeAuthorizationCodeWithPKCE OIDCSaaSAppGrantType = "authorization\_code\_with\_pkce" Link to this property const OIDCSaaSAppGrantTypeRefreshTokens OIDCSaaSAppGrantType = "refresh\_tokens" Link to this property const OIDCSaaSAppGrantTypeHybrid OIDCSaaSAppGrantType = "hybrid" Link to this property const OIDCSaaSAppGrantTypeImplicit OIDCSaaSAppGrantType = "implicit" Link to this property
Link to this property GroupFilterRegex stringOptional A regex to filter Cloudflare groups returned in ID token and userinfo endpoint Link to this property
HybridAndImplicitOptions OIDCSaaSAppHybridAndImplicitOptionsOptional ReturnAccessTokenFromAuthorizationEndpoint boolOptional If an Access Token should be returned from the OIDC Authorization endpoint Link to this property ReturnIDTokenFromAuthorizationEndpoint boolOptional If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property RedirectURIs \[]stringOptional The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
RefreshTokenOptions OIDCSaaSAppRefreshTokenOptionsOptional Lifetime stringOptional How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
Scopes \[]OIDCSaaSAppScopeOptional Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: const OIDCSaaSAppScopeOpenid OIDCSaaSAppScope = "openid" Link to this property const OIDCSaaSAppScopeGroups OIDCSaaSAppScope = "groups" Link to this property const OIDCSaaSAppScopeEmail OIDCSaaSAppScope = "email" Link to this property const OIDCSaaSAppScopeProfile OIDCSaaSAppScope = "profile" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20oidc_saas_app%20%3E%20(schema)>)
type SaaSAppNameIDFormat string The format of the name identifier sent to the SaaS application. One of the following: const SaaSAppNameIDFormatID SaaSAppNameIDFormat = "id" Link to this property const SaaSAppNameIDFormatEmail SaaSAppNameIDFormat = "email" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saas_app_name_id_format%20%3E%20(schema)>)
type SAMLSaaSApp struct{…}
AuthType SAMLSaaSAppAuthTypeOptional Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: const SAMLSaaSAppAuthTypeSAML SAMLSaaSAppAuthType = "saml" Link to this property const SAMLSaaSAppAuthTypeOIDC SAMLSaaSAppAuthType = "oidc" Link to this property
Link to this property ConsumerServiceURL stringOptional The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property
CustomAttributes \[]SAMLSaaSAppCustomAttributeOptional FriendlyName stringOptional The SAML FriendlyName of the attribute. Link to this property Name stringOptional The name of the attribute. Link to this property
NameFormat SAMLSaaSAppCustomAttributesNameFormatOptional A globally unique name for an identity or service provider. One of the following: const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatUnspecified SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatBasic SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatURI SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property Required boolOptional If the attribute is required when building a SAML assertion. Link to this property
Source SAMLSaaSAppCustomAttributesSourceOptional Name stringOptional The name of the IdP attribute. Link to this property
NameByIdP \[]SAMLSaaSAppCustomAttributesSourceNameByIdPOptional A mapping from IdP ID to attribute name. IdPID stringOptional The UID of the IdP. Link to this property SourceName stringOptional The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property DefaultRelayState stringOptional The URL that the user will be redirected to after a successful login for IDP initiated logins. Link to this property IdPEntityID stringOptional The unique identifier for your SaaS application. Link to this property NameIDFormat SaaSAppNameIDFormatOptional The format of the name identifier sent to the SaaS application. Link to this property NameIDTransformJsonata stringOptional A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property SAMLAttributeTransformJsonata stringOptional A \[JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml\_attributes or oidc\_fields of the identity provider used to authenticate. The output of this expression must be a JSON object. Link to this property SPEntityID stringOptional A globally unique name for an identity or service provider. Link to this property SSOEndpoint stringOptional The endpoint where your SaaS application will send login requests. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saml_saas_app%20%3E%20(schema)>)
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_http_basic%20%3E%20(schema)>)
type SCIMConfigAuthenticationOAuthBearerToken struct{…} Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationOAuthBearerTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth_bearer_token%20%3E%20(schema)>)
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth2%20%3E%20(schema)>)
type SCIMConfigMapping struct{…} Transformations and filters applied to resources before they are provisioned in the remote SCIM service. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_mapping%20%3E%20(schema)>) type SelfHostedDomains string A domain that Access will secure. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20self_hosted_domains%20%3E%20(schema)>) #### Zero TrustAccessApplicationsCAs ##### [List short-lived certificate CAs](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/list) client.ZeroTrust.Access.Applications.CAs.List(ctx, params) (\*V4PagePaginationArray\[[CA]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/ca ##### [Get a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/get) client.ZeroTrust.Access.Applications.CAs.Get(ctx, appID, query) (\*[CA](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### [Create a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/create) client.ZeroTrust.Access.Applications.CAs.New(ctx, appID, body) (\*[CA](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### [Delete a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/delete) client.ZeroTrust.Access.Applications.CAs.Delete(ctx, appID, body) (\*[AccessApplicationCADeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### ModelsExpand Collapse
type CA struct{…} ID stringOptional The ID of the CA. maxLength48 Link to this property AUD stringOptional The Application Audience (AUD) tag. Identifies the application associated with the CA. maxLength64 Link to this property PublicKey stringOptional The public key to add to your SSH server configuration. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.cas%20%3E%20(model)%20ca%20%3E%20(schema)>) #### Zero TrustAccessApplicationsUser Policy Checks ##### [Test Access policies](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/user_policy_checks/methods/list) client.ZeroTrust.Access.Applications.UserPolicyChecks.List(ctx, appID, query) (\*[AccessApplicationUserPolicyCheckListResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/user\_policy\_checks #### Zero TrustAccessApplicationsPolicies ##### [List Access application policies](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/list) client.ZeroTrust.Access.Applications.Policies.List(ctx, appID, params) (\*V4PagePaginationArray\[[AccessApplicationPolicyListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies ##### [Get an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/get) client.ZeroTrust.Access.Applications.Policies.Get(ctx, appID, policyID, query) (\*[AccessApplicationPolicyGetResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### [Create an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/create) client.ZeroTrust.Access.Applications.Policies.New(ctx, appID, params) (\*[AccessApplicationPolicyNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies ##### [Update an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/update) client.ZeroTrust.Access.Applications.Policies.Update(ctx, appID, policyID, params) (\*[AccessApplicationPolicyUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### [Delete an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/delete) client.ZeroTrust.Access.Applications.Policies.Delete(ctx, appID, policyID, body) (\*[AccessApplicationPolicyDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### ModelsExpand Collapse
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20access_device_posture_rule%20%3E%20(schema)>)
type AccessRule interface{…} Matches an Access group. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property